>> Welcome to the Nmap lesson on scan techniques.
Knowing the different scan techniques is almost as
fundamental as understanding
target specifications in Nmap.
In this lesson, I'll walk you through
almost all of the available techniques,
as well as how and when they're used.
Let's get started. Here are
the learning objectives for this lesson.
First, we'll talk about what a scan technique is and
where different scan types should be
placed in an Nmap statement.
Next, I'll walk you through
the most popular scan techniques.
Finally, we'll discuss some
more advanced scan techniques
and some that are rarely used.
In Nmap, a scan technique is basically
the way we tell Nmap the protocols it should scan.
There are many options available,
but this typically means which protocol to use,
such as TCP, UDP, or IP.
Nmap also provides the user with the ability to
tell Nmap how to craft packets such
that specific options and flags are
set in order to investigate the target's response.
Nmap will output details on whether
interrogated ports are open, closed, or filtered.
Or in the case of an IP scan,
Nmap will tell us what IP protocols
are supported by the target.
We talked about general TCP/IP topics in
previous lessons and dug a little deeper into TCP,
UDP, IP, and ICMP headers.
But if you want, you can really dig into
the details on normal TCP/IP communications by
reading the IETF RFCs
on TCP and the TCP/IP protocol suite.
TCP is defined in
RFC 793 and TCP/IP is explained in RFC 1180.
One really great feature of
Nmap is that it does all the heavy lifting
for us as far as crafting
packets and analyzing the results.
We as users simply have to tell it what to do,
then read and interpret the output.
In a typical Nmap statement,
where should the scan technique be placed?
I think the best place to put
the scan technique is at
the very beginning of the scan statement,
right before your port number designation.
We'll cover the details of
port scanning in a later lesson.
The reason I like to do this is
because the rest of your scan statement
usually depends heavily upon
which protocols you chose to interrogate.
I put a simple example on this slide.
Do you have to use a scan technique?
Well, for the most part, the answer is
that if you don't specify a scan technique,
Nmap will use its default scan type,
which is great, and it's a TCP SYN or half-open scan.
Know you don't have to specify a scan technique.
But if you don't, one will be selected for you.
However, I would say that the TCP SYN scan
is the most popular and successful in many cases.
If you want to read more detail about
all the scan techniques I'm providing in this lesson,
see the reference at the bottom of this slide.
When you're examining or creating
an Nmap scan statement,
the scan technique is defined by
the capital letter next to
the -s. The only exception
to this is the FTP bounce scan,
which I'll discuss a little bit on the next slide.
As I just mentioned, Nmap -sS is a TCP SYN scan,
otherwise known as a half-open scan.
If no scan technique is specified in your scan,
this is what will run by default.
I should also mention that if
specific ports are not identified in your scan,
Nmap will scan 1,000 most popular
ports in use by modern systems.
As I've shown you before,
you can limit this to 100 by adding
the -F option to your scan.
The SYN scan is quick, unobtrusive, and stealthy.
Most importantly, it is effective
because setting the SYN flag and
TCP is always the first step
>> in normal TCP communication.
>> If Nmap perceives a SYN-ACK in response,
the port is open or listening.
If Nmap perceives an RST or ICMP unreachable,
it is considered closed.
If no response is received after
several retransmissions, is considered filtered.
An Nmap -sT is a TCP connect scan.
In other words, Nmap will
complete the TCP three-way handshake.
This scan technique is used by Nmap by
default only when the user
does not have raw packet privileges.
It is slower, a little more intrusive,
and could be logged and flagged by an IDS.
That's why it is a good idea to run Nmap
as a privileged user or as
an administrator in Windows because
a SYN scan is almost always a better choice.
Nmap -sU is a UDP scan.
Even though most services on the Internet run over TCP,
there are still a lot of really
important ones that use UDP.
Examples include DNS, Port 53,
DHCP Clients 68, DHCP Servers 67,
SNMP 161 and 162, TFTP 69,
and VOIP, which is at 5060,
and syslog at 514.
Just to name a few of the most
popular and easiest to exploit.
One really common thing to do in
an Nmap scan is to combine a UDP scan with
a SYN scan by using -sU and -sS.
