So, now that we've started
and we've gone through and done our discovery scans,
we have now finished our footprinting,
but we now need to start beginning our fingerprinting
and learning information about individual hosts.
One of the ways we do this is by using service discovery.
Now, service discovery is going to help us to determine
which network services and operating systems
are in use by a target.
When we looked at that output from Nmap earlier,
I showed you there was different ports that were open
and different services that were being told like SSH
and what version it was.
This is what I'm talking about
when I talk about service discovery.
Now, service discovery can take several minutes to complete
or up to several hours
depending on how many IPs you're searching
and how many ports you want to dig into.
Now, let me give you a quick word of wording.
Now, you may have heard me say the word stealthy
numerous times so far as we talked about Nmap.
Now, some scans are going to be described as stealthy
or more stealthy than others,
but a well configured IDS or IPS
can detect most nmap scanning.
Now, let's talk about a couple of these ways
for us to start doing port scanning
and identify individual ports on individual hosts
within a network.
The first way is by using -sS.
This is known as a TCP SYN.
Now this type of scan is going to conduct a half open scan
by sending a SYN packet to identify the port state,
but it's never going to send that acknowledgement packet.
Now, this might sound to you
like a denial of service or a SYN flood, right?
Because we're sending these half open packets.
Now, we're not actually going to create a denial of service
doing this because we're not sending enough of them
or in a large enough volume, but it is the same concept.
We're starting a three-way handshake,
but we're not acknowledging it.
And again, that's going to give us the response,
that SYN ACK packet from the target,
and we can analyze that to figure out which ports are open.
The next one we're going to talk about is a TCP Connect,
which uses -sT as its flag.
This is going to conduct the full three-way handshake
by doing the scan.
It's going to send out a SYN packet to identify
the port state,
and then it's going to send the acknowledgement
once it receives that SYN ACK.
This is done because sometimes your network card
doesn't support doing a half open scan.
This is something special
that only certain network cards can do,
and you have to have administrative or root access.
Now, you may wonder
why would I use a full three-way handshake
when I can just use a TCP SYN and use a half open handshake?
Well, depending on where you're doing your scan from,
you may not have rights to do a TCP SYN
because using a half open scan like that
requires you to have root or administrative access
on the system that you're scanning from.
And so if you don't have that, you're going to be stuck
having to do a TCP connect scan instead.
The next one we're going to talk about is a null scan.
Now a null scan uses the flag -sN for null.
Now this is going to conduct a scan by sending a packet
with the header bit set to zero,
which is why we call it a null scan
because there's no information there.
This again, looks abnormal and most IDS and IPSS
are going to see this and think it's malicious.
The next one we're going to talk about is a FIN scan.
Now, a FIN scan uses the flag -sF.
This conducts a by sending an unexpected FIN packet.
If you remember how TCP IP works
back from your network plus days,
you'll remember that FIN packets are used as a way
to end a communication session.
So if you send it in the middle of a session,
it's unexpected, but again,
Nmap will support you doing this.
Just like the null scan,
this is something that will set up flags
inside most intrusion detection and protection systems.
So it's not really stealthy to use this.
The next one we're going to talk about is a Christmas scan.
This is -sX.
Now the reason this is called a Christmas scan is because
it lights up like a Christmas tree.
You're conducting a scan by sending a packet with the FIN,
the PSH, and the URG flags all set to on or one.
Now, in this case, it's going to look like a Christmas tree
in their logs and in their intrusion detection systems.
This is a surefire way for you to get caught.
So why would you ever send one of these
if you are a penetration tester?
Well, because you're trying to make sure
people are actually paying attention.
So you can actually send this out as an easy thing
to see if people catch you or not.
If they're not catching some of your hard things,
you could throw one of these in there
and see if they're actually awake
and actually looking at their logs.
The next one we're going to talk about is a UDP scan.
Now this uses the flag -sU.
This allows us to conduct a scan by sending a UDP packet
instead of a TCP packet,
and we're going to send that to our target
and then wait for a response or a timeout.
Now, because UDP doesn't have SYN and ACK
and all the acknowledgements in three-way handshakes,
we basically have to send it
and then wait to hear if we got a response
or was there a timeout.
And then we use that to figure out
if that port was open or closed.
This can be used if you want to be
a little bit more stealthy
and figure out if things are actually working well for you.
