7.3 Banner Grabbing, Service Verification & Manual Triage

7.3 Banner Grabbing, Service Verification & Manual Triage

Automated vulnerability scanners rely on heuristics, pre-compiled plugin logic, and network banner matching. While automated scanning achieves rapid coverage across thousands of ports, professional penetration testers must manually verify scanner output before documenting findings or attempting exploitation. Flawed service detection, proxy interference, and Linux distribution backporting frequently distort automated findings. In accordance with CREST technical assessment standards, an analyst must be proficient in native command-line interrogation utilities, protocol-specific probing, and packet capture triage.

---

Manual Service Verification & Banner Grabbing Techniques

Banner grabbing is the manual interrogation of a network service to extract its initial software greeting, protocol version identifier, or operating system signature. Conducting manual verification allows the analyst to confirm whether a service is genuinely listening, determine its true operational state, and assess how it responds to unexpected input.

                                BANNER GRABBING TOOLKIT
+-----------------------------------------------------------------------------+
| Netcat (nc)              : Universal TCP/UDP socket reader/writer           |
| Telnet                   : Interactive plaintext terminal client            |
| OpenSSL s_client         : SSL/TLS cryptographic wrapper & STARTTLS client  |
| Nmap Service Scan (-sV)  : Automated protocol signature matcher             |
+-----------------------------------------------------------------------------+

1. Netcat (nc): The TCP/UDP Swiss Army Knife

Netcat establishes direct raw connections to transport-layer sockets, transmitting arbitrary input and reading output directly from the stream:

# Banner grabbing against an unencrypted FTP service on port 21
nc -vn 192.168.10.50 21

# Banner grabbing against an unencrypted SSH service on port 22
nc -vn 192.168.10.50 22

# Scanning a port range with a 2-second timeout and zero-I/O mode
nc -vzn -w 2 192.168.10.50 20-25

• Command Flags Explained:
  • -v (Verbose): Instructs Netcat to print connection progress, listening status, and diagnostic messages.
  • -n (Numeric IP Only): Suppresses DNS hostname lookups. In penetration testing, disabling DNS resolution accelerates connection attempts and prevents leaking target IP addresses to corporate DNS logging infrastructure.
  • -z (Zero-I/O Mode): Directs Netcat to close the connection immediately upon establishing a handshake without sending data; frequently utilized for rapid connection checking.
  • -w [seconds] (Wait Timeout): Specifies the connection timeout threshold in seconds before abandoning an unresponsive socket.

2. Telnet: Interactive Terminal Probing

Although Telnet transmits credentials in unencrypted plaintext and has been deprecated for administrative management, the native telnet client remains a valuable diagnostic utility for interactive banner grabbing across ASCII-based protocols:

# Connecting to an SMTP mail transfer agent on port 25
telnet 192.168.10.50 25

3. OpenSSL s_client: Encrypted Protocol Interrogation

Modern enterprise services wrap application-layer protocols inside Transport Layer Security (TLS/SSL). Traditional tools like basic Netcat or Telnet cannot negotiate cryptographic handshakes and will either receive garbage ciphertext or be disconnected immediately. OpenSSL's s_client establishes the TLS tunnel, validates the cryptographic handshake, and exposes an interactive plaintext console to the underlying protocol.

# Inspecting an HTTPS web service on port 443 with CRLF line termination
openssl s_client -connect 192.168.10.50:443 -crlf

# Interrogating an encrypted SMTPS service on port 465
openssl s_client -connect 192.168.10.50:465 -crlf

# Performing STARTTLS negotiation on an explicit mail submission port (587)
openssl s_client -connect 192.168.10.50:587 -starttls smtp -crlf

# Performing STARTTLS negotiation on an IMAP email server (port 143)
openssl s_client -connect 192.168.10.50:143 -starttls imap -crlf

• Command Flags Explained:
  • -connect [host:port]: Designates the target IP address and destination port.
  • -crlf: Translates standard Unix newline characters ( ) into Carriage Return / Line Feed sequences ( ). Essential when interrogating protocols governed by RFC standards (such as HTTP, SMTP, and POP3) that mandate CRLF termination.
  • -starttls [protocol]: Sends protocol-specific plaintext commands to upgrade the unencrypted connection to TLS before launching the cryptographic handshake.

