Module 03 - Scanning Networks

Module 03 - Scanning Networks¶

Type of Scanning¶

TCP/IP Protocol Suite¶

TCP Communication Flags¶

hping3 Command Options¶

nmap Command Options¶

Host Discovery Techniques¶

| Technique | Description |Advantage | Active Responses | Inactive Responses | | --- | --- | --- |---| | TCP Three-Way Handshake | Sends SYN packets to specified ports and waits for responses | Can bypass some firewalls that allow TCP traffic| TCP SYN-ACK | RST | | ARP Ping Scan | Uses ARP requests to discover hosts on a local network. Advantage: Efficient and accurate, scan large networks quickly| Efficient and accurate| ARP Reply| No response | | UDP Ping Scan | Sends UDP packets to specified ports to elicit responses | Can bypass some TCP strict firewalls that allow UDP traffic| By default Nmap use port 40125 | Can bypass some firewalls | UDP Response| Host unreachable/TTL exceeded | | ICMP Echo Ping Sweep | Sends ICMP echo requests to discover hosts | Simple and widely supported| ICMP Echo Reply| No response | | ICMP Timestamp Ping | Sends ICMP timestamp requests to discover hosts and gather timing information | Can provide additional information about the target system| ICMP Timestamp Reply | No response | | ICMP Address Mask Ping | Sends ICMP address mask requests to discover hosts and gather subnet information | Can provide information about the network configuration| ICMP Address Mask Reply | No response | | TCP SYN Ping | Sends TCP SYN packets to specified host to discover hosts | Can bypass some firewalls that allow TCP traffic. Uses default port 80 | TCP SYN-ACK | RST | | TCP ACK Ping | Sends TCP ACK packets to specified hosts to discover hosts | Can bypass some firewalls that allow TCP traffic. Uses default port 80 | TCP RST | No response | | IP Protocol Ping | Sends packets with specific IP protocol numbers to discover hosts that respond to those protocols | Can discover hosts that respond to specific protocols (e.g., ICMP, IGMP, IP-in-IP). Change DEFAULT_PROTO_PROBE_PORT_SPEC in nmap.h | Response from target protocol | No response |

Ping Sweep Tools¶

Port and Service Discovery¶

List of Commonly Used Ports¶

TCP Scanning¶

TCP Inverse Scanning¶

TCP ACK Flag Probe Scan¶

It analyze the header information (TTL, Window size) to determine if ports are open or closed. | Scan Type | Description | Advantages | Disadvantages | Open port Response | Closed port Response | | --- | --- | --- | --- | --- | --- | | TTL-Based ACK Flag Probe Scan | Sends TCP ACK packets to elicit responses based on TTL values. Open ports may respond with a TTL value lower than 64, while closed ports may respond with a TTL value greater than 64. | Can provide additional information about the target system's operating system based on TTL values. | Less reliable, as some systems may not respond according to expected TTL values. Requires super-user privileges. | TCP ACK with TTL <= 64 (open) | TCP ACK with TTL > 64 (closed) | | Window-Based ACK Flag Probe Scan | Sends TCP ACK packets to elicit responses based on TCP window size. Open ports may respond with a non-zero window size, while closed ports may respond with a zero window size. | Can provide additional information about the target system's operating system based on window size. | Less reliable, as some systems may not respond according to expected window sizes. Requires super-user privileges. | TCP ACK with non-zero window size (open) | TCP ACK with zero window size (closed). No response/ICMP unreachable error = filtered port |

Other Scanning Techniques¶

IDLE/PID Scan¶

This scan use a Zombie System to perform the scan, it analyze the IPID field in the IP header to determine if ports are open or closed. These are the steps: 1. Choose a "Zombie" and probe its IPID to get a baseline value using a SYN/ACK, it replies with a RST and the IPID X. 2. Send a SYN with spoofed source IP address (the Zombie's IP) of the target to the port being scanned on the target system. 2.1. If the port is open, the target will reply with a SYN/ACK to the Zombie, which will reply with a RST and increment its IPID to X+1. 2.2. If the port is closed, the target will reply with a RST to the Zombie, which will not increment its IPID and remain at X. 3. Probe the Zombie's IPID again to determine if it has incremented, which indicates whether the target port is open or closed. If the IPID is X+2, it indicates that the port is open (one increment for the SYN/ACK response and one for the RST response). If the IPID is X+1, it indicates that the port is closed (only one increment for the RST response). If the IPID remains at X, it may indicate that the port is filtered or that the Zombie is not responding to probes.

UDP Scanning¶

SCTP INIT Scan¶

Stream Control Transmission Protocol (SCTP) is a transport layer protocol that provides features such as multi-homing and multi-streaming. The SCTP INIT scan sends SCTP INIT packets to elicit responses based on SCTP behavior. Open ports may respond with an SCTP INIT ACK, while closed ports may respond with an SCTP ABORT or no response.