List Phases of Computer Attack The reconnaissance and probing phase is when an attacker collects information to figure out how to attack. This is like a blue print to find out what vulnerabilities exist within a network. They may search the internet to use DNS and ICMP tools within the TCP/IP protocol suite, Standard and customized SNMP tools, Port scanners and mappers, and security probes. The ICMP (Internet Control Management Protocol) ping commands are available on most computer operating systems. It enables attackers to verify that target systems are reachable. They can use the ping command with a number of extension flags to test direct reachability between hosts. The SMTP tools and port scanners are other methods of finding holes within a network. Once an attacker reaches a target network, they may want to explore and see which systems and services are accessible. The attacker may want to use several port-scanning applications. NMap is one of the popular applications to use in this case. They allow an attacker to discover and identify hosts by performing ping sweeps, probe for open TCP and UDP service ports, and identify operating systems and applications running. Once an attacker probes a network for possible vulnerabilities, they must access the target systems. The goal is to establish the initial connection to a target host, and then gain administrative rights to the system. A method of gaining access is to capture or crack passwords. The attacker can install a password logger as a backdoor Trojan on a target machine to gain access to certain hosts and or administrative rights. They can also use a RAT (Remote Access Tool) to gain control remotely.