:::::::::   ::::::::  :::::::::  :::::::::: 
                        :+:    :+: :+:    :+: :+:    :+: :+:        
                        +:+    +:+ +:+        +:+    +:+ +:+        
                        +#++:++#+  +#++:++#++ +#++:++#:  :#::+::#   
                        +#+    +#+        +#+ +#+    +#+ +#+        
                        #+#    #+# #+#    #+# #+#    #+# #+#        
                        #########   ########  ###    ### ###  
                         
              	             http://blacksun.box.sk
                           _____________________________
    ______________________I          Topic:             I_____________________
   \                      I                             I                    /
    \     HTML by:        I   Possible Information      I   Written by:     /
    /                     I    leaks on servers         I                   \ 
   /   Digital Fallout    I_____________________________I  Digital Fallout   \
  /___________________________>Version 2.0, 10/13/2001<________________________\



What's New In This Version -

This is a near-complete re-write of Raven's original "info gathering tutorial" 
previously hosted on BSRF. It contains some of the original text from version
  1.8 I hope to make it more up to date, more accurate, and generally more 
useful to both computer novices and experienced server administrators.  
Although the original (before this version) was based on how to gather 
information about a specific user, this version will be focused on a server 
based platform. 

Opining Notes -

This paper is so you (the reader) is aware if some of the possible ways that 
you can learn about a server, what operating system it is running along with
 services (daemons), and possibly more importantly, so you cam be aware of 
possible security risks so you may take measures to fix them. 


Section 1 - The Port Scan

The port scanner, one of the most basic network tools out there. You as the 
admin should have one (preferable nmap, the de facto port scanner) because 
you can be sure that your possible attackers have them  The port scanner 
works by connection to every port (or selected ports) on your server to see 
wither or not it is accepting connections.  Depending what port is 
accepting the connection, it can be reasonably assumed that a specific 
service is running. For example, if you run a port scan on a server and 
find that port 80 is open, you can assume that this particular server is 
running an HTTP server. Please note that these are only default ports. It 
is quite possible to have an HTTP server running on port 91 or even 4503! 
But for the purpose of this paper, we will assume that the default ports 
are being used.

The Following is a list of common ports for specific services. For a 
complete list you may look at any number of other references or look at 
the "services" file in your /etc directory on a UNIX based system. 



Port

21     FTP
22     SSH
23     Telnet
25     SMTP
79     Finger
80     HTTP
110    POP3



Section 2- Default Banners

What is a banner? A banner is that thing you see when you try to telnet 
into a computer. For example this is the default banner to a  Linux Mandrake
version 6.1 computer

Linux Mandrake release 6.1 (Helios)
Kernel 2.2.13-4mdksmp on an i686
login:
          

What information do we see here? Well it is rather obvious. First off we 
know that this is a Linux operating system running the 2.2.13 kernel. We 
know that it is running the Mandrake Linux distribution, and we also know 
the architecture of the server (i686i). This is way more information that 
you would want any attacker to know. At this point the user could simply go 
to one of possibly hundreds of exploit sites and simply download a pre-made 
program and hack into your computer with little skill at all. 

Some other things you may wish to change on your computer to further hide 
information are the MOTD files in your /etc directory, and one of the most
overlooked file, is the COPYRIGHT files that got installed with your 
system, they to usually contain information about your server. Keep in 
mind that by using the uname command, allot of this can be bypassed but 
restrictions to that command should also be set. 




Section 3- Error Messages

Finally one of the major things you need to watch out for are error 
messages. By purposely not following expected procedure, a potential 
attacker can gain information. One of the most common errors  is the 
404 error. This error message is generated when an HTTP server is given a 
request for a file that does not exist.  However in the default page 
displayed when you get the error, you can look to the bottom of the page 
and find the version number of the server. This is usually harmless 
information by itself but it is still information that could assist a 
possible attacker. 



Closing Notes-

I hope this basic paper gave you some information on the possible ways 
you may accidentally broadcasting information about your server. Please 
note that this is by far not a complete list but it does show the three 
main ways information is gained about servers. Please visit 
Http://blacksun.box.sk for more information about computers and the 
internet

Useful links

http://blacksun.box.sk   <-- BSRF Homepage