Hello everyone in this lesson. I will talk about how to
detect a port scan with nmap.
First of all, let's talk about briefly. What
and map is
so unmet which means network members.
And it is a free and open source
Network scanner tool.
And it is used to discover hosts and
services on a computer network to map
out networks and to identify the types of devices
and services running on a
network and map is available for all major operating
systems and including Linux
Macos and windows.
And may provides several different types of scans. However,
in this course, we will be
covering the most known and use
it basic Port scanning methods
and we will start with TCP connect
scan first and then we
will examine TCP stealth or maybe you
know TCP scene scan and
then UDP scan types
sequentially. So by the way, I performed
each scanning method in and map
beforehand in the web environment and captured the
network traffic. I have captured the
network traffic in the moment that I have
performed and met scans and we
will see Port scans over these pickup
files.
Let's talk about TCP connect scan is
the first type of the nmap scan.
Maybe you have heard about it before.
And it is based on tcp-3-way handshake.
So this is the key point for us and it simply
attempts to establish a connection to
the Target host or hosts.
If the connection is successful, it means
that the port is open. So this can
option is very fast, but it is also very
easy to detect.
And as it creates a full connection with
the target host. So since it
creates a full connection with the target host. It is
very easy to detect keep in
mind that and well well since this type
of Port scanning is based on TCP three
way handshake.
And if TCP can establish a connection with the
host by doing three-way handshake, it understands
that that port is open.
So, let's see how tcp3 way let's
see how tcp3 very handshake is
on open port and close Port there are
two separate tcptv handshake
patterns for the open port and they will
see them in the first case. It could
be like this.
Firstly we can.
Create our sites.
as
aligned
and
client and the host
and this pattern is for
open port statement.
So
in the first case, it could be like this.
First the client sends a scene
message.
As seen message.
And this message means a
connection request. So then the host sends
a confirmation message that it
has received this message if the request Port
is available.
And it has received the send message. So this
becomes the thin egg message.
Host will seen egg.
Message like this.
In response to the scene act
message declined sense and egg
message.
In the third step client sends and egg
message.
like this
So the client sends an
egg message and thus the connection is established
another pattern that
may be happen for an open
port is like this.
and this is our second pattern
for
an open port
so let's look at this.
This is the second pattern and in this pattern.
We also have a client.
of course and a host sides
and the communication begins again
with the scene message.
from the client to The Host
and the host response with a scene
act message.
like this scene egg message
So the client sends an egg in
response.
again
And then an rst egg comes
from the client.
or ST, which means reset
Egg message to finish the connection
and the conversation.
And in this way sending the rst ACT
message by the client.
By the client right after the egg message
isn't normal if there is no problem
with the network. So keep in mind that so in
close Port TCP handshake pattern is
like this. Let's take a look in here for
the
closed port
TCP conversation
If the port is closed, let's see what happens
the client.
And we have a host.
So in this situation the client sends a
scene message, of course again to establish a
connection with the host.
As seen message.
Is sent by client?
And the host on the other hand responds with
rst directly.
First sense and rst X message
because the requested Port is closed.
Since and map TCP connect scan also
performs Sports scanning by obtaining these
patterns. We will see such packets in
the traffic. We capture during Port scanning. Well,
the question that comes to mind
at this point if there is a
terrific with the same structure as TCP today,
we hashtag patterns. How do we
separate the end map port scan? How do we separate
the envelope port scan ones from the
real TCP handshake?
The answer is we have to use first correct
filtering expiration. So now
let's open our pickup file containing TCP
connect scan packets now.
And to inspect and map TCP connect scans in
a PK file firstly you should use this filtering
expiration.
Now I am typing the filtering expression into
the display filter field.
And this filter expiration.
Have some values and these values
about the flex value the
experimenters.
and TCP flag
In here, the TCP Flex
is seen seen for like if something
like is said to one and
if x flag is set to
zero we have an end map scan packets.
We may have a enemap scan packet. So
the second important point you
should look at after this stage. Is
this the IP addresses of
the source and destination?
But firstly let's apply this
filtering into our pickup file.
And I have clicked the enter.
So now
we are seeing the scene messages scene packets.
because
we have set the scene value as one
and the x value is
0.
Because of this we are seeing now only
the same packets.
and
we will analyze the packets over
scene packets and the second
important point. You should look at after this stage.
Is this the IP address of the source
and the destination this has typically involve
a large number of distinct Source
IP addresses all trying
connect to
a single destination IP address
And map TCP connect scans typically involve a
large number of these things
Source IP addresses all trying to
connect to a single destination IP
address.
As like this for example here scene messages
came from a single Source IP
address to a single destination IP
address and the next place to look from
here is of course the port
numbers.
this nation port
especially is destination Port so nmap.
TCP connect scans.
Often Target a wide range of port numbers looking
for open ports that might
be running Services as in here.
You can see there are too many.
port numbers that
have been sent some sin packets
and as you
can see here a single client sends requests
to avoid range of
port numbers. So these packets are
the end map TCP connects can
packets.
And now let's take a look
at the handshake patterns created by nmet Port
scanning on open ports.
I know ports 135 and
139 are open. That's
right a filtering.
TCP
DCP Dot
port
is equal to
135
and click on the enter now.
There it is. Just like we saw
in the open port pattern.
