Hello everyone. So in
this video we are going to see the scan type
which is null scan.
So the syntax of doing the null scan is and map
hyphen SN the target IP address
and the port number.
This is one of the very still these scan that
sets all the TCP had a Flags to off
or null. That's why this is called as
anal scan.
This is not normally a valid packet
and some host will not know what to
do with this type of scan.
Windows operating systems are in this group and scanning
them with Nils scans will produce unreliable results.
However for non Windows servers protected by
firewalls, this can be a best way to get
through.
Remember Nils scans. No flex
TCP are set
So whenever you scan any
Target machine using null scan are if
a reset packet is received then
the port is considered as closed.
While if no response is received then it is
considered as open or filtered.
The port is generally marked filter
if an icmp unreachable error
is generated.
So take a note if Port is
closed. It replies with resetac and if it
is open, it does not reply.
So what actually happens when you run and null
scan?
So as you can see on the left hand side is the nmap machine
and on the right hand side is the server which we
are going to scan.
So the first request that has been sent is a TCP null
flag are set. So
no flags are set over here.
So if we get a reply with reset or
AC that means that that
Port is considered if you
do not receive a reply or
response, then we consider it as the port is
open or filtered.
So, let's see a Wireshark packet breakdown of
this type of scan. So as you can see a nun
packet was sent for the port 23 and
a reset was received which means
the port is closed.
Similarly again a nun packet was sent
for 22 and it was again same for 22. If
we do not receive a reset. That means that
particular Port is either open or filtered.
So what are the advantages and disadvantages of null scan?
The advantage is it is still
the and can bypass some of the firewalls.
What is the disadvantage it is unreliable at
many times because we cannot identify the
exact status of the port.
So now it is the Practical time and let's see
how we can perform null scan.
So as you can see over here.
I have written the command on my terminal as nmap. -sn.
And the target server I want to scan and hyphen V.
As you can see the scan has initiated successfully and
you can read over here. This is unnul scan.
You can see the host is up, but we have not identified
the exact status of any port.
You can see 500 ports are
closed or open or filtered.
This means we
Did not receive an empty response for
any of the port we have received a reset
for all the ports as
you can see over here. None has been
sent for all the ports, but we have received reset
for all the ports simultaneously
that means and map
has failed to identify the correct Port status.
So I hope you guys understood how we can
perform null scan and how it can be unreliable at
some times, but it is all also helpful.
Sometimes in bypassing the firewalls. Thank you.