RE: Disovering hosts using UDP services

["Alex Eden" <Alex.Eden () senet-int com>]

Onesixtyone is pretty fast and accurate...

DNSSCAN - I'm trying to compile right now - supposedly it's able to scan
whole networks for dns servers...

What about amap? It's not very elegant, but works for me. I don't have
nmap-generated host file, so I do (in csh)

foreach i ("`cat target.hosts.txt`")
amap -u $i 53 >> DNS.servers.txt
end

For hosts input you can use nmap-generated hosts file, but for output would
still need to touch a file and append. Amap has "-o" option which is not done
right.

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Gleb Paharenko
Sent: Thursday, September 04, 2008 3:33 PM
To: pen-test () securityfocus com
Subject: Disovering hosts using UDP services

Dear list.

Often udp port scanning say with nmap -sU -pPort1,Port2,.. does not
give results as UDP services tends do not respond to malformed
packets. At the same time utilities which send good packets getting
results and allows to enumerate hosts on the net.  For example
ike-scan usually give you the VPN endpoints, while nmap will not be
able to do this. Another example - dns server, it will not respond to
nmap UDP packet, but will respond for good dns query.

I'm looking for tools which will allow enumerate
 - dns  53
 - snmp discover 161
 - windows discovery (135,139,138,445,137)
 - ntp discovery 123
 - ms sql 1434


I'm interested on your thoughts about advanced discovery techniques as well.

-- 
Best regards.
Gleb Pakharenko.
http://gpaharenko.livejournal.com
http://www.linkedin.com/in/gpaharenko

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in 
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------