In this lesson,
we're going to explore network scans,
focusing specifically on TCP and UDP scans,
and stealth scans.
These scanning techniques are fundamental
for identifying open ports, running services,
and potential vulnerabilities in a network.
First, let's define what network scanning is.
Network scanning involves using tools
and techniques to discover devices on a network,
identify open ports,
and gather information about the services and protocols
running on those devices.
This information is important
for assessing the security posture of a network
and identify a potential entry point for attackers.
Next, let's discuss TCP/UDP scans.
TCP or Transmission Control Protocol scans
are the most common type of network scans.
They work by sending TCP packets
to a range of ports on a target system
to determine which ports are open
and what services are running.
TCP is a connection-oriented protocol,
meaning it requires a three-way handshake
with a SYN, SYN/ACK,
and ACK messages to establish a connection.
TCP scans can be performed in various ways,
but the most common method include SYN scans,
full-connect scans, and FIN scan.
SYN scans, also known as half-open scans, are the fastest
and stealthiest ways to scan TCP ports.
The scanner sends a SYN packet to a target port
and awaits for a response.
If the port is open to target response
with a SYN-ACK packet,
the scanner then sends a RST (reset) packet
to close the connection
before it's fully established, making the scan less likely
to be logged by the target system.
This could allow us as penetration testers
to quickly identify open ports
without establishing a full connection.
Full-connect scans, also known as connect scans,
involve completing the three-way handshake
to establish a full connection to the target port.
The scanner sends a SYN packet, receives a SYN-ACK
in response, and then sends an ACK
to complete the handshake.
This method provides more detailed information
about the services running on the open ports,
but it's more likely to be detected by the target system
and logged in security logs.
FIN scans are a type of stealth scan that sends a FIN
or finish packet to the target port.
If the port is closed, the target system will respond
with a reset packet.
If the port is open, there will be no response.
This method can bypass certain firewalls
and packet filters that only log SYN packets,
making it a useful technique for stealthy scanning.
UDP or a User Datagram Protocol scans work differently
from TCP scans because UDP is a connectionless protocol.
Instead of establishing a connection,
UDP scans send UDP packets to target ports
and analyze the response.
However, scanning UDP ports can be more challenging
and slower than TCP scanning due to the lack
of a handshake mechanism.
When a UDP packet is sent to a closed port,
the target system typically responds
with an ICMP "Port Unreachable" message.
If no response is received, it suggests
that the port is open or filtered.
However, the absence of a response does not guarantee
that the port is open as firewalls
or packet filters might be blocking the response.
Tools like Nmap use techniques
such as sending specific payloads
to get responses from known UDP services
to improve the accuracy of UDP scanning.
Now, let's move on to additional methods that are considered
to be stealthy scans.
First, we have null scans.
Null scans send packets with no flag set,
meaning the TCP header is devoid of any control flags.
This method exploits how different operating systems respond
to unusual TCP packet.
Specifically, systems
that use TCP/IP standards will respond
with a RST (reset) packet if the
port is closed, while open ports
will not respond at all.
This allows attackers
or pentesters to infer the status
of the port based on the presence
or absence of a response,
helping to map out open ports on a target system.
However, some modern firewalls
and intrusion detection systems can detect
and block null scans.
Next, we have fragmented scans.
Fragmented scans break the TCP header into small fragments,
making it harder for packet filters
and intrusion detection systems to reassemble
and analyze the packet.
This technique can help bypass simple filtering rules
that inspect entire packet.
And the last scan we will discuss is idle scans.
Idle scans, sometimes called zombie scans,
use a third-party system
or zombie to send packets to the target.
The scanner sends spoofed packets that appear
to come from the zombie system
and then observes the response to infer the status
of the target ports.
This technique allows the scanner
to remain completely hidden
as the target system only sees traffic from the zombie.
So, remember, network scans are essential
for identifying open ports, running services,
and potential vulnerabilities within a network.
TCP/UDP scans help discover open ports
and gather information about the services running
on those ports.
Stealth scans, such as SYN scans, FIN scans,
fragmented scans, and idle scans are designed
to avoid detection and minimize logging,
making them valuable tools for penetration testers.