University of Babylon College of
information Technology
Department of Information Security
Ethical Hacking
Lecture 5: Scanning
Networks II
[Link]. Rasha Hussein
Host Discovery
Techniques
ARP Ping Scan and UDP Ping Scan
ARP Ping Scan
➢ARP ping scan: a technique to discover active devices in a network by sending ARP packets
➢ARP packets: used to find the hardware address (MAC) of a device based on its IP address
➢ARP requests: sent by the source device to ask for the MAC of the destination device
➢ARP responses: sent by the destination device to provide its MAC to the source device
➢ARP scan: shows the MAC and IP of all devices on the same network
➢Active devices: devices that respond to ARP requests with ARP responses
➢Inactive devices: devices that do not respond to ARP requests or are blocked by firewalls
➢Attackers use the Nmap tool to perform ARP ping scan for discovering live hosts in the network. In
Zenmap, the -PR option is used to perform ARP ping scan.
➢Note: -sn is the Nmap command to disable the port scan. Since Nmap uses ARP ping scan as the
default ping scan, to disable it and perform other desired ping scans, you can use -- disable-arp-ping.
ARP Ping Scan
Technique for discovering active hosts by sending UDP packets to a target IP.
The default port used is 40,125
Can detect unreachable hosts by analyzing the error messages returned.
The tool “Nmap” supports UDP ping scanning using the `-PU` option.
Users can modify the default port number in Nmap.
Advantages of ARP and UDP ping scan
ARP Ping Scan is considered more efficient and accurate for host discovery.
It manages ARP requests, retransmissions, and timeouts automatically.
Useful for discovering systems over large address spaces.
Can measure response time or latency to an ARP packet.
UDP Ping Scans can detect systems behind strict TCP firewalls, bypassing
TCP filtering.
UDP Ping Scan
ICMP ECHO Ping Scan
ICMP ECHO Ping Sweep
• Ping sweep is used to determine the live hosts from a range of IP addresses by sending ICMP ECHO requests to multiple
hosts. If a host is alive, it will return an ICMP ECHO reply
• Attackers calculate subnet masks by using a Subnet Mask Calculator to identify the number of hosts that are present in the
subnet
• Attackers subsequently use a ping sweep to create an inventory of live systems in the subnet.
•
Ping Sweep Tools
• Angry IP Scanner pings each IP address to check if any of
these addresses are live. Then, it optionally resolves
hostnames, determines the MAC address, scans ports, etc.
• Angry IP scanner is an IP address and port scanner
• Pings each IP address to check if it is alive
• Resolves its hostname, determines the MAC address, scans
ports, and so on
• NetBIOS information (computer name, workgroup name,
and currently logged in Windows user), favorite IP address
ranges, web server detection, and customizable openers
• The tool allows the user to save the scanning results to
CSV, TXT, XML, or IP-Port list files.
Other Host Discovery Techniques
Port Scanning Techniques
Common Port Scan
1- TCP Connect / Full Open Scan
2- Stealth Scan(Half open Scan)
2- Stealth Scan (Half-open Scan)
•
•
•
•
•
•
•
•
•
•
2- Stealth Scan(Half open Scan)
• Type following NMAP command for TCP scan as well as start Wireshark on another hand to
capture the sent Packet.
• nmap -sS -p 22 [Link]
• Open Port • Close Port
2.1 ACK Flag Probe Scan
Categories of ACK Flag Probe Scanning
include :
2.1.1. TTL-based ACK Flag Probe Scanning
• You will first need to send ACK probe packets (several thousands) to different TCP ports and then analyze the TTL
field value of the RST packets received.
• If the TTL value of the RST packet on a particular port is less than the boundary value of 64, then that port is open
• In this example, port 22 returned a TTL value of 50, which is less than 64; all other ports returned a TTL value of
80, which is greater than 64. Therefore, port 22 is open
• In Zenmap, the syntax nmap -ttl [time] [target] is used to perform TTL- based scan.
Categories of ACK Flag Probe Scanning include :
2.1.2. Windows-based ACK Flag Probe Scanning
•
•
•
•
2.1 ACK Flag Probe Scan
2.1.3. Checking the Filtering Systems of Target Networks
• The ACK flag probe scanning technique also helps in
checking the filtering systems of target networks. The
attacker sends an ACK probe packet to check the
filtering mechanism (firewalls) of packets employed
by the target network.
• Sending an ACK probe packet with a random
sequence number and getting no response from the
target means that the port is filtered (stateful firewall
is present); an RST response from the target means
that the port is not filtered (no firewall is present).
• In Zenmap, the -SA option is used to perform an ACK
flag probe scan
3- IDLE / IPID Header Scan
3- IDLE / IPID Header Scan
• IDLE/IPID Header scan is a TCP port scan method that uses a spoofed source address
• IDLE/IPID Header scan allows blind scanning of a remote host without revealing the scanner’s IP
• IDLE/IPID Header scan exploits the IPID (fragment identification) number in IP packets
• IDLE/IPID Header scan process:
• Scanner finds an idle host (zombie) with predictable IPID sequence
• Scanner sends SYN packet to target port with zombie’s IP as source address
• Zombie receives SYN/ACK packet from target if port is open or RST packet if port is closed
• Scanner probes zombie’s IPID and calculates the difference from previous probe
• If difference is 2, port is open; if difference is 1, port is closed; if difference is 0, port is filtered
• Scanner repeats the process for other ports
• IDLE/IPID Header scan can be performed with Zenmap using the -SI option
3- IDLE / IPID Header Scan
• IDLE scan uses a spoofed source address and an idle host (zombie) with predictable IPID
• IDLE scan allows blind scanning of a remote host without revealing the scanner’s IP
• Step1:
• To perform an idle scan, find a zombie with incremental IPID
• Send SYN+ACK to zombie and probe its IPID (X)
• Zombie responds with RST and reveals its IPID
• In the diagram shown in the slide above, assume that the zombie responds with IPID=31337. Furthermore,
assume that this IPID is X
3- IDLE / IPID Header Scan
• Step2:
• Send SYN packet to target port with zombie’s IP as source
• If port is open, target sends SYN/ACK to zombie
• Zombie responds with RST and increases its IPID by 2 (X+2)
• If port is closed, target sends RST to scanner
• Zombie remains idle and keeps its IPID (X)
3- IDLE / IPID Header Scan
• Step3:
• Probe zombie’s IPID (X) with SYN+ACK packet
• Send SYN packet to target port with zombie’s IP as source
• If port is open, target sends SYN/ACK to zombie
• Zombie responds with RST and increases its IPID by 2 (X+2)
• Scanner can infer port is open from IPID difference
• Idle scan allows scanning target with zombie’s IP
H.W: IPv6 Scanning
Thank
You