Devilz Linux

Asynchronous digital subscriber line (DSL or ADSL) modem is a device used to connect a computer or router to a telephone line which provides the digital subscriber line service for connectivity to the Internet, which is often called DSL or ADSL broadband. In this guide I will show you show you how to scan IP range for connected ADSL or DSL modem routers and find DSL ADSL router hack remotely. This guide applies to Windows, Linux or Mac, so it doesn’t matter what’s your Operating system is, you can try the same steps from all these operating systems. The term DSL or ADSL modem is technically used to describe a modem which connects to a single computer, through a USB port or is installed in a computer PCI slot. The more common DSL or ADSL router which combines the function of a DSL or ADSL modem and a home router, is a standalone device which can be connected to multiple computers through multiple Ethernet ports or an integral wireless access point. Also called a residentia...

Force Reverse DNS Resolution The -R parameter instructs Nmap to always perform reverse DNS resolution on the target IP address. Usage syntax: nmap -R [target] # nmap -R 64.13.134.52 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-13 17:22 Central Daylight Time Interesting ports on scanme.nmap.org (64.13.134.52): Not shown: 993 filtered ports PORT STATE 25/tcp closed smtp SERVICE 53/tcp open 70/tcp closed gopher 80/tcp open 110/tcp closed pop3 113/tcp closed auth domain http 31337/tcp closed Elite Nmap done: 1 IP address (1 host up) scanned in 9.38 seconds Output of a Nmap scan with reverse DNS enabled By default, Nmap will only do reverse DNS for hosts that appear to be online. The -R option is useful when performing reconnaissance on a block of IP addresses as Nmap will try to resolve the reverse DNS information of every IP address. The reverse DNS information can reveal interesting information about the target IP address (even if it is offline or blocking Nmap...

Traceroute The --traceroute parameter can be use to trace the network path to the specified host. Usage syntax: nmap --traceroute [target] # nmap --traceroute scanme.insecure.org Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:01 CDT Interesting ports on scanme.nmap.org (64.13.134.52): Not shown: 996 filtered ports PORT STATE SERVICE 53/tcp open domain 70/tcp closed gopher 80/tcp open http 113/tcp closed auth TRACEROUTE (using port 113/tcp) HOP RTT ADDRESS 1 0.91 home (192.168.1.254) 2 24.40 99-60-32-2.lightspeed.wchtks.sbcglobal.net (99.60.32.2) 3 23.12 76.196.172.4 4 22.69 151.164.94.52 5 32.79 ex3-p12-0.eqdltx.sbcglobal.net (69.220.8.53) 6 32.74 asn2828-XO.eqdltx.sbcglobal.net (151.164.249.134) ... 13 74.90 ip65-46-255-94.z255-46-65.customer.algx.net (65.46.255.94) 14 75.01 scanme.nmap.org (64.13.134.52) Nmap done: 1 IP address (1 host up) scanned in 33.72 seconds Output of a traceroute scan The information displayed is similar to the traceroute or tracepath commands fou...

ICMP Timestamp Ping The -PP option performs an ICMP timestamp ping. Usage syntax: nmap -PP [target] # nmap -PP 192.168.1.254 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:27 CDT Interesting ports on home (192.168.1.254): Not shown: 998 closed ports PORT STATE SERVICE 80/tcp open 443/tcp open http https MAC Address: 00:25:3C:5F:5A:89 (2Wire) Nmap done: 1 IP address (1 host up) scanned in 1.83 seconds Performing an ICMP timestamp ping While most firewalled systems are configured to block ICMP echo requests, some improperly configured systems may still reply to ICMP timestamp requests. This makes -PP useful for attempting to solicit responses from firewalled targets. ICMP Address Mask Ping The -PM option performs an ICMP address mask ping. Usage syntax: nmap -PM [target] # nmap -PM 192.168.1.254 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:26 CDT Interesting ports on home (192.168.1.254): Not shown: 998 closed ports PORT STATE SERVI...