---

Protocol-Specific Interaction Probes

Different network services require tailored handshake sequences and application commands to disclose identifying version banners.

+-----------------------------------------------------------------------------+
|                    PROTOCOL-SPECIFIC PROBE SEQUENCES                        |
+-----------------------------------------------------------------------------+
| HTTP/HTTPS (Port 80/443)                                                    |
|   Probe:    HEAD / HTTP/1.0\r\n\r\n                                         |
|   Extracts: Server: Apache/2.4.41 (Ubuntu), X-Powered-By: PHP/7.4.3          |
+-----------------------------------------------------------------------------+
| SMTP (Port 25/587)                                                          |
|   Banner:   220 mail.enterprise.com ESMTP Postfix (Ubuntu)                  |
|   Probe:    EHLO attacker.com\r\n                                           |
|   Extracts: 250-STARTTLS, 250-VRFY, 250-SIZE 52428800                       |
+-----------------------------------------------------------------------------+
| FTP (Port 21)                                                               |
|   Banner:   220 (vsFTPd 3.0.3)                                              |
|   Probe:    SYST\r\n                                                        |
|   Extracts: 215 UNIX Type: L8                                               |
+-----------------------------------------------------------------------------+
| SSH (Port 22)                                                               |
|   Banner:   SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5                         |
|   Rule:     RFC 4253 mandates immediate version exchange before crypto.     |
+-----------------------------------------------------------------------------+

1. HTTP / HTTPS Probes

To extract web server software versions without downloading large page bodies, transmit a lightweight HTTP HEAD or OPTIONS request:

HEAD / HTTP/1.0

Observed Server Response:

HTTP/1.1 200 OK
Date: Mon, 14 Sep 2026 12:00:00 GMT
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3
Set-Cookie: PHPSESSID=d94k1f8s7g...; path=/; HttpOnly
Content-Type: text/html; charset=UTF-8

• Triage Extraction: Identifies the underlying web server daemon (Apache/2.4.41), the host operating system family (Ubuntu), backend application runtimes (PHP/7.4.3), and missing cookie security flags (e.g., absence of Secure or SameSite).

2. SMTP (Simple Mail Transfer Protocol - Port 25/587)

Upon establishing a TCP connection, RFC 5321 mandates that an SMTP server return a 220 service greeting banner. The analyst then transmits EHLO to enumerate supported capabilities:

S: 220 mail.corp.local ESMTP Exim 4.93 Mon, 14 Sep 2026 12:05:00 +0000
C: EHLO testing.local
S: 250-mail.corp.local Hello testing.local [192.168.1.100]
S: 250-SIZE 52428800
S: 250-8BITMIME
S: 250-PIPELINING
S: 250-STARTTLS
S: 250-VRFY
S: 250 HELP

• Triage Extraction: Confirms the mail transfer agent daemon (Exim 4.93), identifies whether user enumeration is permitted via the VRFY command, and determines message size constraints.

3. SSH (Secure Shell - Port 22)

Under RFC 4253 (SSH Transport Layer Protocol), when a TCP connection is established on port 22, both the server and client must immediately send an identification string ending with CRLF before initiating cryptographic key exchange:

nc -vn 192.168.1.50 22

Returned Identification String:

SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5

• Triage Extraction: Discloses the SSH protocol version (2.0), software version (OpenSSH 8.2p1), and the specific Linux distribution package build (Ubuntu-4ubuntu0.5).

---

Limitations of Banner Grabbing & Triage Pitfalls

While banner grabbing is fast and accessible, an analyst must never accept a raw service banner as definitive proof of vulnerability without understanding operational limitations.

1. Banner Obfuscation & Spoofing

System administrators can modify server configuration directives to mask, alter, or falsify service banners:

• Apache HTTP Server: The ServerTokens Prod directive reduces the public header to simply Server: Apache, stripping minor version numbers and operating system signatures. The ServerSignature Off directive removes footers from error pages.
• Nginx: The server_tokens off; directive suppresses version numbering, returning only Server: nginx.
• Deceptive Banners: Administrators may configure an OpenSSH server on Linux to return an IIS banner, intentionally misleading automated scanning tools.

