CEH

106 Chapter 5 ■ Scanning Networks

Vulnerability Scan A vulnerability scan is used to identify weaknesses or vulnerabilities

on a target system. This type of scan is quite commonly done as a proactive measure with

the goal of catching problems internally before an attacker is able to locate those same vul-

nerabilities and act on them.

Checking for Live Systems

How do you check for live systems in a targeted environment? There are plenty of ways to

accomplish this. Some common ways to perform these types of scans are:

■ Wardialing

■ Wardriving

■ Pinging

■ Port scanning

Each of these techniques, along with others we will explore, offers something that the

others don’t, or at least don’t offer in the same way. Once you understand these differences,

you should have a much better idea of how to deploy these methods in a penetration test.

When looking at these methods, keep in mind that you should be paying

attention to the areas in which each is strong and those areas in which they

are weak. Deploying the wrong one could easily waste time as well as alert

the system owner to your presence, thus giving them time to react to your

attack.

Wardialing

The first type of scan is an old but useful one known as wardialing. Wardialing has existed

in an almost unchanged state since the mid-1980s and has stayed around so long because

it has proven to be a useful information-gathering tool. In practice, wardialing is extremely

simple compared to our other forms of scanning in that it simply dials a block of phone

numbers using a standard modem to locate systems that also have a modem attached

and accept connections. On the surface, this type of technique seems to be the digital

equivalent of the dinosaur, but don’t let that fool you—the technique is still very useful.

Understand that modems are still used for a number of reasons, including the low cost

of the technology, ease of use, and the availability of phone lines, which are pretty much

everywhere. Modems are still so commonly used that an attacker can easily dial a block of

phone numbers in just about any town and locate a good number of computers still using

dial-up to attach to the outside world.