6 Cs CL

CS383-Cyber Security and Cyber Laws 20DCS138
Practical: 6
Date:
Aim: Implementation to gather information from any PC’s connected to the LAN using whois,
port scanners, network scanning, IP scanners etc.
Theory:
Angry IP Scanner:
Angry IP Scanner is a free, lightweight, cross-platform, and open source tool to scan networks.
It helps you to scan a range of IP addresses to find live hosts, open ports, and other relevant
information of each and every IP address.
The good thing about Angry IP Scanner is that it lets you scan IP addresses in three different
ways. They are, the range you specified, a random IP address or a list of IP addresses from a
text file. You can easily select the scan mode from the drop-down menu next to the IP address
field.
Fig-6.1 Angry IP Scanner for Scanning a network
Once you close the summary window, you will see the list of all the IP address. You can also
see additional details in different “fetcher” columns. In case you are wondering, here’s what the
colored dots next to each IP address mean.
Red: The IP address is inactive, dead or there is no device connected to this IP address.3.
Blue: The IP address is either active or busy and not responding to the requests sent by Angry
IP Scanner. This usually will be your own IP Address.
Green: The IP address is active, and the device connected to it is responding to the requests
made by Angry IP Scanner. There may also be open ports.
ARPING
If traditional ICMP-based pings are no longer reliable unless you know in advance that there is
no firewall blocking ICMP echo requests, what other options exist? One option is an Address
Resolution Protocol (ARP) based ping using the arping utility.
To know why ARP pings are virtually guaranteed to work while ICMP pings may not, one
should understand the importance of ARP in networking. ARP is used by hosts on a network to
resolve IP addresses into Media Access Control (MAC) addresses, which can be interpreted as
a network interface’s unique serial number. Hosts on an Ethernet network use MAC addresses
rather than IP addresses to communicate.
When a host tries to create a connection to another host (on the same subnet), it first needs to
obtain the second host’s MAC address. In this process, Host A sends an ARP request to the
broadcast address of the subnet to which it is connected. Every host on the subnet receives this
broadcast, and the host with the IP address in question sends an ARP reply back to Host A with
its MAC address. After receiving the ARP reply from Host B, Host A can connect to Host B.
ARP is required for an Ethernet network to function properly, so it typically is not blocked by a
firewall. If ARP requests were blocked, no host would be able to “find” a computer on a network
and connect to it. For all intents and purposes, the system would be unplugged from the network.
(Tools do exist to filter ARP. The ebtables project provides these tools. Ebtables is similar in
both functionality and syntax to iptables, but whereas iptables works with TCP and UDP
protocols, ebtables works with ARP.)
One possible drawback to this system of using ARP to ping a host is that the ARP protocol is
not a routed protocol. If you are not on the same subnet as the host you are trying to connect to,
then this method is not going to work without first joining that subnet, which may or may not
be physically possible. Thus by sending an ARP request rather than an ICMP echo, you are
virtually guaranteed to get a reply.
Fig-6.2 Arping for Scanning a IP address
Zenmap
It is a GUI form of nmap

The purpose of using zenmap is providing user an UI.
Fig-6.3 Zenmap is nmap in GUI to scan a ports and networks

Whois
Whois is a protocol and a set of tools used to query information about domain names, IP
addresses, and other network resources. It is used to look up information about the registration
and ownership of a domain name, or the assignment of an IP address. The information that can
be obtained from a Whois query typically includes details such as the name of the registrant, the
date of registration, and the expiration date of the domain or IP address.
Whois can be used for various purposes, including:
Finding the contact information for a domain or IP address, including the registrant’s name,
address, phone number and email address.
Checking the availability of a domain name.
Identifying the owner of a website or IP address.
Researching the history of a domain or IP address, including past ownership and registration
details.
Fig-6.4 Whois command to scan the DNS and IP Address.
Masscan
Masscan is a high-speed TCP port scanner that can scan the entire internet in under 6 minutes.
It is open-source software that is designed to be fast, efficient, and highly configurable. Masscan
uses a technique called "SYN scanning" to scan for open ports on a given IP address or range of
IP addresses. It can also perform service detection, which means it can identify the type of
service running on a given port.
Fig-6.5 Masscan , The TCP port scanner (SYN Scanning)
Conclusion/Summary:
____________________________________________________________________________
____________________________________________________________________________
____________________________________________________________________________
____________________________________________________________________________
____________________________________________________________________________
Student Signature & Date Marks Evaluator Signature &

Date

6 Cs CL

Uploaded by

Copyright:

Available Formats

6 Cs CL

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

6 Cs CL

Uploaded by

Copyright:

Available Formats

CS383-Cyber Security and Cyber Laws 20DCS138

Fig-6.1 Angry IP Scanner for Scanning a network

Fig-6.2 Arping for Scanning a IP address

It is a GUI form of nmap

Fig-6.3 Zenmap is nmap in GUI to scan a ports and networks

Fig-6.4 Whois command to scan the DNS and IP Address.

Fig-6.5 Masscan , The TCP port scanner (SYN Scanning)

Student Signature & Date Marks Evaluator Signature &

You might also like