In this lecture, we are going to see how we can scan networks and our target machines.
Network scanning refers to the set of procedures appropriate for identifying a network host or services.
It is one of the key components of intelligence gathering that attackers use to create a profile of
the target organization.
It has the following main objectives.
Discover Life Host IP addresses and open source for all live host.
Discover OS and system architecture.
Discover services on the Gold Coast and discover vulnerability online.
Both.
No net is a free and open source network scanner, which is used to discover host and services on computer
network by sending packages and analyzing the responses.
And we've provided a number of features for probing computer networks, including discovery and service
and operating system detection.
These features are extensible by scripts that provide more advanced service detection, vulnerability
detection and other features.
And Meb can adapt to network conditions, including latency and congestion during this can.
Net provides results in the form of four states.
But many scanners have traditionally enabled all ports into open or closed states.
And MAP is much more granular.
It divides ports into six states.
Open, closed, filtered, unfiltered, open, filtered or closed filter.
These dates are not intrinsic properties of the boat itself, but describe how a map sees them.
For example, a scan from the same network.
As a targeted visual word.
135 Dxb has open one scan at the same time with the same options from across the internet.
Might show that both is filtered.
An open court indicates that an application is listening for the connections on the board.
The primary goal of a board scanning is to find these.
Close.
Both indicates that both was relative, but there is no application listing on the board.
A filtered board indicates that probes were not received and the state could not be established.
Unfiltered indicates they're both received, but the state could not establish.
In other words, the port is accessible and MAP is unable to determine whether it is open or closed.
Open filtered indicates the report was filtered or open, but InBev could not establish the state.
Similarly, loose filter indicates that MN Map is unable to determine whether port is closed or filtered.
So before jumping on the actual scanning, we need to know about the TCP header.
And the most important thing, the flags.
And Mab uses these flags to conduct different types of scans which are urgent eg push inserts in Anfield
flags.
The other thing that we need to know is about the handshake.
What that ECB connection is established.
The client sends a thin packet at the same flag on the server, responds with same and flag set, and
the client again sends the EC packet with flag set and then the handshake completes.
Similarly, on connection termination clients sends a thin packet flex set server response within EC
and the client's handbags eg and the connection is terminated.
No, Let's see some skin types.
There are a number of skin types that and supports.
We are going to see only the most popular ones.
No the banks get scan is used to scan for the live host on the network.
Just use the command with flag and it will tell us which posts are up.
For example, a machine that scan a machine network is used the command as shown on the screen.
Then you can scan the complete Network for Life hosts and we can see a couple of hosts in the Target
network.
The second is the DCP Connect scan or DCB scan will scan for all reports and ensure for the listing
or through a three way handshake connection between the source and the destination port.
It can be launched with the flagged SD.
The scan does take this longer and require more packets to obtain the same information, but targeted
machines are more likely to log this connection.
Lord, this can go to a machine launch and scan with stuff leg.
An NMA will provide a detailed report along with the Open.
The third and the most popular scan type is PCP scan.
This scan is often referred to as off opening scan because you don't open a full TV connection and send
us in packet as you are going to open a real connection and then wait for the response.
This can can be read as flag.
Since Ken is the default and the most popular scan option for good reasons, it can be performed quickly.
Scanning toddler ports per second with a fast network not hampered by restrictive firewalls.
No on your machine.
This log the scanned with SS flag.
But you need to have the root privileges to launch this type of scam.
Just give the command again the sudo.
And Neville scan the target's.
The next scan day is will be scan.
UDP scan works by sending a packet to every target for four more sports.
This package will be empty.
No payload, but for a few of the more common powers of protocol, specific payload will be sent by
NMP.
This is launched by Sue flag as UDP is connection less protocol and there is no protocol defined relationship
between packets in a direction.
However, most operating system return an ICP port on visible packet.
If a packet is sent to the closed report that support that does not return an ICP packet can be assumed
open.
Normally, if any response is received, the port is assigned the state of open.
If no response received, it is classified as open filtered and if receive ICMP for unreachable error
type three Code three it is classified as closed and for other ICMP unreachable errors, which is classified
as filtered.
No.
Let's launch PewDiePie skin against our target.
Let's give the target IP and as you flag.
It was the target.
So all your reports that are open.
The next scan is team scan.
It is one of the port scanning methods which uses the sheer stupidity of the old and stateless firewalls.
In fact, when it comes to field scan or scanner software, send a packet with a flag in the form of
PIN in the end of session to the destination firewall or post.
If no response is received, it means the port is either open or filtered, or if the return is reset
or it means the server port is closed.
Often it is used to diminish the connection between the source and destination port.
Typically after the data transfer is complete.
However, rather than even pretending to initiate a standard reconnection and sends a single failed
packet to the target tag is RFC 793 compliant and open port will drop the packet and close port will
send a reset.
Look, a lot of things can buy as a flag.
I'm also giving ad5 flag to speed up the process.
Then you can see that we have the result in the form of open at both.
The other scandals are not in this case that were in a similar fashion as brain scans and eczema scans
thin and urgently exhausted while in a scan a sequence of PCB packets with sequence zeros, inset and
no flag set.
We can launch another scan with some flag.
Whereas an X scan is launched with the help of S x flag.
Then you can see the posters.
NW has a variety of skin types and you can check different types of skins by the number that I have
shared.
However, the most popular ones that are in use are detection and detection.
Which are laws by dash a flag and dash or flag.
So let's scan a target for the last time and check the different versions of the services that are running
on the system.
Bashir will check the system for the most popular options, including detection and detection, and
SC will check the latest and map scripts.
And you can see that this report is more detailed than our previous scans, and we can exactly see different
versions of the different services that are running on the system.
And we are going to target this vast FTP service to exploit the system.
I hope you like this lecture and see you in the next lecture.