Network Security Auditing Tools

Audit Your Network

Recommended references

You need to understand the fundamentals of TCP/IP before you can make sense of any of this!

The best single reference is Doug Comer's Internetworking with TCP/IP, Volume 1. It's well written and clearly tells the story of how the TCP/IP protocol suite works. Yes, it's a textbook and new copies of the latest edition can be pretty expensive. But investigate used copies, and remember that if you're just trying to learn the fundamentals of the main host protocols (Ethernet, ARP, IP, UDP, TCP, ICMP, and DNS), they haven't changed much in ages and an older edition may serve your needs.

Amazon 013608530X

Amazon 0321336313

Richard Stevens' TCP/IP Illustrated, Volume 1: The Protocols is another great reference, but it's more of an encyclopedia and it isn't easy reading.

Be careful when ordering either of Comer's or Stevens' books! Both wrote a three-volume series, in which the first volume (what you probably want) is about the protocols themselves, while the second and third volumes are about how to implement those protocols in an operating system (using BSD Unix as a case study) and how to write applications using those protocols.

Once you understand TCP/IP, you can start working with vulnerability scanners. Network Security Assessment, by Chris McNab, has an in-depth look at network scanning methods and application vulnerability detection and exploit.

TCP and UDP Ports

These TCP ports are used by common attacks. Use this to make sense of all those entries in your firewall logs. See the latest package of the Snort package for far more details. See dshield.org for reports on current scanning patterns.

Suspicious TCP and UDP Ports. Most of these are used for Windows worms and Trojans, a few are used for denial-of-service (DOS) and distributed denial-of-service (DDOS) attacks.

Analysis Tools

Analysis tools fit into major categories. Executive summary: use Nmap for port scanning and version detection, use OpenVAS or Nessus for vulnerability scanning.

Vulnerability Scanners

Vulnerability scanners can also provide warnings about apparent risks due to buggy network server software. Note that some just make assumptions based on banner details, while others may attempt an exploit to see if it works. Also, some of the commercial Windows-specific ones may give false-negative errors if run without remote administrative privileges:

Nessus is a very good tool. It used to be free but now it's expensive, and so...

OpenVAS or the Open Vulnerability Assessment System is a free fork of the Nessus project.

Sectools.org has nice lists of vulnerability scanners and also web vulnerability scanners.

Retina Network Security Scanner originally from eEye Digital Security, now BeyondTrust, has been the U.S. DOD standard vulnerability scanner.

The Penetrator Pen Testing Appliance from SecPoint uses a large set of remote signatures, updated daily.

The IP360 was originally from nCircle, now it's Tripwire IP360.

QualysGuard is a cloud-based scanner from Qualys.

Host-based analysis. So port 80 is open, and the banner says it's Apache 2.0.45, but now you must answer further question: What binary program has that port open, what shared libraries is it using, and what other files, sockets, and pipes does that process have open? And should I have complete confidence in all of this?

lsof answers your questions on UNIX-like systems (commercial UNIX, BSD, Linux, macOS). Either find lsof already included in your OS, or add it.

If you're stuck with Windows, try fport.exe, Vision, and the Process Explorer originally from NTSysInternals.

Other network scanners are found at: cotse.com and Purdue's CERIAS.

SHODAN is an interesting search engine for computer operating systems and server software versions. Rather than search web page content, SHODAN indexes servers, routers, and more, by their OS and version. It aggregates banners from well-known services. You can search for things like the list of all known FTP servers running the vulnerable version 2.6.0 of the Wu-Ftpd server, with a remote format string stack overwrite vulnerability.

Commercial vulnerability scanners aren't cheap. Here are prices from the June 20, 2011 Network World review:

The top 100 network security tools — short descriptions and links to get them: http://sectools.org/index.html

Use Snort to detect scans and other network attacks.

hping2 lets you send craft and send customized ICMP packets.

icmpenum is a distributed ICMP-based host enumerator and network census-taker.

Gibson Research Corporation has an interesting site — it will scan your host for you and report the results.

More tool FTP sites are at coast.cs.purdue.edu, ciac.llnl.gov, and ftp.funet.fi/.

Other tools:

• Detecting and dealing with TCP SYN flood attacks against Solaris.
• Dealing with TCP SYN flood attacks against Cisco routers.
• Test your system's IP stack robustness with ipsend.

DNS Authentication

Earlier versions of DNS are susceptible to DNS spoofing and other abuses. To fix your DNS, make sure you're running the latest version of BIND.

Then make sure you configure it correctly, see Team Cymru's Secure BIND Template.