+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: NTP Range (/showthread.php?tid=5757580)
NTP Range - FusionFunx - Nov 24, 2017
Hello community,
Sorry if it seems like my question[s] are a little basic. I have a NTP server scanner. What I would like to understand is, Are there better ranges to scan than others? Also is there a place in which I could find a list of IP's not to scan. ( Ones that will get me in trouble of course )
Also when testing the NTPS that I have found. I noticed when doing a test to see what the output will be. Sometimes it will say 8b x 4 = 36b for example. But then on others it will send more Bytes towards it.
I am also scanning from my own server hosted at home.
RE: NTP Range - Smileツ - Nov 24, 2017
There are some ranges that you should not scan, make your research..
RE: NTP Range - FusionFunx - Nov 24, 2017
Also another question. I know the better the internet connection and the server used. The better the requests will be. But lets say for example I wanted to issue these requests from my laptop at home. Is this a possibility as it works on the MONList right?
Meaning that this spoofing would not actually require a server and could be done from example a phone or pc / laptop or tablet?
RE: NTP Range - d3lta - Nov 24, 2017
(Nov 24, 2017 07:46 AM)FusionFunx Wrote: Hello community,
Sorry if it seems like my question[s] are a little basic. I have a NTP server scanner. What I would like to understand is, Are there better ranges to scan than others? Also is there a place in which I could find a list of IP's not to scan. ( Ones that will get me in trouble of course )
Also when testing the NTPS that I have found. I noticed when doing a test to see what the output will be. Sometimes it will say 8b x 4 = 36b for example. But then on others it will send more Bytes towards it.
I am also scanning from my own server hosted at home.
Go on Shodan and enter "port:123" if you want to get an idea of which ranges are best.
I would also recommend against scanning from home, eventually your ISP will receive abuse reports and they will contact you.
You won't get in any real trouble for just scanning, but you might get abuse reports if you scan honeypot ranges.
A spoofed server is necessary because many (if not most) hosting providers filter spoofed packets. So it can't be done from a phone or laptop
RE: NTP Range - FusionFunx - Nov 24, 2017
Thank you for putting in the effort for such a detailed response. So I was totally wrong that you could launch an NTP attack from a home computer? That's odd. As when I run Etherape on Kali when testing some of them, I can see them on the Nodes Map.
Why Is it you need a server for NTP but for XMLRPC attacks you do not need a spoofed server? What is the difference? Is there a way I can check to see if my ISP does filter spoofed packets for sure?
Thank you very much.
RE: NTP Range - meatyklackers - Nov 24, 2017
If you put what you said: "list of IP's not to scan" into google it gives you the list...I would post it but I'm sure I'm allowed to and I'm too lazy to read the rules at the moment. Good luck
RE: NTP Range - FusionFunx - Nov 24, 2017
Thanks for clearing that up. Could someone please explain why you think a dedicated server or a virtual server is required for this please? I have tested this out from my laptop and was able to send NTP requests which could be measured with a DSTAT. Is it just the case that my ISP allows spoofing ( Which I find very very odd )
I thought the NTP spoof was available just as simple as using proxies in the same method.