2. The Enterprise Linux Backporting Paradox

The most pervasive cause of false positives in vulnerability assessment is package backporting across enterprise Linux distributions (such as Red Hat Enterprise Linux [RHEL], CentOS, Debian, and Ubuntu LTS):

+-----------------------------------------------------------------------------+
|                    THE BACKPORTING PARADOX EXPLAINED                        |
+-----------------------------------------------------------------------------+
| 1. Upstream Apache Project:                                                 |
|    Releases Apache 2.4.41 ---> Critical Bug Discovered                      |
|    Releases Apache 2.4.50 with security fix                                 |
+-----------------------------------------------------------------------------+
| 2. Red Hat / Debian Distribution Maintainers:                               |
|    * Refuse to upgrade base Apache to 2.4.50 to avoid breaking client APIs. |
|    * Extract ONLY the specific security patch code from 2.4.50.             |
|    * Apply patch directly into distribution package: 'httpd-2.4.41-4.el8'.  |
+-----------------------------------------------------------------------------+
| 3. Uncredentialed Scanner / Banner Grabbing Result:                         |
|    * Interrogates port 80 ---> Reads banner: 'Apache/2.4.41'                |
|    * Flags CRITICAL ALERT: CVE-2021-41773 is present! (FALSE POSITIVE)      |
+-----------------------------------------------------------------------------+

• Manual Verification Technique: An analyst must never rely on remote banners when auditing enterprise Linux systems. Credentialed access must be used to inspect local package changelogs:

  # Querying RPM package changelog for specific CVE patch records
  rpm -q --changelog httpd | grep -i CVE-2021-41773
  
  # Querying Debian/Ubuntu package changelog
  apt-get changelog apache2 | grep -i CVE-2021-41773
  

---

Packet Capture Analysis & Traffic Triage

During security assessments, capturing and inspecting raw network traffic using Wireshark or command-line tcpdump is critical to verify exploit payload execution, detect sensitive data leaks, and troubleshoot scanner anomalies.

                               PCAP TRIAGE WORKFLOW
+-----------------------------------------------------------------------------+
| 1. Capture Traffic    : tcpdump -i eth0 -nn -s 0 -w capture.pcap            |
| 2. Filter Display     : Isolate suspicious ports, IPs, or error status codes|
| 3. Reconstruct Stream : Follow TCP Stream to inspect payload & responses    |
| 4. Validate Impact    : Confirm code execution, credential leak, or crash   |
+-----------------------------------------------------------------------------+

1. Packet Capture with tcpdump

tcpdump captures network packets directly from the interface using the libpcap library:

# Capture full packet payloads on eth0 without name resolution, saving to file
tcpdump -i eth0 -nn -s 0 -w assessment_triage.pcap "tcp port 445 or tcp port 80"

# Read back captured pcap file filtering for SYN-ACK responses from target
tcpdump -r assessment_triage.pcap -nn "src host 192.168.10.50 and tcp[tcpflags] & tcp-syn != 0"

• Flags:
  • -nn: Suppresses hostname and service port resolution.
  • -s 0: Sets snapshot length to 0 (captures the complete packet payload without truncation).
  • -w [file]: Writes raw packets to disk in standard .pcap format.
  • -r [file]: Reads and parses an existing .pcap file.

2. Essential Display Filters for Assessment Triage

In Wireshark and tshark, display filters isolate specific protocol behaviors from millions of captured frames:

3. Reconstructing Raw PCAP Streams & Exploit Validation

When verifying whether a suspected vulnerability is genuinely exploitable without causing system harm:

1. Following the TCP Stream (tcp.stream eq X): Wireshark reconstructs the bidirectional application-layer conversation into a continuous ASCII or hexadecimal view. Analysts inspect the exact request transmitted by the testing tool and the corresponding response returned by the server daemon.
2. Validating Exploit Success: If an exploit payload targets a remote service, packet analysis determines whether the daemon executed the command (e.g., observing command output returned over the socket) or whether the target returned a TCP RST packet immediately following the payload, indicating that the service encountered an unhandled exception, crashed, and was terminated by the operating system kernel.
3. Uncovering Sensitive Information Leaks: Packet stream inspection reveals unencrypted passwords, API tokens, database connection strings, and stack trace dumps inadvertently leaked in verbose HTTP error responses.