1 1 00:00:00,690 --> 00:00:02,760 Nmap port scans. 2 2 00:00:02,760 --> 00:00:03,840 So now that we've started 3 3 00:00:03,840 --> 00:00:06,060 and we've gone through and done our discovery scans, 4 4 00:00:06,060 --> 00:00:08,070 we have now finished our footprinting, 5 5 00:00:08,070 --> 00:00:10,740 but we now need to start beginning our fingerprinting 6 6 00:00:10,740 --> 00:00:13,650 and learning information about individual hosts. 7 7 00:00:13,650 --> 00:00:16,950 One of the ways we do this is by using service discovery. 8 8 00:00:16,950 --> 00:00:18,600 Now, service discovery is going to help us 9 9 00:00:18,600 --> 00:00:20,310 to determine which network services 10 10 00:00:20,310 --> 00:00:22,950 and operating systems are in use by a target. 11 11 00:00:22,950 --> 00:00:25,050 When we looked at that output from Nmap earlier, 12 12 00:00:25,050 --> 00:00:26,850 I showed you there was different ports that were open 13 13 00:00:26,850 --> 00:00:28,680 and different services that were being told, 14 14 00:00:28,680 --> 00:00:31,050 like SSH and what version it was. 15 15 00:00:31,050 --> 00:00:31,980 This is what I'm talking about 16 16 00:00:31,980 --> 00:00:33,870 when I talk about service discovery. 17 17 00:00:33,870 --> 00:00:36,510 Now, service discovery can take several minutes to complete 18 18 00:00:36,510 --> 00:00:38,310 or up to several hours, 19 19 00:00:38,310 --> 00:00:40,470 depending on how many IP's you're searching 20 20 00:00:40,470 --> 00:00:42,690 and how many ports you want to dig into. 21 21 00:00:42,690 --> 00:00:45,240 Now, let me give you a quick word of wording. 22 22 00:00:45,240 --> 00:00:47,310 Now, you may have heard me say the word stealthy, 23 23 00:00:47,310 --> 00:00:50,250 numerous times so far as we talked about Nmap. 24 24 00:00:50,250 --> 00:00:52,350 Now, some scans are going to be described as stealthy 25 25 00:00:52,350 --> 00:00:53,970 or more stealthy than others, 26 26 00:00:53,970 --> 00:00:56,460 but a well-configured IDS or IPS 27 27 00:00:56,460 --> 00:00:58,920 can detect most Nmap scanning. 28 28 00:00:58,920 --> 00:01:00,810 Now, this is really important to you as an analyst 29 29 00:01:00,810 --> 00:01:04,080 because your job is to configure IDS and IPS, right? 30 30 00:01:04,080 --> 00:01:05,670 And so you want to make sure your devices 31 31 00:01:05,670 --> 00:01:07,470 are configured to protect yourself 32 32 00:01:07,470 --> 00:01:09,180 from these different types of scans, 33 33 00:01:09,180 --> 00:01:11,490 and so you can detect more of them. 34 34 00:01:11,490 --> 00:01:13,710 Now, let's talk about a couple of these ways 35 35 00:01:13,710 --> 00:01:15,390 for us to start doing port scanning 36 36 00:01:15,390 --> 00:01:17,220 and identify individual ports 37 37 00:01:17,220 --> 00:01:19,620 on individual hosts within a network. 38 38 00:01:19,620 --> 00:01:22,500 The first way is by using -sS. 39 39 00:01:22,500 --> 00:01:25,050 This is known as a TCP SYN. 40 40 00:01:25,050 --> 00:01:27,960 Now, this type of scan is going to conduct a half-open scan 41 41 00:01:27,960 --> 00:01:30,960 by sending a SYN packet to identify the port state, 42 42 00:01:30,960 --> 00:01:34,080 but it's never going to send that acknowledgement packet. 43 43 00:01:34,080 --> 00:01:35,460 Now, this might sound to you, 44 44 00:01:35,460 --> 00:01:38,130 like a denial-of-service or a SYN flood, right? 45 45 00:01:38,130 --> 00:01:40,350 Because we're sending these half-open packets. 46 46 00:01:40,350 --> 00:01:42,180 Now, we're not actually going to create a denial-of-service 47 47 00:01:42,180 --> 00:01:44,100 doing this because we're not sending enough of them 48 48 00:01:44,100 --> 00:01:45,780 or in a large enough volume. 49 49 00:01:45,780 --> 00:01:47,460 But it is the same concept. 