Scanning
Scanning is a method in which we can get information
about a network, port or vulnerability in a system.
Types of Scanning
1) Port Scanning – Port scanning is the process of checking the
services running on the target computer by sending a sequence of
messages in an attempt to break it.
2) Network Scanning – Network scanning is a procedure for
identifying active host in a network.
3) Vulnerability Scanning – Vulnerability scanning is a method for
checking weather a system is exploitable by identifying its
vulnerabilities.
Objective of Scanning
1) To search Live host in network
2) To search open and closed ports
3) To search service running on a networks
4) To discover vulnerabilities in live hosts
What is a packet?
Packets is a basic unit of data that grouped together and transferred over
computer networks.
What is a port?
Ports in networking is a software defined number associated to a network
protocol that receives or transmits communication for a specific service.
Different Port Numbers
20,21 - FTP (File transfer protocol)
• Used for transfer of files from one host to another over TCP based.
22 – SSH (Secure shell)
• That use for enables two or more computers to communicate.
23 – TELNET (Tell communication)
• Used for collaborative and text-based communication.
25 – SMTP (Simple mail transfer protocol)
• Used to send and receive email.
80 – HTTP (Hyper Text transfer protocol)
Collaborative hypermedia information system.
443 – HTTPS (Hyper Text transfer protocol secure)
S in HTTPS stands for SSL- Secure Socket Layer
69 – DHCP (Dynamic host configuration protocol)
• Used to configure network device to communicate on an IP network.
53 – DNS (Domain name service)
• Responsible for translating domain names into a specific IP.
123 – NTP (Network time protocol)
• Is a used protocol designed to time synchronize network of machines and NTP runs in UDP
109 – pop 2 (Post office protocol)
• A point or physical location where two or more network communication devices build a connection
from one place to rest of the internet.
110 – pop 3
143 - IMAP 4 (Internet message access protocol)
• Used for delete mailboxes on the server and copy messages between mailboxes
161 – SNMP (Simple network Managment protocol)
• Used to collect data related network or determine that status of network.
3389 – RDP (Remote Desktop Protocol)
• a proprietary protocol developed by Microsoft to remotely connect to a Windows system using a
graphical user interface.
8080 – Apache server
TCP – Transmission Control Protocol
UDP – User Datagram Protocol
TCP perform 3 ways handshake.
TCP flags
1 syn – synchronize (syn) is as packet sent to another computer requesting that a connection be
established between them.
2 syn & ack = synochronize + acknowledgement (syn + ack) is a message back to the client.
3 ack = in the final part client acknowledgement the response of server and they both establish the
connection.
TCP communication flags
1) Urg (urgent) = data contained in the packets should be current processed immediately
2) Fin (finish) = there will no further transmission
3) Rst (reset) = reset a connection
4) Psh (push) = send all buffered data immediately
5) Ack (acknowledgment) = acknowledgement the receipt of packet
6) Syn (synchronize) = initiates a connection between hosts.
Types of Scans
1) TCP scan = -sT
2) Stealth scan = -sS
3) Xmas scan = -sX
4) Fin scan = -sF
5) Null scan = -sN
6) ARP scan = -sA
Tools
1) Nmap
2) Nikto
3) Wireshark
4) Hping3
5) Net discover
6) Arp-scan