Hello everyone. So in this
video we are going to see the TCP synth type
of scam which is also known as stealthcan or
half open scan.
The syntax of doing the scan is nmap hyphen
SS the target IP
address that you want to scan and hyphen P the port number.
This can type is also known as half open
scanning because it actually never sends or
opens a full TCP connection.
The port scanner generates a syn packet
if the target port is open, it will respond with
a synac packet the scanner then responds with
the rst reset packet.
Closing the connection before actually the handshake
is completed.
That is only two steps or Arden of the TCP
3 Way handshake.
If there is a port which is closed, but unfiltered the
target will instantly respond with the reset
packet and tell us the port is closed.
So what actually happens in the
background?
When we are going to perform a stealth
scan.
As you can see on the left hand side is the unmapped machine
through which you're going to perform the
scan on the right hand side is the server which
is your target.
So the first request that nmap sends is the sin type
of packet.
the server responds with the synac
but there is no act like the full
TCP connect scan that we saw so there is
no acknowledgment packet that has been sent that's
why this is known as TCP half
connect scan.
So, let's see the Wireshark packet break down to understand
better what actually is happening.
As you can see in the figure the first request has
been sent to Port 23.
and put 22
Port 23, the reply is reset, which
means this port is closed.
But for Port 22 a synac has been received which
indicates that this port
is open.
You can notice there is no third step of
tcp3 way handshake that is act which
is happening over here.
So what are the advantages and disadvantages
of this type of scan?
The advantage is it is quicker because it
sends less number of packets.
What is the disadvantage with the admired advancements in
firewall and server defenses technology? It
is not very stealthy anymore.
So it is the Practical time and let's see
this type of scan in action.
As you can see over here. I'm going to type the
command and map.
And my target IP address that I want
to scan.
I will add the flag hyphen V to see
the output in verbose mode.
Now I will add hyphen SS which stands
for a stealth scan.
I have also started Wireshark in the background and
I will hit enter.
As you can see the nmap has successfully initiated
a sin still scan.
The Wireshark is running in the background.
As you can see and map has identified three
ports, which is open put 88.445 and
Port 7070 and the host is up.
Now, let's go to Wireshark and into the
filter. Let's type ip.edr equals
equals the target IP address that we
scan for.
Now, let's see the packets in which we will observe the
sin and the synac that happened.
Remember in this type of scan there will be no third step
that will happen. That is
the act packet.
So, let's see in the packets if we can see perfect as
you can see over here.
The sin has been sent and synac has
been received for this specific port number.
Which is 445 as you
can see over here a sin was sent and synac
has been received over here.
As you can see here.
This is the target side. I was running the
Wireshark and on the target side. Also, the sport
was opened and 445 has been
successfully sended a sin act
packet which indicate that this port number
is open.
If you notice for all other ports, the reset has been
successfully sent which indicates that this port
number is closed.
As you can see all the other ports are
closed and hence reset packets have
been sent for all other different ports.
So I hope you guys understood that TCP
half connect scan or the stealth scan.
Thank you.