50 50 00:01:47,460 --> 00:01:48,900 We're starting a three-way handshake, 51 51 00:01:48,900 --> 00:01:50,370 but we're not acknowledging it. 52 52 00:01:50,370 --> 00:01:52,200 And again, that's going to give us the response 53 53 00:01:52,200 --> 00:01:54,090 that SYN-ACK packet from the target 54 54 00:01:54,090 --> 00:01:56,700 and we can analyze that to figure out which ports are open. 55 55 00:01:56,700 --> 00:01:59,400 The next one we're going to talk about is a TCP Connect, 56 56 00:01:59,400 --> 00:02:02,160 which uses -sT as its flag. 57 57 00:02:02,160 --> 00:02:04,740 This is going to conduct the full three-way handshake 58 58 00:02:04,740 --> 00:02:05,700 by doing the scan, 59 59 00:02:05,700 --> 00:02:08,670 it's going to send out a SYN packet to identify the port state 60 60 00:02:08,670 --> 00:02:10,770 and then it's going to send the acknowledgement, 61 61 00:02:10,770 --> 00:02:12,630 once it receives that SYN-ACK. 62 62 00:02:12,630 --> 00:02:15,240 This is done because sometimes your network card 63 63 00:02:15,240 --> 00:02:18,420 doesn't support doing a half-open scan. 64 64 00:02:18,420 --> 00:02:19,500 This is something special 65 65 00:02:19,500 --> 00:02:21,000 that only certain network cards can do, 66 66 00:02:21,000 --> 00:02:23,670 and you have to have administrative or root access. 67 67 00:02:23,670 --> 00:02:24,720 Now, you may wonder 68 68 00:02:24,720 --> 00:02:26,910 why would I use a full three-way handshake 69 69 00:02:26,910 --> 00:02:30,480 when I can just use a TCP SYN and use a half-open handshake? 70 70 00:02:30,480 --> 00:02:32,730 Well, depending on where you're doing your scan from, 71 71 00:02:32,730 --> 00:02:35,790 you may not have rights to do a TCP SYN, 72 72 00:02:35,790 --> 00:02:37,740 because using a half-open scan like that 73 73 00:02:37,740 --> 00:02:40,110 requires you to have root or administrative access 74 74 00:02:40,110 --> 00:02:42,210 on the system that you're scanning from. 75 75 00:02:42,210 --> 00:02:44,040 And so if you don't have that, you're going to be stuck 76 76 00:02:44,040 --> 00:02:47,190 having to do a TCP connect scan instead. 77 77 00:02:47,190 --> 00:02:49,620 The next one we're going to talk about is a Null Scan. 78 78 00:02:49,620 --> 00:02:53,730 Now a null scan uses the flag -sN for null. 79 79 00:02:53,730 --> 00:02:56,220 Now, this is going to conduct a scan by sending a packet 80 80 00:02:56,220 --> 00:02:58,080 with the header bit set to zero, 81 81 00:02:58,080 --> 00:02:59,550 which is why we call it a null scan 82 82 00:02:59,550 --> 00:03:01,710 because there's no information there. 83 83 00:03:01,710 --> 00:03:04,560 This again, looks abnormal, and most IDS and IPS 84 84 00:03:04,560 --> 00:03:07,380 are going to see this and think it's malicious. 85 85 00:03:07,380 --> 00:03:09,930 The next one we're going to talk about is a FIN Scan. 86 86 00:03:09,930 --> 00:03:13,500 Now, a FIN scan uses the flag -sF. 87 87 00:03:13,500 --> 00:03:17,130 This conducts a scan by sending an unexpected FIN packet. 88 88 00:03:17,130 --> 00:03:19,050 If you remember how TCP/IP works 89 89 00:03:19,050 --> 00:03:20,700 back from your network plus days, 90 90 00:03:20,700 --> 00:03:22,380 you'll remember that FIN packets are used 91 91 00:03:22,380 --> 00:03:24,600 as a way to end a communication session. 92 92 00:03:24,600 --> 00:03:26,220 So if you send it in the middle of a session, 93 93 00:03:26,220 --> 00:03:30,270 it's unexpected, but again Nmap will support you doing this. 94 94 00:03:30,270 --> 00:03:31,530 Just like the null scan, 95 95 00:03:31,530 --> 00:03:33,390 this is something that will set up flags 96 96 00:03:33,390 --> 00:03:36,480 inside most intrusion detection and protection systems. 97 97 00:03:36,480 --> 00:03:39,090 So it's not really stealthy to use this. 98 98 00:03:39,090 --> 00:03:41,550 The next one we're going to talk about is a Christmas Scan. 99 99 00:03:41,550 --> 00:03:43,470 This is -sX. 100 100 00:03:43,470 --> 00:03:45,540 Now the reason this is called a Christmas scan is 101 101 00:03:45,540 --> 00:03:47,940 because it lights up like a Christmas tree. 102 102 00:03:47,940 --> 00:03:50,610 You're conducting a scan by sending a packet with the FIN, 103 103 00:03:50,610 --> 00:03:54,690 the push and the urge flags all set to on or one. 104 104 00:03:54,690 --> 00:03:57,330 Now, in this case, it's going to look like a Christmas tree 105 105 00:03:57,330 --> 00:04:00,030 in their logs and in their intrusion detection systems. 106 106 00:04:00,030 --> 00:04:02,520 This is a surefire way for you to get caught. 