ICMP Echo Ping The -PE option performs an ICMP (Internet Control Message Protocol) echo ping on the specified system. Usage syntax: nmap -PE [target] # nmap -PE 192.168.1.254 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:26 CDT Interesting ports on home (192.168.1.254): Not shown: 998 closed ports PORT STATE SERVICE 80/tcp open 443/tcp open http https MAC Address: 00:25:3C:5F:5A:89 (2Wire) Nmap done: 1 IP address (1 host up) scanned in 1.89 seconds Performing an ICMP echo ping The -PE option sends a standard ICMP ping to the target to see if it replies. This type of discovery works best on local networks where ICMP packets can be transmitted with few restrictions. Many internet hosts, however, are configured not respond to ICMP packets for security reasons. Note The -PE option is automatically implied if no other ping options are specified.

SCTP INIT Ping The -PY parameter instructs Nmap to perform an SCTP INIT ping. Usage syntax: nmap -PY[port1,port1,etc] [target] # nmap -PY 192.168.1.254 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:28 CDT Interesting ports on home (192.168.1.254): Not shown: 998 closed ports PORT STATE SERVICE 80/tcp open 443/tcp open http https MAC Address: 00:25:3C:5F:5A:89 (2Wire) Nmap done: 1 IP address (1 host up) scanned in 0.79 seconds  Performing a SCTP INIT ping This discovery method attempts to locate hosts using the Stream Control Transmission Protocol (SCTP). SCTP is typically used on systems for IP based telephony. note The default port for -PY is 80. Others can be specified by using the following syntax: nmap -PY22,25,80,443,etc.

TCP ACK Ping The -PA performs a TCP ACK ping on the specified target. Usage syntax: nmap -PA[port1,port1,etc] [target] # nmap -PA 192.168.1.254 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:31 CDT Interesting ports on home (192.168.1.254): Not shown: 998 closed ports PORT STATE SERVICE 80/tcp open 443/tcp open http https MAC Address: 00:25:3C:5F:5A:89 (2Wire) Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds Performing a TCP ACK ping The -PA option causes Nmap to send TCP ACK packets to the specified hosts. This method attempts to discover hosts by responding to TCP connections that are nonexistent in an attempt to solicit a response from the target. Like other ping options, it is useful in situations where standard ICMP pings are blocked.   note The default port for -PA is 80 , but others can be specified using the 50 following syntax: nmap -PA22,25,80,443,etc. UDP Ping The -PU option performs a UDP ping on the target system . Usage syntax: n...

TCP SYN Ping The -PS option performs a TCP SYN ping. Usage syntax: nmap -PS[port1,port1,etc] [target] # nmap -PS scanme.insecure.org Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:31 CDT Interesting ports on scanme.nmap.org (64.13.134.52): Not shown: 995 filtered ports PORT STATE SERVICE 53/tcp open domain 70/tcp closed gopher 80/tcp open 113/tcp closed auth http 31337/tcp closed Elite Nmap done: 1 IP address (1 host up) scanned in 27.41 seconds Performing a TCP SYN ping The TCP SYN ping sends a SYN packet to the target system and listens for a response. This alternative discovery method is useful for systems that are configured to block standard ICMP pingsNote . Note The default port for -PS is 80, but others can be specified using the following syntax: nmap -PS22,25,80,443,etc.

Ping Only Scan   The -sP option is used to perform a simple ping of the specified host. Usage syntax: nmap -sP [target] $ nmap -sP 192.168.10.2/24 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-08 20:54 CDT Host 192.168.10.1 is up (0.0026s latency). Host 192.168.10.100 is up (0.00020s latency). Host 192.168.10.101 is up (0.00026s latency). Nmap done: 256 IP addresses (3 hosts up) scanned in 3.18 second Output of a ping only scan This option is useful when you want to perform a quick search of the target network to see which hosts are online without actually scanning the target(s) for open ports. In the above example, all 254 addresses in the 192.168.10.0 subnet are pinged and results from live hosts are displayed . When scanning a local network, you can execute Nmap with root privileges for additional ping functionality. When doing this, the -sP option will perform an ARP ping and return the MAC addresses of the discovered system(s). Usage syntax: nmap -sP [target]...

