‫Well, what do open, closed or filtered actually mean?
‫Let's take a closer look at the results of and map when Map sends packets to a port and receives a positive
‫response.
‫The port is assigned the state of open, for example, since Scan receives a snack from the destination
‫system if the port is open.
‫If Unmapped determines that a port is not available, it assigns it the closed state.
‫This signifies it, and map has received a result that clearly shows that the port is closed.
‫A sign scan receiving a receipt in response to a port query is an example of a closed port.
‫Filtered port are the result of a packet filter or firewall when no response at all is received from
‫the remote device.
‫The port is considered to be filtered since the response isn't received from the port, and Map often
‫retrieves communication to the port to ensure that the packet wasn't simply dropped due to error or
‫congestion.
‫Please note that this type of response is categorised differently.
‫If this is a different scan type, such as a UDP scan or a fin scan, the next result open filtered
‫is coming in a minute.
‫On the other hand, if the destination systems return an unexpected response again, the port is considered
‫to be filtered.
‫If we get an ICMP unreachable response, in a sense scan, the port is flagged as filtered.
‫Now, in some cases, the lack of a response may not necessarily mean that a port is filtered.
‫Lack of a response might mean that the port might also be open now in these situations, and map signifies
‫that the port is either filtered or open.
‫For example, in a UDP connection, in most cases, the destination system does not send a response
‫when it receives a UDP packet.
‫So if the destination system does not respond and map categorizes it as open, filtered makes sense.
‫In this slide, you see some of the most known default ports.
‫So here's the question.
‫If the Port 22 is open, is the service running there absolutely and S-H?
‫Could there be another service?
‫Well, these are the default port numbers of the services.
‫You can run any service in any port.
‫You can run FTP on Port 22, for example.
‫But for the ease of use, the default ports are used in general.
‫So if you're performing a pen test, you should probably look at the well-known ports first.
‫But you should never just scan the default port.
‫There are different ways to scan ports within map.
‫Let's see how we can scan ports.
‫Let's prepare a synth scan for a Metasploit able device.
‫The IP address of my Metasploit bill is one seven two one six nine nine eight two zero six.
‫If you do not use any one of the port scanning parameters, top 1000 ports are scan, top ports are
‫the most used ports in general.
‫The first way of choosing the ports to scan is using parameter.
‫After entering the scan type and target IP.
‫Enter the port numbers with P parameter.
‫You can at airports one by one, separated by a comma, or you can give a range of ports by putting
‫a dash between the port numbers in this example, the ports 20 to 80 and the ports between 100 and 200
‫are scanned.
‫If you perform both TCP scan and UDP scan in a single Nmap query.
‫You can choose both the EDP ports and the TCP ports using parameter.
‫For this end map, scan will use both in the scan and UDP scan at the same time.
‫We haven't seen it yet, but the UDP scan is performed using less capital you parameter.
‫And as you know, the signs scan is a type of TCP scan.
‫After entering the target IP put Dash P.
‫One or TCP ports put uppercase T with a colon just after the parameter P and the TCP ports to scan.
‫Sam is giving port numbers directly with parameter, you can enter ports one by one separated by a comma.
‫Or you can give a range of ports by putting a dash between the port numbers.
‫To specify the UDP ports put you as a no case, you with a colon and the ports with the same format.
‫For this example, let's scan the TCP ports 22 and 80 and the UDP ports 53 and the ports between 139
‫and 150.
‫So here are the results TCP ports first and then UDP ports.
‫Another way to specify the ports is using top ports parameter using this with the number of ports that
‫will be scanned.
‫You can scan the top ports within this parameter, so let's scan top 20 ports, for this example.
‫So here are the top result of the most used 20 ports.
‫If you use uppercase F, which means fast scan, top 100 ports are scanned.
‫So let's perform an end map since scan with f parameter here.
‫And open another terminal screen and perform another end map scan using top ports, 100 parameter.
‫As you see, we get the same result because these are the same queries.
‫If you'd like to scan all the ports of the system.
‫Well, you should scan all the ports of the systems and append test.
‫You have to use the P parameter with the interval from one to 65.
‫Five three five.
‫This is a range of possible port numbers.
‫Prepare the map since can query with a destination IP address.
‫Now put P1 Dash six five five three five.
‫And hid in her.
‫Here are all the open ports of Metasploit among.
‫By default, and Map does host Discovery and then performs a port scan against each host it determines
‫is online.
‫If you use pen in the end query, you skip host discovery and port scan all target hosts.
‫Disabling host discovery with -- causes and map to attempt the requested scanning functions against
‫every target IP address specified.
‫So if a Class C target address space, that means 24 is specified on the command line.
‫All 255 IP addresses are scanned.
‫Why would we want to do this?
‫As you know, if you were a privileged user in maps and four types of packets to discover hosts, expect
‫a request send packet to TCP 443 port.
‫Backpack it to TCP 80 port and ICMP time stamp request.
‫If the system is configured not to answer to ICMP requests and if the ports 80 and 443 are filtered,
‫then that map thinks that the host is down even if it's up.
‫If you find a system which is not found by pings can always use PM for further port scans.
‫Otherwise, and Map doesn't perform the port scan because it assumes that the host is not up.
‫So if your network is not big or if you don't have enough time to scan, you should skip the ping scan
‫and run the port scans for every possible IP address.
‫Use a port scan instead of ping scan if you were scanning a server block because those systems are configured
‫to be more secure than usual.
‫Then you can find more computers than the ping scans do.
‫You're halfway there.