When developing software or defending a network, it’s helpful to understand how malicious hackers hack. A dedicated attacker will fingerprint the intended host, starting first with available IP addresses and then perform TCP - and sometimes UDP - scans looking for active and listening TCP/IP ports. Each found port is then further fingerprinted to determine the listening application. For example, if port 80 is found, is it running Apache or IIS?

At InfoWorld.

[ Read more ]