107 107 00:04:02,520 --> 00:04:04,440 So why would you ever send one of these 108 108 00:04:04,440 --> 00:04:06,090 if you were a penetration tester? 109 109 00:04:06,090 --> 00:04:07,380 Well, because you're trying to make sure 110 110 00:04:07,380 --> 00:04:08,880 people are actually paying attention, 111 111 00:04:08,880 --> 00:04:11,490 so you can actually send this out as an easy thing 112 112 00:04:11,490 --> 00:04:13,200 to see if people catch you or not. 113 113 00:04:13,200 --> 00:04:14,940 If they're not catching some of your hard things, 114 114 00:04:14,940 --> 00:04:16,380 you could throw one of these in there 115 115 00:04:16,380 --> 00:04:17,400 and see if they're actually awake, 116 116 00:04:17,400 --> 00:04:19,410 and actually looking at their logs. 117 117 00:04:19,410 --> 00:04:21,900 The next one we're going to talk about is a UDP Scan. 118 118 00:04:21,900 --> 00:04:23,300 Now, this uses the flag -sU. 119 119 00:04:24,720 --> 00:04:26,160 This allows us to conduct a scan 120 120 00:04:26,160 --> 00:04:29,220 by sending a UDP packet, instead of a TCP packet 121 121 00:04:29,220 --> 00:04:30,540 and we're going to send that to our target 122 122 00:04:30,540 --> 00:04:32,850 and then wait for a response or a timeout. 123 123 00:04:32,850 --> 00:04:35,550 Now, because UDP doesn't have SYN and ACK 124 124 00:04:35,550 --> 00:04:37,380 and all the acknowledgements in three-way handshakes, 125 125 00:04:37,380 --> 00:04:39,780 we basically have to send it and then wait to hear 126 126 00:04:39,780 --> 00:04:42,180 if we got a response or was there a timeout. 127 127 00:04:42,180 --> 00:04:44,550 And then we use that to figure out if that port was open 128 128 00:04:44,550 --> 00:04:45,540 or closed. 129 129 00:04:45,540 --> 00:04:47,730 This can be used if you want to be a little bit more stealthy 130 130 00:04:47,730 --> 00:04:50,430 and figure out if things are actually working well for you. 131 131 00:04:50,430 --> 00:04:51,960 Next, we have Port Ranges. 132 132 00:04:51,960 --> 00:04:55,830 You can use the flag -p to specify the port you want to scan. 133 133 00:04:55,830 --> 00:04:57,900 Now, when you're scanning ports by default, 134 134 00:04:57,900 --> 00:05:01,320 it's going to scan 1,000 of the most commonly used ports. 135 135 00:05:01,320 --> 00:05:04,410 That can take a lot of time and it's not very stealthy. 136 136 00:05:04,410 --> 00:05:07,170 So when I'm doing my scans as a penetration tester, 137 137 00:05:07,170 --> 00:05:09,570 I will usually scan for just a couple of ports 138 138 00:05:09,570 --> 00:05:12,390 that I think are important or ones that I want to go after. 139 139 00:05:12,390 --> 00:05:14,580 I might go after port 80 if they're running a web server. 140 140 00:05:14,580 --> 00:05:16,680 Port 443 if they're using a web server. 141 141 00:05:16,680 --> 00:05:18,930 Port 22 if they're running an SSH server, 142 142 00:05:18,930 --> 00:05:21,150 instead of going after a thousand ports, 143 143 00:05:21,150 --> 00:05:23,370 it's another way to try to sneak in past the sensors 144 144 00:05:23,370 --> 00:05:24,750 and try to get through the firewall 145 145 00:05:24,750 --> 00:05:26,280 and get through the intrusion detection 146 146 00:05:26,280 --> 00:05:27,990 and prevention systems. 147 147 00:05:27,990 --> 00:05:30,300 Now, all of these techniques can be made more 148 148 00:05:30,300 --> 00:05:31,950 or less stealthy as well as combined 149 149 00:05:31,950 --> 00:05:34,920 with other options covered in our discovery scans. 150 150 00:05:34,920 --> 00:05:37,500 So I can use things like timing for my discovery scans 151 151 00:05:37,500 --> 00:05:40,140 and use -t0 to make it really slow. 152 152 00:05:40,140 --> 00:05:43,290 And then I can use a half-open scan using -sS 153 153 00:05:43,290 --> 00:05:45,360 and I can combine these together to gimme something 154 154 00:05:45,360 --> 00:05:47,010 that looks a little bit more stealthy. 155 155 00:05:47,010 --> 00:05:50,370 I also can use that with -p and add in only port 80. 156 156 00:05:50,370 --> 00:05:52,950 And so by doing this and crafting my Nmap scans, 157 157 00:05:52,950 --> 00:05:55,650 I can make myself more stealthy and have a better chance 158 158 00:05:55,650 --> 00:05:57,813 of not being detected if I'm an attacker.