Hello, guys, and welcome to another video on this chapter.
This video, you will learn how to capture
Network packet to use in Wireshark. When an Attack scanning a target using the nmap
port scanning method. else you will notice how Wireshark captures a
different network traffic packet for open and closed ports.
So let's get started.
So here is our Kali Linux machine.
I have opened the terminal and the
Wireshark side by side so we can explore how nmap interacts with open and close
ports and how that is being translated into the Wireshark.
So let's start with a TCP Scan,
a TCP Scan with Scanner for TCP Ports, like Port 22, 23, four, four, five, etc.
and sure for this report through three way
handshake connection between the source and the destination port.
Of course, if the port is open, then the source will
make a request with SYN packet a response from the destination will be sent
as a form of SYN ACK Packet, and then the resource will send and net packet.
And then again the source will send another RST ACK packet.
So let's see how that is being translated
first, how we are going to type the nmap command, so we are going to use nmap.
The.
That's the for the stealth for the TCP Scanner,
and then we are going to choose any port in this case it will be four four five and
we are going to choose a local address, my network.
That have, this port open,
so before we hit enter, let's go ahead on in Wireshark, choose the network inter
face, start capturing and then we are going to hit enter on our terminal.
So let's go ahead and type the nmap
command that we are going to use, so nmap, we're going to use the dash s
capital T for the TCP scan, and then we are going to choose Port any
port this case it would be four four five, and we are going to target.
And with the system.
that I have set up in my local network.
And before we hit enter, we are going to choose our
network interface, start capturing and then we're going to hit enter
and then we're going to go back to our Wireshark and stop capturing.
So, as you see.
We did still scan on port four, four, five, and it returned to its open.
So if you look over to the sequence of the packet.
Here, so this is the eight dot 188 is our Kali Linux.
IP and one, two, three dot eight dot
one, two, three is our windows IP and.
As we discussed earlier, you see that the
Kali Linux machine isn't a SYN packet four four five
port of Windows system and then eight dot one, two, three, the Windows
system replied with the SYN ACK to our Kali Linux machine.
Then Kali Linux
machine SYN ACk, and then again the source, our Kali Linux machine
send an RST ACK packet signifying that the port four four five on
our target machine in this case are windows machine is open.
So let's clear this out so we can capture the next traffic when the port is closed.
So we are going to use the port that we already know that is closed.
So lets use port 22.
On 8 dot 124.
And before we hit enter that start capturing again and hit and run nmap.
Go back to Wireshark, stop the traffic
capture, as you can see, and Nmap returned that the state of the Port 22 is closed.
So usually when when you're doing a TCP Scan.
On the port and the port is closed, usually the sequence goes like that.
The source is send in a SYN packet
to the destination port and then the destination replies with an rst ack packet
to the source signifying that the port is closed.
So let's see, how is that being translated to Wireshark.
So here we are.
We see that our Kali Linux machine sent a SIEM packet to a 124.
This is another Linux machine on port 22 and our destination, our target, IP 8
point 124 replied to our Kali Linux machine with an
RST ACK, as we send, signifying that the port.
Its closed.
So its going ahead and clear this one more time.
Clear terminal.
Well, and let's explore what happens on a still Scanner, so still Scan.
More simplified SYN scan is the default and most popular
scan option for good results, it can be performed quickly, scanning
thousands of bullets per second on the first network, and it is not hampered by
restrictive firewalls or any kind of Firewall.
It is also relatively typical of still, since it never completes TCP connections.
So normally when you are doing this
store scan on a port the sequence of the package, when it comes to
communication between the source of the destination goes like that.
The source is sending a SYN packet
to the destination destination, replying with a same packet
to the source and then the source sends an RST packet to the destination.
So let's see, how are we going to use nmap for that result,
so we are going to use nmap the flag space dash s and then capital S, which is the
skull scan, and we are going to use port four four five.
But we know that it's open on the.
8 dot, one, two, three,
target, just remember, always to start capturing before you hit enter for nmap.
And then we hit enter and then we can see that the port.
Is open four four five on our target
machine, go back to Wireshark, stop capturing.
All this traffic.
Now you can go back and search for the
IPS, as we said, eight point one eight eight is the our Kali
IP and we send it to eight dot one, two, three, four, four, five.
So, as we said, the port is open, so our
Kali Linux machine sent to our target machine a SYN packet
Target Machine replied to our Kali Linux machine with a Syn ack packet.
And then.
Our Kali linux machine sent a reply.
To the destination, IP on port four, four,
five with an RST packet, signifying that the port four, four, five is open.
So let's figure out now.
How the traffic is looking for a closed port using skull scan.
