WEBVTT 00:01.130 --> 00:04.820 Well, it's time for us to talk about scanning. 00:05.120 --> 00:09.180 We kind of think of scanning as a bad word. 00:09.380 --> 00:11.720 Often times in this context. 00:11.990 --> 00:17.000 But remember, scanning is something that we're going to be doing with management tools quite a bit. 00:17.360 --> 00:23.630 The scanning that we're talking about here is when we are being scanned as part of a reconnaissance 00:23.630 --> 00:24.080 attack. 00:24.560 --> 00:30.830 Now, just to kind of set the stage here, I understand that when there are scans taking place against 00:30.830 --> 00:38.120 your infrastructures, you have someone that's really creating quite a profile of your organization's 00:38.120 --> 00:39.440 I.T. infrastructures. 00:39.800 --> 00:46.190 They're really building this excellent documentation, perhaps documentation that you should have already 00:46.220 --> 00:46.670 had. 00:46.890 --> 00:49.010 They're in the process of creating. 00:49.980 --> 00:58.230 Often times when you hear scanning in the ethical hacking context, you immediately think of network 00:58.260 --> 00:58.970 scanning. 00:58.980 --> 01:06.000 And yes, this is network scanning that we're talking about, but understand that a lot of times we 01:06.000 --> 01:12.390 will break out network scanning from port scanning, from vulnerability scanning. 01:12.690 --> 01:20.640 So you'll want to be very precise when you're speaking with clients about exactly what type of scanning 01:20.640 --> 01:26.250 that you are talking about, is it specifically port or network or vulnerability scanning? 01:26.880 --> 01:33.690 When we're engaged in network scanning, we're typically wanting to enumerate information from hosts, 01:34.050 --> 01:36.930 from ports and from services. 01:37.080 --> 01:43.650 It's all about who's out there, what services are they running, what ports do they have open? 01:43.830 --> 01:50.760 This is key information that the attacker gains in order to begin an attack against you. 01:51.620 --> 02:00.080 Now, one of the things that I want to review with you is transmission control protocol and specifically 02:00.080 --> 02:06.860 six bits that are in the TCP header that give us the flag settings. 02:07.190 --> 02:15.260 It's critical that you know this because oftentimes these flags are going to be set a certain way during 02:15.260 --> 02:16.040 scans. 02:16.280 --> 02:21.860 So let's review these six bits and what they mean when they are set. 02:22.580 --> 02:28.020 Notice the first bit that we need to talk about here is the syn bit. 02:28.040 --> 02:34.970 So when this bit is set to one, this is our syn bit setting or syn flag setting. 02:35.240 --> 02:41.150 You know, the sin is used to initiate the TCP three way handshake. 02:41.690 --> 02:45.710 Sure enough, the next flag is the ACH flag. 02:45.770 --> 02:48.320 This is the knowledge flag. 02:48.560 --> 02:52.040 We know this is another key part of that three way handshake. 02:52.520 --> 03:01.580 There's a push flag with the push flag indicates is that the receiving machine should be ready for a 03:01.580 --> 03:04.190 large flow of information from the sender. 03:04.190 --> 03:07.040 So it's saying, push the things out of your buffer. 03:07.040 --> 03:07.790 Let's go. 03:08.240 --> 03:15.290 The urgent flag indicates that this data should be processed urgently on the receiver. 03:15.620 --> 03:24.920 The thin flag is to terminate the graceful way to terminate the TCP session and the ungraceful way to 03:24.920 --> 03:27.440 reset it is the reset flag. 03:27.530 --> 03:32.720 The rusty flag will cause a reset of the communications. 03:33.110 --> 03:34.700 Notice the reset. 03:34.700 --> 03:43.300 The Syn in the ACH are often used in scanning utilities when you are being reclined against. 03:43.520 --> 03:50.570 So these settings are great to look for in packets when you suspect some type of scanning attack. 03:51.170 --> 03:55.340 Well, we're going to have a lot more to say about scanning in the videos that follow. 03:55.340 --> 04:00.950 But I hope this has done a great job of setting the stage for you and again, reviewing some of that 04:00.950 --> 04:02.990 key TCP header information.