Week 2 Written Assignment

Banner Grabbing:
Understand the role of Banner Grabbing in determining the operating system running
on a remote target system and examine the various tools that are used to accomplish
it.
Introduction
Within an information system, each piece of information is important, it is always
crucial to know what is seen by the average user, by the attacker or by the technical
teams. Today we will study what banner grabbing is and why it is important for the
proper management of IS security.
Definition
Banner grabbing is the act of retrieving, after a first connection to a port and a
targeted service, the name of the service running on this port as well as possibly its
version. In fact, for the sake of clarity and sometimes to simplify exchanges, most
services advertise information on the network to customers after their connection
request. When an attacker does banner grabbing, he is always in the "fingerprinting"
phase, that is to say he will seek to establish a network and systems map and thus
draw up a list of what is present. Banner grabbing is quite simply the fact of opening
a TCP session on a given port and basically exchanging with the service therein to
analyze its responses and more or less easily determine its type and version.

Types of banner grabbing

a. Actif banner grabbing

This method of banner grabbing is rarely used, but has the advantage of being the
most discreet. We're not going to get the information, but rather wait for it to pass
through our ports. For example, we will perform network sniffing and then study the
packets that pass in order to find a banner on a given port and IP.

b. Passif banner grabing

This method of banner grabbing is rarely used, but has the advantage of being the
most discreet. We're not going to get the information, but rather wait for it to pass
through our ports. For example, we will perform network sniffing and then study the
packets that pass in order to find a banner on a given port and IP.

Banner grabbing, when services say too much

Banner grabbing is mainly used in the security world by attackers. Indeed, after trying
to find the active IPs on a network and the open ports on them, we will try to find out
what the services and their versions are. Banner grabbing is therefore an element to
take into account when looking at the security of an information system. We must
indeed control all the information that comes out of our servers and in the context of
an intrusion test or an attack, the fact that a server announces its version is
information that is too much.

An attacker doing banner grabbing, which is also often automated using tools like
nmap, will quickly be able to detect active services, but especially obsolete and
vulnerable versions of them. This is when banner grabbing appears to be a danger.
This is information that greatly facilitates the work of attackers and therefore
deserves to be checked, the response of the service to the obsolete version to an
attacker is as clear as "I am a vulnerable service, I have not been updated for three
years! ".

Tools to perform the technique of banner grabbing

Below are some of the most popular and top tools available for using the Banner
Grabbing technique.

1. Telnet: It is the most popular and best tool for using the technique of banner
Grabbing. Telnet web tool is the cross-platform that is available which helps to
interact with remote servers for banner grabbing. Telnet allows querying any
service, only by typing telnet IP PORT, where IP represents the IP address of the
network and PORT represents the portal where the remote host is running.
2. Wget: This tool is popularly used for Active Banner Grabbing, as this tool helps to
connect to the remote host or the localhost. The syntax used for Wget is IP
address -q -S, where IP address is the address of the network, -q will help to
suppress the output, and -S is used as the parameter that will print the header file
sent by the HTTPS server and FPS server.
3. cURL: works exactly the same as Wget. It also connects to the remote host or the
localhost but the only difference is in the syntax format. The syntax used
for cURL is curl -s -I IP address | grep -e “Server:”, where -s is responsible for
avoiding showing the process of error messages i.e., it mutes the output, -I am the
parameter that is responsible for showing header file all the requested pages. At
last, grep is used to get the final output from the server.
4. Nmap: It is an amazing tool to perform Banner Grabbing. It helps to get
information from the targeted system in a very easy way. The syntax used to
make use of Nmap is nmap –sV –version-intensity 5 site_name -p 80, where -sV
allows to lean the software version, and writing –version-intensity 5, the sender
can get the maximum information needed from the targeted system.
5. NC: NetCat or NC is another tool used for fetching information using the banner
grabbing technique. It is known to be the oldest and the most popular tool used
on UNIX ad Linux. For using this tool, the syntax is written as nc -V IP POST. This
helps in getting the FPS banner and the latest software version.
6. ASR: ASR stands for Attack Surface Reduction and it is one the best tools available
to reduce the attack area. ASR tool is considered ideal for IT managers and
 security leaders. This web tool will help in discovering unseen areas of your
online assets.

Conclusion

The technique of banner Grabbing can be used by the authorities to get credential
information from some systems and can also be used by the non-ethical hackers who
would try to invade and steal information from the targeted system for authorities.
The former one is known as white hat hacking while the latter one is called grey
hacking. Banner Grabbing helps tally the information available on a system by
connecting to its host server. The banner grabbing technique is of two types, one is
Active Banner Grabbing while the other one is Passive Banner Grabbing. There are
several tools available for attempting Banner Grabbing. Few examples of these tools
are telnet, cURL , Wget, etc.

References: https://www.jigsawacademy.com/blogs/cyber-security/banner-grabbing/
https://en.wikipedia.org/wiki/Banner_grabbing
https://www.it-connect.fr/quest-ce-que-le-banner-grabbing/