Don’t Ping By default, before Nmap attempts to scan a system for open ports it will first ping the target to see if it is online. This feature helps save time when scanning as it causes targets that do not respond to be skipped. $ nmap 10.10.5.11 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-13 08:43 CDT Note: Host seems down. If it is really up, but blocking our ping probes, try -PN Nmap done: 1 IP address (0 hosts up) scanned in 3.16 seconds Results of a Nmap scan where the target system is not pingable In the above example the specified target is not scanned as it does not respond to Nmap’s pings. The -PN option instructs Nmap to skip the default discovery check and perform a complete port scan on the target. This is useful when scanning hosts that are protected by a firewall that blocks ping probes. Usage syntax: nmap -PN [target] $ nmap -PN 10.10.5.11 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-13 08:43 CDT Interesting ports on 10.10.5.11: Not shown: 999 fil...

  Discovery Options Discovery Options Overview Before port scanning a target, Nmap will attempt to send ICMP echo requests to see if the host is “alive.” This can save time when scanning multiple hosts as Nmap will not waste time attempting to probe hosts that are not online. Because ICMP requests are often blocked by firewalls, Nmap will also attempt to connect to port 80 and 443 since these common web server ports are often open (even if ICMP is not). The default discovery options aren’t useful when scanning secured systems and can hinder scanning progress. The following section describes alternative methods for host discovery which allows you to perform more comprehensive discovery when looking for available targets.

Scan an IPv6 Target The -6 parameter is used to perform a scan of an IP version 6 target . Usage syntax: nmap -6 [target] # nmap -6 fe80::29aa:9db9:4164:d80e Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-11 15:52 Central Daylight Time Interesting ports on fe80::29aa:9db9:4164:d80e: Not shown: 993 closed ports PORT STATE SERVICE 135/tcp open msrpc 445/tcp open microsoft-ds 5357/tcp open unknown 49152/tcp open unknown 49153/tcp open unknown 49154/tcp open unknown 49155/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 227.32 seconds Scanning an IPv6 address The example above displays the results of scanning an IP version 6 target. Most Nmap options support IPv6 with the exception of multiple target scanning using ranges and CIDR as they are pointless on IPv6 networks. note    Both the host and the target systems must support the IPv6 protocol in 44 order for a -6 scan to work.

Perform an Aggressive Scan The -A parameter instructs Nmap to perform an aggressive scan . Usage syntax: nmap -A [target] # nmap -A 10.10.1.51 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-10 09:39 CDT Interesting ports on 10.10.1.51: Not shown: 999 closed ports PORT STATE SERVICE VERSION 80/tcp open http Linksys WAP54G wireless-G router http config |_ html-title: 401 Unauthorized | http-auth: HTTP Service requires authentication |_ Auth type: Basic, realm = Linksys WAP54G MAC Address: 00:12:17:AA:66:28 (Cisco-Linksys) Device type: general purpose Running: Linux 2.4.X OS details: Linux 2.4.18 - 2.4.35 (likely embedded) Network Distance: 1 hop Service Info: Device: WAP OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.61 seconds Output of an aggressive scan The aggressive scan selects some of the most commonly used options within Nmap and is provided...

 Exclude Targets Using a List The --excludefile option is similar to the --exclude option and can be used to provide a list of targets to exclude from a network scan. $ cat list.txt 192.168.10.1 192.168.10.12 192.168.10.44 Text file with hosts to exclude from a scan The example below demonstrates using the --excludefile argument to exclude the hosts in the list.txt file displayed above. Usage syntax: nmap [targets] --excludefile [list.txt] $ nmap 192.168.10.0/24 --excludefile list.txt Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-08 20:49 CDT Interesting ports on 192.168.10.100: Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 2049/tcp open nfs Nmap done: 253 IP addresses (1 host up) scanned in 33.10 second Excluding a list of hosts from a network scan In the above example, the targets in the list.txt file are excluded from the scan. Exclude Targets Using a List The --excludefile option is ...

Exclude Targets from a Scan The --exclude option is used with Nmap to exclude hosts from a scan. Usage syntax: nmap [targets] --exclude [target(s)] $ nmap 192.168.10.0/24 --exclude 192.168.10.100 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-08 20:39 CDT Interesting ports on 192.168.10.1: Not shown: 996 filtered ports PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp closed ftp 23/tcp closed telnet 80/tcp open http ... Excluding a single IP fromhow  a scan The --exclude option is useful if you want to exclude specific hosts when scanning a large number of addresses. In the example above host 192.168.10.100 is excluded from the range of targets being scanned. The --exclude option accepts single hosts, ranges, or entire network blocks (using CIDR notation) as demonstrated in the next example. $ nmap 192.168.10.0/24 --exclude 192.168.10.100-105 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-08 20:39 CDT ... Excluding a range of IP addresses ...

