To get started,
let's talk about identifying open ports on either
individual or multiple network devices.
In order for us to understand what we mean by an open port,
we need to understand the statuses that we can get returned back to us.
The first one is open,
which means that the target machine that we're connecting to or
trying to connect to is listening for connections.
So let's say we're using port 80, so HTTP.
That means it will be listening on port 80,
and it's also accepting packets to that port.
We could also get a closed status,
which means that the device or the target machine is rejecting
connections and ignoring all packets to that specific port.
And then our third status would be filtered,
which means there's something in between, maybe a firewall,
a filter,
or other network device that's restricting or
blocking access to that report directly.
Now just like we did in the past,
there are some specific scanning tools that we can utilize.
The first one will be our trusty .NET API namespace,
which is going to be somewhere under the System.Net namespace.
We could also use the Test‑Connection cmdlet, which is native to PowerShell.
There are many third‑party PowerShell modules that we can download and install.
And then, of course,
we can include the use of our Nmap tool that we utilized previously.
Now the .NET API namespace, we know that we utilized System.Net last time,
but it provides a client connection approach by dropping into Sockets.TcpClient.
If we branch into that TCP client and look at the
constructors that are available,
you'll see the first one is a TCP client instance that's using some kind
of specified family or address family as it's called,
which would be InterNetwork, which would be IP version 4,
or it could be InterNetwork IP version 6.
The second approach is to pass an IP endpoint,
so some type of IP address that we can connect to.
The third would be to pass a name of a specific host and then a port,
so a kind of a pair of values that we can connect across.
Let's have a look at a basic example of what this would look like.
So let's say we set our IP address here.
We choose port 80.
And then what we do is we instantiate the System.Net.Sockets.TCPClient object.
And then once we've connected to that object and
created what we're calling client here,
client will then have a method called Connect,
and you can see that I'm passing in an IP address and a port.
That will then return whatever the status is for that specific
device that we're connecting to.
If we were to use native PowerShell and just use the Test‑Connection cmdlet,
then what this will do for us is it will send ICMP echo
request packets or pings to one or more computers depending
on how we write the PowerShell.
And we can also test specific ports for one or more of those computers.
So what does that look like?
Well, let's have a look at a simple example again.
In our first example here,
we've got our same IP address and port. And this time we say Test‑Connection,
specify the TargetName property, and specify the TcpPort. And that
will go ahead and test the two of those things together, does the IP
address exist and does the port exist, and return the status.
If we wanted to check multiple ports, for example,
on a single device, then we could set our IP address again.
And you'll notice how we're using the dot dot for the range,
so we've got from port 1.. all the way to 1024.
And then we can simply say ForEach‑Object call Test‑Connection,
passing the TargetName, which will be our IP address we have,
and then we're going to use the $_from the ForEach‑Object to pass the TCP port.
That will then iterate from 1 to 1024 ports for that single IP address.
We could also use Nmap to scan for specific ports as well.
Firstly,
we can use comma‑separated lists of ports if we know what the ports would be.
So we can say I want to target that specific device and say these reports here,
which would be HTTP, HTTPS, and Remote Desktop.
We could also use a port range as well and say 22,
which is SSH, all the way through to 389,
for example.
Or in Nmap, we can also set the protocol that would need to be used.
So maybe we are trying to connect using TCP or UDP or both.
So you'll see the syntax here where we say T for TCP,
U for UDP, colon, and then the port itself.
So what does this look like when we put this into PowerShell?
Well, if we were to use a comma‑separated port list,
you'll see that we can use the IP address and then we can say nmap
‑p and then start to comma‑separate the ports.
If we wanted to use a port range, we could do the same thing,
so nmap ‑p and then a dash for the 80 to 100.
If we wanted to set the port protocol instead,
so using TCP or UDP, we could do this.
So we can start to combine them together.
So the syntax is really straightforward.
And what's nice here about using Nmap is we can call this
inside PowerShell in a regular command window.
Or if we're using the GUI interface of Nmap,
we can just paste that command directly in.
Now there are some third‑party PowerShell modules that
other individuals and groups have created.
A couple of these that are quite helpful is PSnmap.
This is an asynchronous Linux Nmap tool for PowerShell.
You can do ping sweeps and scans and also check for open ports.
There's also one called PortScan, which is a simple PowerShell script.
This time, it tries to scan from the outside of the network and checks.
And then of course the famous one here is called PowerSploit, which
is a penetration tester framework that can be used for all different
types of assessments using PowerShell.
So what does it look like if we were to use a third‑party
PowerShell? So in this example, we're going to use some of
the PowerSploit commands.
So if I want to scan multiple ports on a single device, there is a specific
function called Invoke‑PortScan and a property called hosts, which is the
IP address or IP addresses, and then a property called ports where we can
comma‑separate those ports together.
If we were to do multiple ports on multiple devices,
you can see that we can simply comma‑separate the IP addresses and
the ports and pass them into the same thing.
The objective in all of these approaches is to get a status
response back to say this port is open or closed.