Network Scanning Study Notes
Lesson 01 - Network Scanning Concepts
Definition: Network scanning is the process of discovering active devices, open ports,
and services on a network.
Purpose: Identifies vulnerabilities, maps network structure, and gathers information for
security assessments.
Types of Scans:
o Port Scanning: Identifies open ports and services.
o Network Scanning: Detects active devices and hosts.
o Vulnerability Scanning: Searches for known vulnerabilities.
Key Terms:
o IP Address: Unique identifier for devices on a network.
o MAC Address: Hardware address of network interfaces.
o Subnet: Logical subdivision of an IP network.
Lesson 02 - Scanning Tools
Nmap (Network Mapper): Popular open-source tool for network discovery and security
auditing.
Netcat: Versatile networking utility for reading and writing network connections.
Angry IP Scanner: Lightweight, fast IP address and port scanner.
Zenmap: Graphical front-end for Nmap.
Masscan: Ultra-fast port scanner capable of scanning the entire Internet.
Key Features to Consider:
o Speed and efficiency of scanning.
o Ability to bypass firewalls and IDS.
o User interface (command-line vs. GUI).
Lesson 03 - Scanning Techniques
Ping Sweep: Identifies live hosts by sending ICMP Echo requests.
Port Scanning Types:
o TCP Connect Scan: Full connection established (easily detected).
o SYN Scan (Half-Open): Sends SYN packets, stealthy but detectable.
o UDP Scan: Checks open UDP ports, slower due to no handshake.
o ACK Scan: Maps firewall rules, checks if ports are filtered.
Stealth Scanning Techniques:
o Xmas Scan: Sends packets with FIN, PSH, and URG flags.
o NULL Scan: No flags set, checks for open or filtered ports.
o FIN Scan: Sends packets with only FIN flag.
Lesson 04 - Scanning Beyond IDS and Firewall
Why Bypass IDS/Firewalls? To avoid detection and collect accurate data.
Techniques Used:
o Fragmentation: Breaking packets into small pieces to avoid detection.
o Spoofing: Using fake IP addresses to hide the source of the scan.
o Proxy Chains: Routing traffic through multiple proxies for anonymity.
o Timing Variations: Slowing down scans to avoid triggering alarms.
Tools for Evasion:
o hping: Packet crafting tool for custom TCP/IP packets.
o Nmap Timing Options: Adjusts speed and timing of scans.
Lesson 05 - Banner Grabbing
Definition: Collecting service information from open ports (e.g., web server version).
Purpose: Helps in identifying running services and potential vulnerabilities.
Techniques:
o Telnet and Netcat: Manually connecting to ports for information.
o Nmap Scripts: Using NSE scripts for automated banner grabbing.
Common Targets:
o Web Servers (HTTP headers)
o FTP, SSH, and Mail Servers
o Application Services (e.g., database version information)
Lesson 06 - Draw Network Diagrams
Purpose: Visual representation of network topology for analysis and security audits.
Types of Network Diagrams:
o Physical Diagrams: Show hardware and cabling.
o Logical Diagrams: Display IP addressing and routing paths.
Tools for Diagramming:
o Microsoft Visio
o Lucidchart
o [Link] ([Link])
o Nmap (with Zenmap for topology mapping)
Best Practices:
o Keep diagrams clear and organized.
o Use consistent symbols and labeling.
o Update diagrams regularly to reflect network changes.
Lesson 07 - Scanning Pen Testing
Purpose: Assess network security by simulating real-world attacks.
Phases of Pen Testing:
o Planning and Reconnaissance: Collect information about the target.
o Scanning and Enumeration: Identify open ports, services, and vulnerabilities.
o Exploitation: Attempt to exploit identified vulnerabilities.
o Post-Exploitation: Assess impact and maintain access.
o Reporting: Document findings and provide recommendations.
Tools Used:
o Nmap – for network discovery and port scanning.
o OpenVAS – vulnerability scanning and management.
o Metasploit – for exploiting vulnerabilities.
Ethical Considerations:
o Always get written permission before conducting scans.
o Follow legal and organizational guidelines.