In this lesson, we're going to explore
port and protocol scanning,
focusing on TCP and UDP scanning.
Now these methods are commonly used
by network security professionals,
and pen testers to identify which ports are open
on a target host and determine the services running
on those ports.
We'll also discuss how specific application layer protocols
like FTP, SMTP, DNS, HTTP and SMB,
or assist during these scans
to get a full understanding of the network's attack surface.
Port scanning involves sending packets
to specific ports on hosts
and analyzing a response to learn about the state
of the ports and services that they're running.
TCP and UDP are the two main protocols used
for sending data over the internet
and each behave differently,
requiring different scanning techniques.
TCP is a connection-oriented protocol,
which means a connection must be established
before data can be sent.
The most common type of TCP scan is a SYN scan,
also known as a "half-open scan,"
because it does not complete the TCP handshake.
In this method, the scanner sends a SYN packet
(initiating communication) to a specific port
on the target machine.
If the target responds with the SYN-ACK
(acknowledgment of the communication), the port is open.
The scanner then sends a RST (reset) packet
to abort the connection before it is fully established,
minimizing the log-in footprint.
This type of scan is popular
because it can quickly determine port status
without fully opening a connection.
Now, unlike TCP, UDP is a connection list,
meaning it's sent packets without establishing a connection,
which can make a UDP scanning less reliable and slower.
When a UDP packet is sent to a port,
there are a few possible responses.
If a packet is returned,
typically an ICMP port unreachable error,
the port is closed.
If there is no response,
the port could be open or filtered by a firewall.
due to its unreliable response to nature.
UDP scans are generally supplemented
with additional verification scans or methods.
Pen testers often use tools like Nmap
for both TCP and UDP scanning.
Nmap offers a variety of options for port scanning
that can be tailored to the specifics of the engagement
and the target networks configuration.
While TCP and UDP scanning are useful
for identifying open ports and associated services,
understanding specific application-layer protocols
that operate over these ports can further refine
a penetration tester's approach.
For example, FTP is used for the transfer of files
between a client and a server.
It's commonly found on port 21,
and it's known for its lack of secure data transmission,
which makes it a target for eavesdropping a text.
During a port scan, finding an open FTP port
might lead us to test for anonymous access
or credentials brute-forcing.
SMTP is used for sending emails
and is usually found on port 25.
Identify an open SMTP port can lead
to further investigations to check for open email relays
or for gathering email headers
that might reveal internal network details
or be used in phishing attack.
DNS translate domain names to IP addresses and vice versa,
and typically operates on port 53.
DNS scanning might reveal information about the domain names
and associated IP addresses within the target network,
which can be valuable for mapping network infrastructure.
HTTP is used for transmitting webpages
and often runs on port 80 for non-secure communications
and port 443 for secure communications (HTTPS).
Scanning these ports can uncover active web servers
and potentially reveal misconfigurations
or vulnerable web applications.
SMB is used for file sharing, network browsing,
and printer services,
and usually runs on ports 139 and 445.
Open SMB ports can be a significant security risk,
potentially allowing unauthorized access
to file shares and sensitive data.
Let's look at two common examples
of how a penetration tester might conduct a TCP SYN scan,
using Nmap with the following commands.
nmap - sS -p 1-65535 scanme.nmap.org.
This command performs a SYN scan
as indicated by the -sS option against all ports,
which is determined by the -p 1-65535 option,
on the target scanme.nmap.org, which is a test target
nmap allows us to use to test the tool's capabilities.
The result will list which ports are open,
closed, or filtered, providing valuable information
about the services running on the target host.
In a similar fashion,
the UDP scan might be performed with the following.
nmap -sU -p 1-65535 scanme.nmap.org.
Again, now this command initiates a UDP scan instead
as indicated by the dash U option against all ports
on the same host.
Due to the nature of UDP,
the scan might take a little longer
and the results may require further investigation
to confirm whether the ports are genuinely open or not.
So remember, mastering TCP and UDP scanning,
along with understanding the nuances of different protocols
like FTP, SMTP, DNS, HTTP and SMB
equips pen testers with the knowledge
to identify vulnerable points effectively
and understand the services running on that network.
Now by understanding how to perform protocol scanning,
testers can plan their security assessments
more effectively, ensuring that their actions are backed
with good understanding of the target's network setup
and potential vulnerabilities within the services.