Scan Random Targets The -iR parameter can be used to select random internet hosts to scan. Nmap will randomly generate the specified number of targets and attempt to scan them. Usage syntax: nmap -iR [number of targets] # nmap -iR 3 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07 23:40 CDT ... Nmap done: 3 IP addresses (2 hosts up) scanned in 36.91 seconds Scanning three randomly generated IP addresses  note For privacy reasons we do not display the results of the above scan in this book. Executing nmap -iR 3 instructs Nmap to randomly generate 3 IP addresses to scan. There aren’t many good reasons to ever do a random scan unless you are working on a research project (or just really bored). Additionally, if you do a lot of aggressive random scanning you could end up getting in trouble with your internet service provider.

Scan a List of Targets I f you have a large number of systems to scan, you can enter the IP address (or host names) in a text file and use that file as input for Nmap on the command line. $ cat list.txt 192.168.10.1 192.168.10.100 192.168.10.101 Target IP addresses in a text file The list.txt file above contains a list of hosts to be scanned. Each entry in the list.txt file must be separated by a space, tab, or newline. The -iL parameter is used to instruct Nmap to extract the list of targets from the list.txt file. Usage syntax: nmap -iL [list.txt] $ nmap -iL list.txt Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07 19:44 CDT Interesting ports on 192.168.10.1: Not shown: 997 filtered ports PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp closed ftp 80/tcp open http Interesting ports on 192.168.10.100: Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh ... Nmap scan using a list for target specification The resulting scan displayed above will be performed for each ...

Scan an Entire Subnet Nmap can be used to scan an entire subnet using CIDR (Classless Inter-Domain Routing) notation.   Usage syntax: nmap [Network/CIDR]   $ nmap 192.168.10.1/24 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07 20:43 CDT Interesting ports on 192.168.10.1: Not shown: 996 filtered ports PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp closed ftp 23/tcp closed telnet 80/tcp open http Interesting ports on 192.168.10.100: Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 2049/tcp open nfs Nmap done: 256 IP addresses (2 hosts up) scanned in 8.78 second Scanning an entire class C subnet using CDIR notation The above example instructs Nmap to scan the entire 192.168.10.0 network using CIDR notation. CIDR notation consists of the network address and subnet mask (in binary bits) separated by a slash. See Appendix C for a cross reference of subnet masks and their CIDR notatio...

Scan a Range of IP Addresses   A range of IP addresses can be used for target specification as demonstrated in the example below. Usage syntax: nmap [Range of IP addresses] $ nmap 192.168.10.1-100 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07 20:40 CDT Interesting ports on 192.168.10.1: Not shown: 997 filtered ports PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp closed ftp 80/tcp open http Interesting ports on 192.168.10.100: Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds Nmap done: 100 IP addresses (2 hosts up) scanned in 25.84 seconds Scanning a range of IP addresses In this example Nmap is instructed to scan the range of IP addresses from 192.168.10.1 through 192.168.10.100. You can also use ranges to scan multiple networks/subnets. For example typing nmap 192.168.1-100.* would scan the class C IP networks of 192.168.1.* through 192.168.100.*. NOTE The asterisk is a w...

Scan Multiple Targets Nmap can be used to scan multiple hosts at the same time. The easiest way to do this is to string together the target IP addresses or host names on the command line Usage syntax: nmap [target1 target2 etc] $ nmap 192.168.10.1 192.168.10.100 192.168.10.101 Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07 20:30 CDT Interesting ports on 192.168.10.1: Not shown: 997 filtered ports PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp closed ftp 80/tcp open http Interesting ports on 192.168.10.100: Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 2049/tcp open nfs Nmap done: 3 IP addresses (2 hosts up) scanned in 6.23 seconds Multiple target scan The example above demonstrates using Nmap to scan three addresses at the same time. Tip Since all three targets in the above example are on the same subnet you   could use the shorthand notation ...