Instructor: It is time we discuss different scan types
that we can do with Nmap.
Now, Nmap is a huge tool
and it offers many different types of scans
that we can perform
and we'll be covering just some
since there are a lot of them.
However, at the end of this video,
I will give you a really good tip
as to how you can really master the Nmap tool.
Talking about different scans doesn't necessarily mean
the tool will get different results.
Matter of fact, many of these different scans
will give us the same result.
And in this video, I am going to explain exactly
what the differences are between certain scans.
To fully understand this,
you will need a background knowledge on TCP and UDP.
So, in case you didn't watch the short video
I made on TCP and UDP,
make sure to watch it before covering this.
Let's start with first type of scan,
and that scan is called TCP SYN scan.
Let me open the terminal.
The command that we must run is nmap -sS
and then we're going to be scanning
Metasploitable in this video
since that is the machine that we are attacking,
so the IP address of my Metasploitable is 192.168.1.6
and this -sS is TCP SYN scan.
SYN scan is probably the most popular scan in Nmap.
It can be performed quickly,
scanning thousands of ports per second
or networks that aren't protected by a firewall.
And the reason why it is called a SYN scan
is because it never really opens a full TCP connection.
You only perform the first step of three-way handshake
which is sending SYN.
And the way it works
is if the target sends SYN-ACK back for a certain port
that indicates that that port is listening or it is open.
Target can also send something called RST
which stands for reset,
which would indicate that the port is closed.
In case it doesn't give any response back
after several tries,
port will be marked as filtered.
And filtered is just another state of ports
that happens once Nmap cannot determine
whether a certain port is open or closed.
The filtered state could happen if port is, for example,
protected by some filtering or a firewall.
And now that we know exactly how TCP SYN scan works
let's test it out on our Metasploitable.
There is one thing with this command.
If we try to run it, it will not work.
It will tell me, "You requested a scan type
which requires root privileges."
And the reason this requires root privileges
is because we are only sending one part
of three-way handshake
and telling our machine that we do not want to respond
to a SYN-ACK bit set
in case it is sent back from the target
that requires root privileges.
So we must run this with sudo,
sudo nmap -sS and then let's type in our password.
And we will notice it gives us the results
of ports that are open very fast.
And it is also very important and satisfying
once we know how a certain scan type works.
Once again, it sends only the SYN
and waits for a SYN-ACK or RST
and it never establishes a full TCP connection.
Let us check out the result.
So we got these ports open
and we also got what service is running on those open ports.
Now, here's the time that it took
and we are going to compare this with different scans.
And the reason it finished this fast is, once again,
it doesn't establish a connection.
Compared to this SYN scan that we just performed,
we also got something called TCP connect scan
or also labeled as -sT.
So in order to run this,
we can just change this command from -sS to -sT.
And you will see all of these options
if you run the Help menu of Nmap.
What's interesting about this
is that it does not require sudo privileges,
and the reason it does not require is because it performs
a normal TCP three-way handshake connection.
So the only difference between this and previous scan
is that TCP connect scan establishes a full connection.
The important part here that you should remember
is that this scan will leave much more trace
that you performed an Nmap scan on the target machine
and it is easily detected.
That's why once you can run Nmap as root,
usually SYN scan will be a better option
than the TCP connect scan.
Nonetheless, let's test this one out so we can remove sudo,
as it does not require root privileges,
and you will see it also finishes relatively fast.
The output will be exactly the same as with the SYN scan,
but sometimes it could take a little bit longer
than the SYN scans
since it is performing a full TCP connection.
And even though we got the exact same result,
which are just the open ports
and the services that they run,
now we know how both of these scans work.
And now you know that, for example,
this scan is much more detectable than the SYN scan,
or you can say that it just makes more noise
on target machine.
The last scan that we're going to cover
and, keep in mind, these are just some of the scans
and I will show you where you can find
the rest of them and possibly test them out, if you want to,
but the next scan that I'm going to cover
is pretty unpopular
and that is the -sU scan or also known as UDP scan.
The reason why it's unpopular
is because many services on the Internet
run over TCP protocol, as we already know.
Since UDP scanning is much slower
than TCP scanning and more difficult,
sometimes, when people are developing security
for their ports, they ignore the UDP ports.
And this results in a mistake
as there are a lot of exploitable UDP services
and we should never ignore this scan
just because it takes time.
Let us test it out.
This also will require sudo privileges,
so let us type sudo nmap -sU for the UDP scan
and specify the IP address of Metasploitable.
You will notice this scan will take time.
You can check at how much percent it is currently at
by pressing the upper arrow key.
So if I press upper arrow key,
down here it'll tell me it is currently at 3%.
And I'm just going to leave this running
while I show you the cool tip for the Nmap.
So remember this, the key to learning Nmap in great details
is not in reading its Help menu
but in reading its manual.
And to open the Nmap manual, you can open your terminal
and type manual nmap.
And let me do this in a second terminal.
So I will open it up. Type man and then nmap.
This man right here is shortened for manual.
Press Enter.
In this file it explains every Nmap option in great detail.
Let us find different scan types that also exist
since we didn't really cover every one of them.
Let's scroll all the way down to different Nmap scans.
And as we're scrolling,
you will see that we are passing the actual Help menu
that we get outputted once we run the --help.
And below this Help menu,
it explains every option in great details.
And as I'm scrolling, I came to this part
which says port scanning basics,
and here are the six port states recognized by Nmap.
And this is good to read,
so we got the open port state, the closed port state,
we got filtered port state, unfiltered port state,
open and filtered, and closed and filtered.
So if you want, read through this.
It is really useful knowing once you get, for example,
filtered ports to know exactly what that means.
And if I go a little bit more down, here they are.
Here are the different scan types that Nmap has
So here is the TCP SYN scan that we performed, which is -sS.
Here is the -sT, which is full TCP connection scan.
And down here, you will notice after the UDP scan
that we got different options
as to how we can perform our scan.
And you can read about each and every one of them,
and see when are the useful, and how you can specify them.
Here is the TCP ACK scan,
here's the TCP window scan,
and you will see there are a lot of them.
There are also different options such as these scanflags
which is custom TCP scan,
but this is an advanced option
and we might take a look at this later on.
Here is idle scan, ECHO scan,
let's see all the way down.
IP protocol scan, FTP relay host, FTP bounce scan.
And that would pretty much be it for the Nmap scans.
So depending on your target and what you exactly want to get
from this scan,
you would pick one of them.
So for example, if you wanted to discover open ports,
you would use the TCP SYN scan.
Now the ACK scan, I believe, which is the -sA,
which we saw a few seconds ago,
is useful, I believe, to mapping out the firewall
just read through them, if you have time,
and you will discover how they work
and when are they useful.
So let's see how much percentage our UDP scan is at.
So it has finished about third of the scan.
And we know that this will take
at least 10 to 15 more minutes,
so we're not going to wait this.
And by the way, about the Nmap manual,
you'll need to read that entire file,
just it is good to know that it exists.
So sometimes when you forget something
or you want to check out
if Nmap has some other option that you need.
You can just open that manual
and read until you find what you need.
Nobody expects you to know everything inside of that file.
But after some time, you will start picking
some of the comments up and memorizing them.
Cool. We covered a lot in this video.
The next two videos will be even more important.
We're going to check
how we can discover operating systems
that our target machines run
and what versions of services are they running
on an open port,
which is, remember, one of the most important things
that we want to find.