MODULE 6: PORT SCANNING AND
ENUMERATION
MODULE OBJECTIVE
In this Module, you will learn how Port scanning is used to determine what
ports a system may be listening on, which hosts are live and which services
they are running. After completing this Module you should know:
✔ what a port address is, how it is used and what its functions are.
How to perform port scanning using one of the most advanced network
scanner nmap(network mapper).
✔
Techniques that can be implemented in reducing the effect of port scanning
from port scanners.
✔
MODULE 5: PORT SCANNING AND
ENUMERATION
Topics:
Port Address.
Port Scanning And Enumeration.
✔
Port Scanning And Enumeration With Nmap.
✔
Mitigations
✔
✔
PORT ADDRESS
PORT ADDRESS
A port Address/Number is a 16-bit unassigned integer ranging
from 1 to 65535. There are 65535 ports and it is at the transport
layer. These ports identifies a service. They are application specific or
process specific. The port number and the IP address of a computer
complete the destination address for a communication session.
There are three types of ports: Well-Known, Registered and
Ephemeral ports.
PORT ADDRESS
Well Known Ports
The port number ranging from 0 to 1023 are the well known ports and
some of them are:
Port Number Description TCP/UDP
0 Reserved TCP/UDP
21 FTP (File Transfer Protocol) TCP
22 SSH (Secured Shell) TCP/UDP
23 telnet TCP/UDP
25 SMTP (Simple Mail Transfer TCP
Protocol)
53 DNS (Domain Name Service) TCP/UDP
80 HTTP TCP/UDP
PORT ADDRESS
Registered Ports
Since port number identifies a service, different vendors have registered some
port numbers for their application. Port number 1024-49151 are known as
registered port for use by vendors.
Port Number Vendor
1047 Sun’s NEO Object Request Broker
1026 Shockwave
PORT ADDRESS
Ephemeral/Dynamic Ports
Ports in the range of 49151-65535 are neither reserved for any service or
used for any well known service. They are no available as such for
registration. Ports from this range are assigned by the operating system on
runtime when the program requests for an available port. Ephemeral ports
are terminated when the connection is not valid.
PORT SCANNING AND
ENUMERATION
PORT SCANNING AND ENUMERATION
Port Scanning is one of the most popular techniques attackers use to discover
services that they can exploit to break into systems. Although Port Scanning isn’t
inherently hostile, it is often the first step of reconnaissance used by hackers when
trying to infiltrate a network or steal/destroy sensitive data.
In other words, it is a technique used to identify open ports and services
available on a network host. It is sometimes utilized by security technicians to
audit computer.
While Enumeration is the process of extracting usernames, machine names,
network resources, shares and services from a system and it is conducted in an
intranet environment.
PORT SCANNING AND
ENUMERATION WITH NMAP
PORT SCANNING AND ENUMERATION
WITH NMAP
Nmap is a free, open source tool for scanning networks and security auditing.
It is:
I. Flexible: it supports different techniques like port scanning, OS detection,
version detection and many more.
II. Powerful: it could be used to scan big networks with many computers.
III. Free: free to download.
IV. Easy: easy to use considering the different tutorials and cheat sheets
available.
SYN STEALTH SCAN
SYN STEALTH SCAN
SYN Stealth (Half Open) Scan
They are known as half open scan as they don' t complete the TCP 3-way handshake. Here, it
initiates the scanning by sending a SYN packet, if SYN/ACK is received then the port is open
and the target is trying to make connection. This is the default scan and by default scans 1024
ports.
The scanner then sends a RST to tear down the connection before it can be established fully.
This scan is not logged in the target system because it is not complete. There are different ways
in which stealth scan can be done depending on the flag set.
Syntax:
Nmap -sS <IP address or domain name>
FRAGMENTED SCAN
FRAGMENTED SCAN
FRAGMENTED Scan
In fragmented scan the attacker sends the probe packet in small IP
fragment. The idea is to split the TCP header over several packet
to make it harder to detect by firewalls. The advantage of this scan
is the ability to bypass the packet filters. The disadvantage is it is
slow.
Syntax:
Nmap -f <IP address or domain name>
PING SCAN
PING SCAN
PING Scan
This is done by sending ICMP ECHO REQUEST packets
to all the hosts specified. If an ICMP ECHO REPLY is
received then the hosts that responded to these packets are
up.
Syntax:
Nmap -sP <IP address or domain name>
VERSION DETECTION SCAN
VERSION DETECTION SCAN
VERSION DETECTION Scan
Version detection scan collects information about the
specific service running on an open port including
the product name and version number.
Syntax:
Nmap -sV <IP address or domain name>
OS FINGERPRINTING SCAN
OS FINGERPRINTING SCAN
OS FINGERPRINTING Scan
This scan is used to determine the target operating system. This is done by
comparing the already stored fingerprint database of nmap with the
fingerprint(output) generated by the scan. When verbose is enabled along
with -O, IPID sequence is also reported.
Verbose mode is chosen when you need more detailed information about
the scan.
Syntax:
Nmap -O <IP address or domain name>
MITIGATIONS
MITGATIONS
By using firewalls to redirect open ports to honeypots or empty
hosts, you can turn a port scan that would take hackers just a few
✔
seconds in to a 7-hour job.
✔ Block or shutdown ports if you do not need them.
Configure ports/services not to be accessible outside your
network if neccessary.
✔
✔ Use port knocking method to externally open ports on a firewall.
SUMMARY
SUMMARY
The Module helps one understand the need for enumeration and scanning
activities at the start of one's penetration test, and helps one learn how to
best perform these activities with tools such as Nmap. The Module discusses
the specific tools that reveal the characteristics of the targets, including what
services they offer, and the versions and types of resources they offer.