Nmap Scanning Techniques Overview
Uploaded by
sadosov992Nmap Scanning Techniques Overview
Uploaded by
sadosov992Common questions
Powered by AIThe FIN scan sends a packet with the FIN flag to a targeted port. If the port is open, the system sends no response, whereas a closed port will usually send back an RST/ACK packet. It is effective particularly against systems that adhere to RFC 793 TCP/IP standards. Because many commercial systems are based on this standard, FIN scan can be effectively used to stealthily determine open ports without raising alarms on the target system .
The "-oA" option in Nmap is beneficial for generating comprehensive scan reports as it saves the results in three different formats: normal, XML, and grepable formats. This enables flexibility in how the data is analyzed and utilized. XML is suited for integration with XML-parsing tools, normal is human-readable, and grepable allows efficient text processing and searching. This multi-format output facilitates diverse use-cases including automated processing, reporting, and analysis .
Nmap facilitates service and OS detection through options like "-A" for advanced scan features, including operating system detection, service version detection, and traceroute. The "-sV" option specifically targets service detection by capturing banner information, and it allows adjustment of the intensity with "--version-intensity." These techniques help identify running versions and software on open ports, which can indicate specific vulnerabilities or configurations .
The three-way handshake is fundamental to establishing a TCP connection, involving a SYN, a SYN/ACK, and an ACK exchange between a client and server. In SYN scanning, only the first two steps of this handshake occur before the connection is reset, allowing it to probe open ports without completing the handshake. This provides the scanning system the requisite response to determine if a port is open (SYN/ACK response) without alerting the target system via a completed connection .
The XMAS scan sends packets with FIN, URG, and PSH flags set. For open ports, no response is received, indicating the port is open. For closed ports, an RST/ACK response is returned. It only works on systems developed according to RFC 793 because these systems have a specific TCP/IP stack behavior that adheres to the RFC specifications, interpreting the flags in the manner expected by the scan .
The Heartbleed vulnerability impacts systems using vulnerable versions of OpenSSL, exposing sensitive data from memory that might include private keys, session cookies, and passwords. Nmap can help detect it using the "--script=ssl-heartbleed" in conjunction with "-sV -p 443" which scans the secure connection port for the presence of the Heartbleed bug. This capability allows administrators to quickly identify vulnerable systems and mitigate risks by updating or patching OpenSSL .
The "-Pn" option, when used, tells Nmap not to perform host discovery (i.e., no ping will be sent to determine if hosts are up before scanning them). This option is useful for scanning hosts that do not respond to ping requests or when dealing with networks that filter ICMP packets. This makes the scan assume that all hosts in the specified range are up, reducing the initial discovery phase .
The SYN scan, often referred to as a "half-open" scan, allows for determining a port's state without making a full connection to the host, unlike the TCP Connect scan, which establishes a full connection. This characteristic helps in reducing log entries on the target system because many systems do not log connections that are not fully established, thus increasing stealthiness .
TCP flags dictate the purpose of a TCP packet and influence how a target system processes it. For instance, SYN flags are used to request connection initiation, while FIN indicates an end of data transmission. Techniques like SYN scans use the SYN flag to probe ports without completing a connection, evoking a SYN/ACK or RST response. XMAS scans use combinations of FIN, URG, and PSH flags to confuse systems into revealing open ports based on whether they send an RST/ACK or provide no response. The behavior of receiving these flags influences whether a system logs activity or considers it an error, impacting stealth and effectiveness .
The NULL scan differentiates itself by transmitting packets with no set flags, unlike SYN, FIN, or XMAS scans that utilize specific flag combinations. If the port is open, there will be no response; if closed, it will respond with an RST packet. This method relies on the target system's adherence to TCP/IP specifications under RFC 793, making it effective for systems that implement these standards strictly. Its stealthiness lies in appearing like no legitimate request, potentially bypassing intrusion detection systems not configured to catch such anomalies .