- [Instructor] Let's go over an overview of port scanning
and also service discovery.
And starting with port scanning,
one of the best utilities or best tools to use
in order for you to actually start getting
some experience with poor scanning is Nmap.
And I'm gonna be using Mmap
throughout the demonstrations in the next few minutes.
But let's start going over of what is port scanning
and what is the purpose of it.
As an ethical hacker you're trying to demonstrate
what a real life attacker can do
to find vulnerabilities in a system
and then exploit those vulnerabilities
and move to post exploitation.
So one of the main avenues
in the active reconnaissance phase
is to look for any ports that may be open
in a target system.
So I'm gonna put here T to demonstrate a target system.
This can be a web application,
this can be an embedded device,
it can be an IOT device,
it can be pretty much anything, right?
Now an attacker can perform port scanning
by using TCP packets, by using UDP,
and even though ICMP does not have any ports,
the ICMP protocols have types and codes,
you can actually use ICMP to enumerate host
within an environment, within a subnet.
So we're gonna concentrate mostly
in TCP and UDP scanning here.
Now, TCP is a connection oriented protocol.
So in other words TCP scan is a lot more reliable
than a UDP scan, right?
Because an attacker, whenever you use a UDP scan,
can send a packet to a target system
and may not get anything back.
In some cases, the target system,
if the port is not open it may send
an ICMP destination unreachable message
back to the attacker
but that could be blocked by a firewall
or by any other infrastructure device that is out there.
So that's why UDP scanning
is a lot more unreliable than TCP scans.
Now to demonstrate a TCP scanning here,
I'm gonna do a SYN scan.
So basically an attacker or the scanner itself,
I'm just gonna draw a scanner here,
sends a TCP SYN message to the target system.
And then if the port is open,
let's say this is actually over port 80,
and if the port is open,
of course the target system
will actually send a SYN-ACK message back to the scanner,
and the scanner will say that port 80 is open, right?
If it then goes to a different port,
let's say port 81,
and it does not send a TCP SYN-ACK message,
and it may actually send instead a TCP Reset message
then the scanner actually says that
of course the port is closed.
Now there are different type of states
of the scan reports that you can get in a map.
And later I'm gonna share with you a cheat sheet
that I have in my GitHub repository
that goes over all those different permutations
and different options within Nmap.
Now to demonstrate this
I'm gonna be using Nmap using a SYN scan.
So I'm gonna be launching a TCP SYN scan.
And the option here is lowercase s, uppercase s,
so dash sS,
with the IP address of a target system.
And in this case it's 10.6.6.23.
And if I hit Enter, Nmap starts the scan
and right away it actually tells me that port 21,
port 22, 53,
80, 139 and 445 are open.
Now, what Nmap is doing is actually scanning
for the top 1,000 most popular ports out there,
not in sequence.
So it's not going from one to 1,000;
it is actually going
and picking the top 1,000 most common ports
and then it's actually doing that.
If you want to scan for all the ports
then you can do a dash P and another dash
as the option here,
and it will scan for the 6,500
or 65,535 different ports out there.
Now in this case the port scan is not telling me
if truly port 21 is actually running FTP.
It's actually just guessing that because port 21
was actually open, that FTP may be that service.
So whenever you're doing service enumeration
you actually have to go further
than a regular TCP or normal SYN scan like this.
You can take advantage of additional checks,
whether it's manual checks that you can do
to actually launch a utility like netcat against that port
or by taking the advantage of other utilities
and other scripts that come with Nmap.
And there's a scripting engine,
called the Nmap Scripting Engine, NSE,
and there's a whole bunch of different scripts
that you can take advantage of,
or you can create your own.
And in this case, I'm actually using WebSploit,
the learning environment that I created,
and is running on top of Parrot OS.
And in this case, I can do a locate *.nse
and you can see that under user/share/nmap/scripts,
there are a whole bunch
of different NSE scripts that are here
for you to do additional enumeration
of different shells, different files,
and different potential vulnerabilities
that may be in the system.
Now a quick cheat, if you will,
or a kind of shortcut of launching
the most appropriate Nmap Scripting Engine scripts
is by using the -sC option.
So lowers case s, and uppercase c.
And I'm gonna launch this against the same target,
so 10.6.6.23.
Now this is gonna take a little bit more time
than the previous scan that we just did
which was a normal SYN scan.
And what the scanner is doing
is actually sending the same type of scan,
with a default 1,000 ports to that system,
to the 10.6.6.23.
And then based on the results,
like you saw that there was port 21, 22,
port 80, 445, and all those different ports,
Nmap is actually picking the most appropriate
or the most common Nmap Scripted Engine scripts
to run and do further enumeration.
Now, this is actually a lot more verbose
than the previous scan, than the SYN scan,
but it actually gives you a lot of additional information.
And as you can tell, the scan just concluded.
And if I scroll up, you see that for port 21
it was able to enumerate that of course it is open,
and indeed it's actually running an FTP server
and it was able to log in anonymously
and it was also able to enumerate these files.
So file one, file two, file three,
and this another one called super secret file.
Now it also was able to enumerate additional things
about the system, including the version
and the program that is running FTP.
So in this case it is vsftpd, version 3.0.3.
In some cases you may actually get some false positive,
in this case is actually correct.
Now for SSH you see that it's getting
the SSH keys for DNS,
is not only able to find
that DNS is actually running in the system,
but the type of DNS server,
in this case is actually BIND and the version as well.
Then for port 139 and 445 you actually see
that was actually able to enumerate additional things like,
that it is not a Window system;
that it is actually a Debian system running Samba
and is running an old version of Samba 4.9.5 for Debian.
And it was also able to enumerate additional things,
including the system time
and the smb-security-mode and so on.
Now to launch a specific script
you can run or use the dash dash script tag or keyword,
followed by the specific location of the script.
And in this case we're gonna be doing enumeration of shares
of that same Samba implementation on the 10.6.6.23.
And as a matter of fact
you can be even more specific and say,
I'm gonna be only running this scan against port 445,
so with a dash P option.
Whenever I hit Enter,
now what it's doing is actually scanning the system
only on port 445 and then enumerating different shares.
And as you can see, it was actually able
to actually find a directory called work files,
and there's a comment there
about confidential work files, right?
So once again, we went over the different scan types.
We went over a very brief introduction to the Nmap scanner,
how to use the Nmap Scripting Engine,
how to verify additional system enumeration,
and there are plenty of additional tools for that.
And then one more thing that I want to share with you
is that in my GitHub repository, under cheat sheets,
you have a lot of different cheat sheets
for many different things
including Exploit Development, Metasploit,
even memory forensics.
There's one specifically for Nmap that I created
and it has the different scan types, port status;
as I mentioned to you, the states of the ports,
and the different results you can get from the scanner,
the different scan types, probing options, timing options.
And especially if you want to be more stealth
and potentially bypass intrusion detection systems
and monitoring tools
that the security operations center may have
you can use these different timing options
to tweak your scans and be a lot more stealthy.
So I have tons and tons of different references
in here for you
for your benefit and for your learning.