So in this case, we're going to use same
command, but we are going to use a different port this time.
It's going to be port 22 on our eight dot,
one twenty four before we hit enter and they're
going to start capturing the packet hit enter
and as you see, the scan has finished on Port 22 and it's a close sport and
let's see, how is that being translated into Wireshark so let's go back.
So here we are.
As you can see, our source IP sent to our target machine,
I think I get on port 22 and the target machine reply to our Kali Linux machine
within RST ACK packet like it does signify that the port is closed.
So that is usually how the sequence of the
packet is looking when you are using a skull scan on a closed port.
So let's clear out.
Everything one more time so we can go to the next.
Scan that we are going to explore, so we are going to do now fin Scanner.
I generally fin like it is used to
terminate the TCP connection between the source and destination port,
typically after some data transfer is complete
in the place of a SYN packet and Nmap start
a fin scan by using fin packet of course, if the port is open, then no response will
come from the destination port when the fin packet is sent.
Through the source port.
So let's see, how is that being structured on an nmap command and.
See if that will translate correctly, this transaction will translate correctly
to an Wireshark, so a Nmap are going to use the dash sF for the fin scan.
And we are going to choose again port four, four five on our
destination, IP, which is going to be 8 dot
one, two, three, start capturing, then we hit enter.
So let's see how the nmap command will be structured when it comes to a fin scan.
So we are going to type nmap.
We're going to choose the s
capital F flag for different scan, and then we are going to choose port 22.
1922 168 8 dot 194 start capturing before we hit enter.
And then.
And go ahead and stop the traffic capture
from Wireshark, as you can see, the Port 22 on our target machine is open.
So we can see how is that we can go and.
We can go and look over the sequence of the packets and see how is that being
translated, if you go to Wireshark, you can see that our.
Kali Linux machine 188 sent to eight
point one nine four our target machine a fin packet on port to 22, as we
specified in our command, in fact sent to fin packets.
And there was no reply after that.
You can see that in the stream of packets there is no one nine two one six eight dot
eight one nine four replying to our Kali Linux machine.
So let's clear this out.
Now, Wireshark first and then
we can see that if a fin scan is performed against any close sport,
then the source port will send fin packet to a specific port and destination.
This time will reply by sending an RST ACK packet.
So let's use the nmap command again with the flag itself on port 22 again.
But this time we are going to target eight point one twenty four.
We start capturing and then we hit enter
to send a fin scan on the closed 22 port.
So let's see b
ack in Wireshark, how is that being translated after we search a little bit
our IP and yes, you can see here that our Kali linux machine sent on the
eight point one twenty four target fin packet on port twenty two.
And the target IP replied to our
Kali Linux Machine with the RST ACK packet signifying that the port is closed.
So let's move on now to another type of scan and see how that type of scan will.
Behave and we can check how it's been translated into Wireshark.
So the next thing on our list is a null scan. Null scan
is a series of TCP packet switch hold a sequence number of zeros.
And since there are no.
Flag set the destination will not know how
to reply to that request because it's basically like receiving nothing.
So it will discard the packet and no reply
will be sent, which indicates that the port is open.
So let's see that.
Are we going to structure Nmap command by using nmap this time we are going to use
the n flag, we are going to choose Port four four five.
On our target, which is going to be.
Dot, dot, one, two, three.
We start capturing and then we hit enter.
So let's see how the nmap command will be structured.
For another scan,
so it's going to be nmap dash we're going to use the sn
and for the nosecone flag, we're going to choose Port 22
on our target, which is going to be eight dot one nine four.
We start capturing before we hit enter and.
So go ahead and hit under
can see that the port is open on 22, on our target, eight dot one nine four.
So we start capturing, we stop capturing and we go and look how this transaction.
Happened in Wireshark.
So as you can see, our Kali Linux machine sent to the target
specified in our command, which is eight dot one nine four basically.
No, no, packet.
So zero packet on port 22 and.
There was no reply after that.
So you can see one nine three responding
to another type of address and so on, so there is no reply from one nine four to
one eight eight in the next sequence of packet.
So let's figure out how the sequence of
packet look like when we are using the nose on the on a closed port.
So this will be kind of the same command.
But we are going to choose a different
target that we know that the port is closed.
So we're going to do a nosecone on a
closed port and we start capturing we hit enter.
You can see the port is closed.
We stop the capture and we go back to where the.
Command is happening.
So you can see that our target here.
I received a port, 22 a null packet, and it replied immediately after that,
on Kali Linux machine with an rst ack packet, which as we discussed
earlier as well, that signifies that report is closed.
