Narrator: Nmap port scans. 2 2
So now that we've started 3 3
and we've gone through and done our discovery scans, 4 4
we have now finished our footprinting, 5 5
but we now need to start beginning our fingerprinting 6 6
and learning information about individual hosts. 7 7
One of the ways we do this is by using service discovery. 8 8
Now, service discovery is going to help us 9 9
to determine which network services 10 10
and operating systems are in use by a target. 11 11
When we looked at that output from Nmap earlier, 12 12
I showed you there was different ports that were open 13 13
and different services that were being told, 14 14
like SSH and what version it was. 15 15
This is what I'm talking about 16 16
when I talk about service discovery. 17 17
Now, service discovery can take several minutes to complete 18 18
or up to several hours, 19 19
depending on how many IP's you're searching 20 20
and how many ports you want to dig into. 21 21
Now, let me give you a quick word of wording. 22 22
Now, you may have heard me say the word stealthy, 23 23
numerous times so far as we talked about Nmap. 24 24
Now, some scans are going to be described as stealthy 25 25
or more stealthy than others, 26 26
but a well-configured IDS or IPS 27 27
can detect most Nmap scanning. 28 28
Now, this is really important to you as an analyst 29 29
because your job is to configure IDS and IPS, right? 30 30
And so you want to make sure your devices 31 31
are configured to protect yourself 32 32
from these different types of scans, 33 33
and so you can detect more of them. 34 34
Now, let's talk about a couple of these ways 35 35
for us to start doing port scanning 36 36
and identify individual ports 37 37
on individual hosts within a network. 38 38
The first way is by using -sS. 39 39
This is known as a TCP SYN. 40 40
Now, this type of scan is going to conduct a half-open scan 41 41
by sending a SYN packet to identify the port state, 42 42
but it's never going to send that acknowledgement packet. 43 43
Now, this might sound to you, 44 44
like a denial-of-service or a SYN flood, right? 45 45
Because we're sending these half-open packets. 46 46
Now, we're not actually going to create a denial-of-service 47 47
doing this because we're not sending enough of them 48 48
or in a large enough volume. 49 49
But it is the same concept. 50 50
We're starting a three-way handshake, 51 51
but we're not acknowledging it. 52 52
And again, that's going to give us the response 53 53
that SYN-ACK packet from the target 54 54
and we can analyze that to figure out which ports are open. 55 55
The next one we're going to talk about is a TCP Connect, 56 56
which uses -sT as its flag. 57 57
This is going to conduct the full three-way handshake 58 58
by doing the scan, 59 59
it's going to send out a SYN packet to identify the port state 60 60
and then it's going to send the acknowledgement, 61 61
once it receives that SYN-ACK. 62 62
This is done because sometimes your network card 63 63
doesn't support doing a half-open scan. 64 64
This is something special 65 65
that only certain network cards can do, 66 66
and you have to have administrative or root access. 67 67
Now, you may wonder 68 68
why would I use a full three-way handshake 69 69
when I can just use a TCP SYN and use a half-open handshake? 70 70
Well, depending on where you're doing your scan from, 71 71
you may not have rights to do a TCP SYN, 72 72
because using a half-open scan like that 73 73
requires you to have root or administrative access 74 74
on the system that you're scanning from. 75 75
And so if you don't have that, you're going to be stuck 76 76
having to do a TCP connect scan instead. 77 77
The next one we're going to talk about is a Null Scan. 78 78
Now a null scan uses the flag -sN for null. 79 79
Now, this is going to conduct a scan by sending a packet 80 80
with the header bit set to zero, 81 81
which is why we call it a null scan 82 82
because there's no information there. 83 83
This again, looks abnormal, and most IDS and IPS 84 84
are going to see this and think it's malicious. 85 85
The next one we're going to talk about is a FIN Scan. 86 86
Now, a FIN scan uses the flag -sF. 87 87
This conducts a scan by sending an unexpected FIN packet. 88 88
If you remember how TCP/IP works 89 89
back from your network plus days, 90 90
you'll remember that FIN packets are used 91 91
as a way to end a communication session. 92 92
So if you send it in the middle of a session, 93 93
it's unexpected, but again Nmap will support you doing this. 94 94
Just like the null scan, 95 95
this is something that will set up flags 96 96
inside most intrusion detection and protection systems. 97 97
So it's not really stealthy to use this. 98 98
The next one we're going to talk about is a Christmas Scan. 99 99
This is -sX. 100 100
Now the reason this is called a Christmas scan is 101 101
because it lights up like a Christmas tree. 102 102
You're conducting a scan by sending a packet with the FIN, 103 103
the push and the urge flags all set to on or one. 104 104
Now, in this case, it's going to look like a Christmas tree 105 105
in their logs and in their intrusion detection systems. 106 106
This is a surefire way for you to get caught. 107 107
So why would you ever send one of these 108 108
if you were a penetration tester? 109 109
Well, because you're trying to make sure 110 110
people are actually paying attention, 111 111
so you can actually send this out as an easy thing 112 112
to see if people catch you or not. 113 113
If they're not catching some of your hard things, 114 114
you could throw one of these in there 115 115
and see if they're actually awake, 116 116
and actually looking at their logs. 117 117
The next one we're going to talk about is a UDP Scan. 118 118
Now, this uses the flag -sU. 119 119
This allows us to conduct a scan 120 120
by sending a UDP packet, instead of a TCP packet 121 121
and we're going to send that to our target 122 122
and then wait for a response or a timeout. 123 123
Now, because UDP doesn't have SYN and ACK 124 124
and all the acknowledgements in three-way handshakes, 125 125
we basically have to send it and then wait to hear 126 126
if we got a response or was there a timeout. 127 127
And then we use that to figure out if that port was open 128 128
or closed. 129 129
This can be used if you want to be a little bit more stealthy 130 130
and figure out if things are actually working well for you. 131 131
Next, we have Port Ranges. 132 132
You can use the flag -p to specify the port you want to scan. 133 133
Now, when you're scanning ports by default, 134 134
it's going to scan 1,000 of the most commonly used ports. 135 135
That can take a lot of time and it's not very stealthy. 136 136
So when I'm doing my scans as a penetration tester, 137 137
I will usually scan for just a couple of ports 138 138
that I think are important or ones that I want to go after. 139 139
I might go after port 80 if they're running a web server. 140 140
Port 443 if they're using a web server. 141 141
Port 22 if they're running an SSH server, 142 142
instead of going after a thousand ports, 143 143
it's another way to try to sneak in past the sensors 144 144
and try to get through the firewall 145 145
and get through the intrusion detection 146 146
and prevention systems. 147 147
Now, all of these techniques can be made more 148 148
or less stealthy as well as combined 149 149
with other options covered in our discovery scans. 150 150
So I can use things like timing for my discovery scans 151 151
and use -t0 to make it really slow. 152 152
And then I can use a half-open scan using -sS 153 153
and I can combine these together to gimme something 154 154
that looks a little bit more stealthy. 155 155
I also can use that with -p and add in only port 80. 156 156
And so by doing this and crafting my Nmap scans, 157 157
I can make myself more stealthy and have a better chance 158 158
of not being detected if I'm an attacker.