Next we have port ranges.
You can use the flag -p to specify the port
you want to scan.
Now, when you're scanning ports, by default,
it's going to scan 1000 of the most commonly used ports.
That can take a lot of time and it's not very stealthy.
So when I'm doing my scans as a penetration tester,
I will usually scan for just a couple of ports
that I think are important, or ones that I want to go after.
I might go after port 80 if they're running a web server,
or port 443, if they're using a web server,
port 22, if they're running an SSH server
instead of going after a thousand ports.
It's another way to try to sneak in past the sensors
and try to get through the firewall
and get through the intrusion detection
and prevention systems.
Now, all of these techniques can be made more
or less stealthy as well as combined with other options
covered in our discovery scans.
So I can use things like timing for my discovery scans
and use -T0 to make it really slow.
And then I can use a half open scan using -sS
and I can combine these together to give me something
that looks a little bit more stealthy.
I also can use that with -p and add in only port 80.
And so by doing this and crafting my Nmap scans,
I can make myself more stealthy
and have a better chance of not being detected
if I'm an attacker.
Now, as I mentioned, when you conduct your scan,
you're going to be scanning a host and fingerprinting it
and to identify what ports may be open
or which ones may be closed.
Now, there's lots of different port states,
and you have to understand these
because these different states can tell you
what that port is capable of doing
and whether or not you have a vulnerability.
Now, the first three of these are known as open,
closed, and filtered.
Let's take a look at each of these.
First, we have open.
Now open is when an application of the host
is ready to accept connections.
So if I'm running a web server, port 80 should be open
because I need to be open and listening
and ready to accept a connection from whatever client
wants to get access to my web server.
But if I'm not running something like Telnet,
then port 23 should not be open.
And that brings us to our second state,
which is known as closed.
This is when the port responds to probes
by sending a reset packet.
That means there's no application available
to accept connections there.
So again, if I have a web server
and it's not running Telnet,
it's not going to have port 23 open.
So if I send a packet to it and say, 'Is port 23 open?
I want to make a connection',
it's going to send back a reset packet that says,
this port is closed.
You know, there is no application installed on that system
for that particular port.
Now, the third category we have is what's known as filtered.
Now, filtered occurs when Nmap can't probe the port,
but it doesn't necessarily know that it's closed.
This is usually due to a firewall blocking the scan
on the network or host.
And so when you see filtered,
the first thing you should be thinking as somebody
who's scanning this network is there's a firewall in place.
And so that brings us to other states
that could be shown as well.
There are three other states that are displayed
if the scan cannot determine a reliable result.
Again, filtered is one result
where we're sure there's a firewall,
but there's other ones when we're not so sure.
These are unfiltered, open-filtered, and closed-filtered.
Now, unfiltered is when Nmap can probe the port,
but it can't determine if it's open or closed.
It's not filtered, it's not being blocked by a firewall,
but I'm really not sure if it's open or closed.
I know this sounds kind of weird, and it really is.
It is not very common to find ports labeled as unfiltered
in your Nmap scans.
Next we have open filtered.
Now this happens when Nmap can't determine
if the port is open or filtered, so it's one or the other.
So when it does its UDP or IP protocol scan,
this is pretty common that it'll come back open filtered.
If you're using a SYN scan,
it should actually tell you whether or not
it was open or filtered.
It can determine that based on the response from the server.
Now, the third one we have is closed filtered,
and this is when Nmap can't determine if the port is closed
or filtered when conducting the TCP idle scan.
So if you're conducting a TCP idle scan using -tI,
you may get back something that shows closed filtered.
Again, these three are not nearly as common
as the open, closed and filtered,
but they are important to know.
Now, why is it important for us to know
all these different port states?
It's important for us to understand this
because an open port indicates a host
that is ready to accept connections.
That means there might be a vulnerability there
because there's an inbound connection that's open.
If you have a web server and port 80 is open,
that's not really a vulnerability
because you know that port 80 is open
'cause it's a web server, you're expecting that.
But if I do a scan against your host
inside your network for your work stations
and I find port 80 is open,
that is something that I'm going to look into.
That is a vulnerability to me
because most people aren't running web servers
on their desktops.
It's just not that common.
And so by going through and doing these port scans
and looking at these port states,
it can tell you what you need to look further into
and help identify the attack surface of the network.