The last popular scan technique I've placed on
this slide is Nmap -sO,
which is an IP protocol scan.
If you are a member from our lesson on IP headers,
this type of scan will cycle through each of
the protocol field's responses to
determine which protocols are supported by the target.
This is a great scan to run first
before you delve into deeper scanning.
It isn't a port scan,
but will still allow you to use the -P option,
which will be discussed in a later lesson.
You can use this to specify
which protocol numbers to interrogate.
I'll go through these a little faster.
One thing I want to say upfront
>> is that some of these are
>> advanced and some of them are
simply rarely used and ineffective.
The best thing to do is think carefully
about what the scan techniques
are doing at Layer 4 and
choose them based on what you're trying to accomplish.
For the most part, the ones at
the bottom are still widely
used for firewall evasion and penetration testing.
Nmap -sY is an SCTP INIT scan.
It is quick and reliable,
but not many hosts and services
on the Internet currently use SCTP,
which is a transport layer protocol
developed mostly for use in the telecom world.
This certainly may change in the future,
so keep this one in your toolbox.
Nmap -sA is a TCP ACK scan.
In other words, it sets
the ACK flag in the initial probe.
This one is different from
the other scans because it doesn't attempt to
determine if a port is open or open-filtered.
It is used to map out firewall rule sets to determine
whether they are stateful or
not and which ports are filtered.
This scan can be slow if
many ports are determined filtered.
Nmap -sW is a TCP Window scan.
It is the same as the TCP ACK scan,
except that it examines
the TCP headers Window field
>> of the returned RST packet.
>> Not many systems on the Internet respond.
Nmap -sM is a TCP Maimon scan,
which is named after the guy who
described the technique in the '90s.
It was effective to determine if
BSD-derived systems had open ports.
Modern systems rarely exhibit
the bug exploited by the scan.
Now for some out-of-state scan techniques
used for firewall evasion.
The big advantage of these scans
is that they can sneak through
some non-stateful firewalls
>> and packet filtering routers.
>> Also, they are slightly more stealthy than a SYN scan.
Consider them as a secondary scanning technique
to gather additional information about a host.
Nmap -sN is a null scan.
All TCP flags are set to zero or off.
In production environments,
every TCP packet has at least one flag set.
Every host should respond with
RST packets in the response.
The port is considered open if no reply is received.
Nmap -sF is a FIN scan and sets the TCP FIN bit to one.
In normal TCP communication,
the FIN flag is set at the end of
a conversation typically to
suggest the data transfer is complete.
If you set the FIN bit to one
>> in an initial conversation,
>> the target will respond with
an RST to reset the connection.
When Nmap receives an RST,
it knows that the host is alive.
Nmap -sX is an Xmas scan.
It sets the FIN, PSH,
and URG flags to one.
When you examine this from
the receiving end using a packet sniffer,
it looks as though every other flag is set.
It looks like blinky lights
that might be on a Christmas tree.
Like the null scan and FIN scan
if an RST packet is received back,
the port is considered closed,
while no response means it is open and filtered.
I'm including the Nmap -b in
this section because it has the ability to exploit
an old vulnerability in FTP defined in
RFC 959 called proxy FTP connections.
Since FTP servers are often outward-facing,
yet accessible from the inside of a network,
you can use this technique to ask FTP servers to send
a file to each interesting port
of a target host inside the network.
If an attacker finds
an FTP server accessible from the outside,
they quickly check to see
>> if that server is vulnerable to
>> this exploitation by running
>> the FTP -bounce NSE script.
>> In this lesson, we talked about Nmap scan techniques.
First, we talked about what a scan technique is
and where the different scan types
should be placed in an Nmap statement.
Next, I walked you through
the most popular scan techniques.
Finally, we discussed
some more advanced scan techniques and
some that are rarely used and ineffective.
In the next lesson, I'll walk you through a lab.
I probably won't run every single one
of the scans provided in this lesson.
You could do that yourself in your own exploration.
However, I will walk you through the ones
you need to know for everyday Nmap usage.
I will show you how to combine
certain scan techniques and how to look at the results.
Thanks so much for going through this lesson with
me and I'll see you again in the next one.