Network Scanning Techniques Overview
Uploaded by
Aamir KhanNetwork Scanning Techniques Overview
Uploaded by
Aamir KhanCommon questions
Powered by AIThe 'Colasoft Packet Builder' facilitates network scanning by allowing users to create customized packets to carry out specific scanning tasks. Unique features include its ARP packet template, setting Delta Time for inter-packet transmissions to control the pace of sending packets, and the ability to review packets before transmission through a Send All Packets window. These functionalities make it a versatile tool for network administrators to script and automate complex scanning sessions .
Using 'hping3' for TCP/UDP packet crafting provides flexibility for creating custom packets, allowing detailed control over packet parameters such as size, source, destination, and flags. This helps in performing tailored network diagnostics and penetration tests. However, challenges include the complexity and technical expertise required to craft meaningful packets, the risk of misconfiguring packet options leading to ineffective scans or detection, and the potential legal implications due to unauthorized scanning that may violate network policies or laws .
The 'IDLE scan' operates by sending spoofed packets to a target in a way that makes the behavior seem as though it's coming from a different host, known as the 'zombie.' This utilizes the predictability of IPID (IP Identification) sequences to infer if a port is open or closed based on increment patterns. The advantage of this method is its stealthiness; since it doesn't transmit packets from the attacker's real IP address, it is difficult to trace back to the true source, thus providing anonymity .
Using 'decoys' in network scanning involves launching a scan from multiple fictitious IP addresses alongside the real source IP. This method, specifically using Nmap's -D option, causes the target's logging and defensive mechanisms to register the scan as coming from multiple sources, obscuring the attacker's actual IP among the decoys. This technique effectively reduces the risk of scan detection and tracing the origin of the scan to the attacker .
The purpose of the 'Xmas Scan' in network scanning is to identify open ports on a target machine without establishing a full TCP connection, making it less detectable than other scan types. It functions by sending TCP segments with all flags (FIN, URG, PSH) set in the packet header, which generates packets that are illegal according to RFC 793. If a port is closed, it will respond with an RST packet. However, if a port is open, it will typically drop the packet due to no acknowledgment, allowing the scanner to infer the state of the port .
The role of 'TTL and TCP window sizes' in identifying a target system's operating system lies in the fact that different OSs have characteristic default values for these parameters. By analyzing the Time-To-Live (TTL) value and TCP window size of a packet, one can infer the operating system: for instance, Linux systems often have a TTL of 64 and a TCP window size of 5840, while Windows systems may have a TTL of 128 and a TCP window size of 65535. These identifiers help in profiling and identifying systems accurately without direct access .
'Ping sweeps' are used in network reconnaissance to determine which IP addresses are currently active and reachable within a given IP range. By sending ICMP echo request packets to numerous addresses and listening for replies, a scan can map out which live hosts exist on a network. This technique typically reveals the IP addresses of devices that are up and responding, thus indicating potential targets for further investigation or connectivity verification .
The use of a 'burst mode' in network packet transmission, where packets are sent in quick succession without delays, accelerates the scanning process by increasing the transmission speed of probing data. This can effectively reduce the overall time taken for a scan to complete. However, it can also lead to higher chances of detection due to quicker, more noticeable influxes of traffic. Additionally, it might cause network congestion or packet loss if network bandwidth is limited .
The 'TCP Connect Scan' initiates a full TCP handshake by establishing a normal TCP connection to determine if a port is available. This makes it straightforward to detect because it follows the standard connection procedures that can be logged by target systems. In contrast, the 'Stealth Scan' (or SYN scan) only sends a SYN packet and analyzes the SYN-ACK response instead of completing the TCP handshake. This results in lower detectability, as the connection is never fully established, making it less likely to be logged or flagged by intrusion detection systems .
'UDP scans' differ from 'TCP scans' in that they do not establish a connection through a handshake. Instead, they send a UDP packet to each target port, and if a response is not received, the port is presumed open. A closed port typically sends an ICMP destination unreachable message. The limitations of UDP scans include their slowness and the need to handle rate limits on ICMP responses, which can be selectively dropped to limit false positives. Additionally, various network security appliances might also block or drop these packets, making open ports harder to detect compared to TCP scans .