So next, we are going to do a UDP Scan
UDP Scan works by sending UDP packet to every destination port.
It is a connection, less protocol for some common ports such as fifty three
and one two six one a protocol specific payload, is send to increase the response
rate service will respond with a UDP packet proving that it is open
if no response is received after retransmissions.
The port is classified as open filtered as
we already saw in somewhere in some of our demonstrations so far.
So this means that the port could be open or perhaps the packets are filtered.
Or perhaps the packet filters are blocking
the communication, so let's construct the nmap command by using the flag as u.
You can find the UDP Scan.
We're going to choose.
Port one, six one, this time on our target.
A scene which is going to be.
Eight port.
Eight dot, one, two, three.
So we start capturing hit enter.
So we are going to go on our terminal and type and Nmap.
I am going to choose the flag SU for the UDP Scan port one six one.
On our target machine, which is going to be.
Eight point one eight six this time.
We're going to start the capture
before we hit enter, and as you can see, it replies open filter.
Open source filtered,
as we discussed earlier in our port, 161 to let's go to Wireshark once again.
lets filter out all this traffic.
By the destination IP address.
And you can see that, as we discussed, there is.
There is a get request from our Kali linux machine to the target actually
twice, but as you can see, there is no response.
That is received from the target machine,
so that, as we discussed earlier, classifies the port as open or filtered.
So let's clear this out and see.
How the UDP Scan will be translated.
In Wireshark, so we are going to use the same command.
But we are going to change the target now, and this is going to be on the same port.
So in this case, if the source
is sending UDP packet on a closed port to the destination, then the destination.
Sent a reply with a SIEM packet port unreachable.
So let's see, how is that going to be
viewed in Wireshark after we hit enter on nmap
Command, we just prepared.
First we start capturing and then we hit enter.
We can see that the airport is closed 161.
And let's review that in Wireshark.
So you can see that our.
Here it starts, our Kali Linux machine eight point one eight eight is sending to
our target, which we specified in the command.
Eight point one twenty four,
is send in a UDP packet request and the destination, IP
124, is replying, as we said earlier, with the destination unreachable.
So that means that the Port 161 on our target machine is closed.
So the final Scan that we are going to explore how its results
are being translated in Wireshark is the X-mas scan.
So this scan,
are we going to explore more in depth in later chapters and videos
are designed to manipulate the psh and fin flags of the TCP Hacker.
So by setting the fin psh and urg flags,
it's basically like in the pick it up like a Christmas tree, as we say.
So when the source sends this type of packet to specific port.
And the port and if the port is open, then the destination will discard the
packet and will not send any reply to the source.
So let's go ahead in our terminal and type the nmap command with the flag this
time dash s Capital X up for the X-mas command.
We are going to choose Port four four five
in our target machine, which is going to be eight point one, two, three.
So let us go ahead and start capturing first and there.
So let us go ahead and type the nmap
command by choosing the flag dash s X for the X-mas Scan.
And then we are going to choose port four four five in our target.
System. It's going to be a point one nine four.
Oh, we start capturing first the traffic from on our network interface we hit.
And there you can see that
the port four four five in the target machine, and then we go to Wireshark.
And we will try to find these transaction.
So you can see here at our Kali Linux Machine is sending.
To our target, as we specified, eight
point one nine four a fin psh urg packet, you are actually twice and after that
there is no reply from the destination IP signifying the port is open.
So the.
The X-mas scan for the close port will be in the same manner, meaning that the
source will send a fin push urg packet
to the destination and the destination
this time will apply with an Rst ACK PACKET to the source, as we said.
Classifying report as closed.
So just go ahead and use the command
again, this time we're going to
choose port 22 8 .port 124 target.
We start capturing and then we hit enter you can see the port is closed.
So let's see how the nmap command is being translated, the Wireshark.
So as you can see, we found it already here.
Eight point one eighty eight, our Kali linux machine is sending
to our target machine 124, a fin push urg packet
and then immediately after that, our destination target IP is
applied on our kali linux machine with an RST.
ACK packet.
Signifying to us that the Port 22 is closed.
Those you saw today, we
gained a deeper understanding into how various scans
are behaving on closed and open ports, and we gained a deeper understanding
into investigating the packet with a Wireshark and how it Scan behaves.
We use the TCP Scan the SYN scan
the fin scan the nose, scan the UDP Scan and the X-mas Scan.
So that was it for this video.
I hope you have gained a deeper
understanding so far how nmap interacts with the ports
using different types of scans with the help of Wireshark, of course.
So you can just go ahead now
and click on the next video where you're going to get a deeper understanding on the
ICMP protocol, analyzing it with Wireshark.