angad

nmap ultra scan params - Vector Targets scan_list ports scantype timeout info

Steps

startTimeOutClocks(Targets)

angad

#!/usr/bin/perl -w
use strict;

# Copyright 2008, Andrew Ross andy@plausible.org
# Distributable under the terms of the GNU GPL, see COPYING for details

# The Android toolchain is ... rough.  Rather than try to manage the
# complexity directly, this script wraps the tools into an "agcc" that
# works a lot like a gcc command line does for a native platform or a
# properly integrated cross-compiler.  It accepts arbitrary arguments,

angad

##Port Scanning - Advanced

###SYN Half Open Scanning Send a SYN packet and Wait for response
SYN/ACK - Port open
RST - Port closed

Method

1. Find Source MAC address (Android WifiManager)
2. Find Destination MAC address (ARP Result)

angad

##Port Scanning Loop over the list of specified ports.

###TCP Socket

Open a socket to check if the port is available

Socket s = new Socket(hostAddress,currentPort);

Jmap specifies the timeout by the number of retries

angad

###Default ICMP echo request
TCP SYN Packet to port 443
TCP ACK packet to port 80
ICMP Timestamp request
ARP scan for local network

angad

cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
10.138.0.90      0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.108     0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.107     0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.9       0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.4       0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.78      0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.182     0x1         0x0         00:00:00:00:00:00     *        eth0
10.138.0.233     0x1         0x2         00:1c:df:7a:28:d3     *        eth0

angad

##GSoC Resources [List of important readings and codes for GSoC Android Network Scanner]

• nmap source
• libpcap
• tcpdump
• JNI

###nmap http://moonpie.org/writings/discovery.pdf

angad

#Sockets Programming [Source http://www.rites.uic.edu/~solworth/sockets.pdf]

##API socket : create a socket of domain, type, protocol
bind : assign a name to the socket
listen : specifies the number of pending connections that can be queued for a server socket
accept : server accepts a connection request from a client
connect : client requests a connection request to a server
send, sendto : write to a connection

angad

##libpcap for Android

###Android.mk

LOCAL_PATH := ./jni  

include $(CLEAR_VARS)  
LOCAL_MODULE    := pcaptest  
LOCAL_SRC_FILES := libpcap-native.c  

angad

	Process p;
		try {
			p = Runtime.getRuntime().exec("su");
			try {  
			      p.waitFor();  
			           if (p.exitValue() != 255) {  
			              // TODO Code to run on success  
			              Log.v("Sample_LIBPCAP_DEBUGGING", "ROOT");  
			           }  
			           else {