Banner Grabbing Explained For Beginners

What Is A Banner?

Well we try to connect to a port (i.e. the service running on that port) then it responds to our request and the header of the packet sent by the service in response contains some information about the service and this is called Banner.

What Is Banner Grabbing

The processor of fetching banner of a service is called Banner Grabbing. Most common services that we are likely to grab banner for are Hyper Text Transfer Protocol (HTTP) which runs on port 80, Simple Mail Transfer Protocol (SMTP) which runs on port 25 and File Transfer Protocol (FTP) which runs on port 21.
Why We Need Banner Grabbing?
Well these banners can reveal a lot of sensitive information about the services running on the target machine.
For example you if you are able to grab banner for FTP you may find out the FTP Client in use by the target machine. This type of information about the services will help us to choose the right exploits.

How To Do Banner Grabbing

You can do banner grabbing with telnet or netcat but I will be using Netcat because my computer my rules. *trying to be funny*
Well I have a target here: 103.25.131.117
So first thing I will do is a port scan with nmap because before banner grabbing I would need to know which ports are open on target machine.
So here is the result of the port scan:






Now lets try to grab the banner for HTTP,
Open terminal and enter nc -v 103.25.131.117 80
Here, nc stands for netcat, -v is an option which tells the program to be more verbose i.e. to show the output in detail, 103.25.131.117 is our target server (you can also use a domain as a target) and 80 is the target port.
So here is what we got:



Its a Microsoft-HTTPAPI/2.0 server.
Some people be like hey I know about banner grabbing. I read about it on some blog and they used GET HTTP instead of GET HTTP 1/1.
Well if you are thinking the same then look at this:



See? You can try to enter anything and the output will be same.
Now lets grab the banner for FTP
Open terminal and enter nc -v 103.25.131.117 21
And in no time I have this:



So see? They are running the native Microsoft FTP Service and believe me this information comes in handy when you try to exploit the target.
Well this is how you grab banners but who got time for grabbing banners one by one?
This is why some wise guy created a nmap script for lazy (smart) guys like me.
NMap has a script which looks for open ports and tries to grab banner for them.
To use the script I will pass the following command to the terminal nmap -sV –script=banner 103.25.131.117
It will take a bit longer than a normal scan but it worths it.
Now lets look at the results:



See? Its so easy and effective and it also guessed that target machine is probably running windows.
So that’s all folks. I hope you enjoyed this article.