Scene message comes first.
as you can see
from the attacker machine Maybe
we can imagine this IP belongs to
the end map Port scanner and
it sends a scene message to the
Target to Target machine
That as the IP address ends with
2.15.
and after scene message
As you can see the host the target sends a
scene act message.
As the second step of
the tcp3 very handshake.
and after this scene egg message the
End map scanner's hands and egg message to
the Target.
So in here the TCP TV handshake
is completed.
and the connection
has been established.
So just like we saw in the open port
pattern and on the other hand
and map performs a ports
can responds within egg and then
sends and rst.
And rst egg message in
addition to these patterns. Finally. You
can also examine a packet payloads.
So now let's examine another nmap ports
can method TCP stout or
tcps and
We will use this pickup file
and maptcp start scene scan pickup
and G and this file also
has Network packets that were captured at the
moment. This port scan was performed.
You should know this.
And while nmftcp connect
scan is performed the nmap even
St. Comment mftcp since
can.
Uses with the mrtcp sinscan
is performed with the
end map Heaven S command. So
this can option uses the
cineflag in the TCP packet heater
to establish a connection with target post and it
doesn't complete the TCP handshake.
This is the important point. It doesn't complete
the TCP handshake. So
it is less detectable than anticip
connect scan. However, it
may be blocked by firewalls or other security
device that are configured to block syn
packets the patterns it follows for
open and close ports are like this
and let me show you now.
A scene message comes from the
client.
The end map client and the host
response with a scene egg again.
As usual as seen Edge message, but
at this point the end
map finishes with rst, and
we will finish the conversation with
rst message.
So, thus the TCP handshake
is not completed.
for the close port
the pattern will be like this.
So in here the pattern is the same as before
as in the TCP connect
scan and as in message is sent to
the Post.
And post ends with rst act
message as you know.
Rst Edge message because the
port and map wants to establish a
connection is closed and now let's
move on to the pickup file.
Now, let's see if nmap performs a
TCP handshake on open ports
without completing it without completing
the handshake process for
this. Let's look at the conversation in an
open port and I know in an open
port so I will type A filtering.
it
45
is our Port that is open.
As you can see it sent.
an rst message
in here as a response to the scene act
message, even though it was indeed and
open port.
And map TCP scene and map TCP scene
Parts can is very fast.
You should know this and it can be recognized by
sending too many thin messages
in a very short time span.
So let's turn back to the packets all
of them.
And when you investigate the time
range you can
see there are too many
seen packets in a very
very short time.
In a very short time range, you
can see this now open
the iograph to analyze
it.
Look at how quickly around 2,000 packets
were sent.
in a very short time range
nearly
two seconds about 2000 scene
messages arrive in less than two seconds. So
it is important to have a wide range
of Target ports as well.
And remember that the PK
price we reviewed.
Consists only of ports can packets.
Therefore we can easily analyze. So,
however, since there may be too
many Network packets in the same seconds in
very large pickup files to if
you are working in an Enterprise Network
environment, and you must
first filter The Source IP address in
order to perform this analysis.
so however after this filtering after the
IP filtering
you may notice a traffic like this one.
That we have in this pickle file.
For example here. You can write a field into
like this IP.
Dot
source
Is equal to the suspicious IP?
so we will write the suspicious
IP as
10.0 Dot
2.4
And when we filter out this IP as
Source IP, we have
the our texts.
Likewise in UDP port scan analysis.
You should write a filtering as
UDP dot SRC which
means source as UDP
packets will come and now let's
examine and map UDP port scan
and we are closing this peak a file.
so the third one is
Nmap, UDP scan and
it's common for
nmap.
is even as you
As you know UTP is not a connection based
protocol UDP packets are sent directly
to the destination. The protocol doesn't carry
whether packets error or not.
Therefore we can imagine a pattern for
open ports like this.
For UDP communication declined sense
a UDP packet to the host and
this is the UDP packet.
So there is no packet turning back and that's
it.
And enclosed ports close ports.
We can imagine the communication like
this.
If the port is closed client since
the UDP packet to
the host and because the port is
closed in the host site the
host will send and icmp packet
like this and icmp error
packet will be sent by
host.
So if the port is closed and icmp message
is returned to the client. So
this message is destination unreachable
Port unreachable.
The values of the code and type
parameters of the sicmp message
are will be three in
the icmp message. We
will see the perimeters.
Gradually the type and
the type value will equal to 3
and the other parameter code.
And code also will equal
to 3 so now
we can find and analyze such
icmp messages in our
pickup file to find a
UDP scan patterns because
if there are too many
acmp error messages for too
many ports in our Network.
There may be a UDP
scan operation. We will write
a filtering expression with this
pattern.
Now, let's turn back to the PK file
and let's apply the
filtering.
We will write.
the icmp DOT
type parameter
is equal to
3 and
icmp
dot the another parameter will
be called.
is equal to
3
and now we can click on the enter.
As you can see there are too many
packets.
We have 101 packets with
the message of icmp
protocol and the message
contains destination unreachable or
Port unreachable.
this answers
were given to the same IP address for a
very wide range of ports.
And it can be understood that this is a UDP
port scan.
It is important to note that this method may
not be foolproof as there may be other types
of traffic that also exhibit this pattern
of multiple packets to the same
destination IP address with varying destination
ports additionally attackers may
use techniques like IPS, proofing
or randomized storage to evade
detection. So you should always consider
other indicators of an
app scans such as timing especially and
payloads and other network
metrics before making a final
conclusion.
That's all for now. See you on the next video.