Network Scanning refers to the set of procedures adopted for identifying a network’s hosts

Network Scanning refers to the set of procedures adopted for
identifying a network’s hosts, ports and services. It is one of the
key components of intelligence gathering that attackers use to
create a profile of the target organization
It has the following main objectives

1. Scanning
Networks
1
@mmar

2. Network Scanningrefers to the set of procedures adopted for
identifying a network’s hosts, ports and services. It is one of the
key components of intelligence gathering that attackers use to
create a profile of the target organization
It has the following main objectives:
Discover live hosts, IP addresses and open ports of all live hosts
Discover OS and system architecture
Discover services running on hosts
Discover vulnerabilities on live hosts

3. NMAP
3
Nmap is a free and open‐source network scanner. Nmap is used to
discover hosts and services on a computer network by sending
packetsandanalyzingtheresponses
Nmapprovidesanumberoffeaturesforprobingcomputernetworks,
includinghostdiscoveryandserviceandoperatingsystemdetection.
These features areextensible byscripts that providemoreadvanced
service detection, vulnerability detection, and other features. Nmap
can adapt to network conditions including latency and congestion
duringascan

4. PortStates
•
While many port scanners have traditionally labelled all ports into the openor
closed states,Nmapismuchmoregranular.
•
It divides portsinto sixstates: open,closed,filtered,unfiltered,open|filtered,or
closed|filtered
•
These states are not intrinsic properties of the port itself, but describe how
Nmap sees them
•
For example, an Nmap scan from the samenetwork as the target may show port
135/tcp asopen, while a scan at the same time with the same options from across
theInternetmightshowthatportasfiltered

5. PortStates •
open– indicates that an application is listening for connections on the port. The primary goal of port
scanningistofindthese.
•
closed–indicatesthat theprobeswerereceivedbutthere is noapplicationlisteningontheport.
•
filtered–indicatesthat theprobeswerenotreceived, andthestate could notbeestablished.
•
unfiltered –indicates that the probes were received but a state could not be established. In other
words,aportis accessible,butNmap isunable todetermine whether itis openorclosed.
•
open/filtered–indicatesthat theportwasfilteredoropen,but Nmapcouldn’testablishthestate.
•
closed/filtered–indicatesthatNmapis unable todetermine whether aportis closedorfiltered.

6. TCP Header
6

7. TCP

Handshake
7

8. Connection

termination
8

9. SCAN TYPES
9

10. Nmap Scan

types
10

11. Ping Scan
11
Ping scan is used to scan for the live hosts on the network
>nmap–sn192.168.18.1/24

12. TCP scan will scan for TCP ports and ensure for listening 
port   (open)   through a 3‐way   handshake   connection   
between the source and destination port
TCP Connect Scan
12
>nmap–sT192.168.18.1

13. TCPConnect
Scan/FullOpenScan
•
TheScandoes this take longer and require more packets to obtain the same
information,buttargetmachinesaremorelikelytologtheconnection
•
If the port is open then source made request withSYNpacket, a response
destination sentSYN, ACKpacket and then source sentACKpackets, at last
sourceagainsentRST,ACKpackets

14. 
This scan is often referred to as half‐open scanning because yo u don't 
open a full TCP connection. You send an SYN packet, as if you a re going 
to open a real connection and then wait for a response
TCP SynScan
14
>nmap–sS192.168.18.1

15. TCPSYN
Scan/StealthScan
•
SYN scan is the default and most popular scan o ption for good reasons. It can be performed
quickly, scanning thousands of ports per second on a fast network not hampered by restrictive
firewalls
•
ASYN/ACKindicatestheportislistening(open),whileRST(reset)isindicativeofa
non‐listener. If no response is received after several retransmissions, the port is marked as
filtered
•
TheportisalsomarkedfilteredifanICMPunreachableerror(type3,code0,1,2,3,9,10,or13)is
received

16. 
UDP scan works by sending a UDP packet to every targeted port.  For 
most ports, this packet will be empty (no payload), but for a f ew of the 
more common ports a protocol‐specific payload will be sent
UDP Scan
16
>nmap–sU192.168.18.110

17. UDPScan
•
UDPisaconnectionlessprotocolandthere's noprotocol‐definedrelationshipbetween
packetsin either direction
•
However, mostOS TCP/IPstackswillreturnanICMP“PortUnreachable”packetif aUDP
packetissenttoaclosedUDPport
•
Thus,a portthat doesn't return anICMPpacketcanbe assumedopen
•
Neitherthe probe‐packetnoritspotentialICMPpacketare guaranteedto arrive

18. 
FINSCANisoneoftheportscanningmethodsinNmap,whichusesthe
sheer stupidity of old and stateless firewalls. In fact, when it comes to
FIN Scan, our Port Scanner software sends a packet with a flag in the
form of FIN meaning the end of the session to the destination firewall
orhost.Ifnoresponseisreceived,itmeansthattheportisopen,andif
thereturnisRST//ACK,itmeansthattheserverportisclosed
FIN Scan
18
>nmap–sF192.168.18.110

19. FINScan
•
A FIN bit is used to terminate the TCP connection between the source and
destinati
•
Here, rat
sendsas
•
If the tar
onporttypicallyafterthedatatransferiscomplete
her than even pretending to initiate a standard TCP conn
ingleFIN(final)packet
get's TCP/IP stack is RFC‐793‐compliant then open ports
dclosedports willsendanRST
ection, nmap
will drop the
packetan

20. NULL and XMAS 
Scans
•
NULLandXMASscantypesareexactlythesameinbehaviorexceptfortheTCPflagssetin
probe packets. If a RST packet is received, the port is considered closed, while no response
meansitisopen|filtered.
•
TheportismarkedfilteredifanICMPunreachableerror(type3,code0,1,2, 3,9, 10, or13)is
received
•
XMASscansare designedtomanipulate thePSH,URGand FINflagsoftheTCPheader,Sets
theFIN,PSH, andURGflags,lightingthepacketuplikeaChristmastree. Whensourcesent
FIN,PUSH,andURGpackettoaspecificportand iftheportisopenthendestinationwill
discardthepacketsandwillnotsendanyreplytothe source
•
A Null Scan is a series of TCP packets which hold a sequence number of “zeros”
(0000000). since there are none flags set, the destination will not know how to
reply the request.It will discard the packet and no reply will be sent, which indicate
that the port isopen

21. NMAP

CHEATSHEET

22. NMAP

CHEATSHEET

23. THANKS
23