So any map is the most powerful and preferred scanner for security professionals.
The usage of map varies from the weeds to an advanced level, so we will analyze the value scan techniques
in detail.
So you run any map directly from MSF console, as you normally would from the command line.
So however, if you want to import the results into the Metasploit database, you need to run the map
scan using the All X flag, so followed by the desired file name to generate the same allowed output
file.
So and then use the DB input command to populate the Metasploit database.
So have to do it starting anywhere from Metasploit.
It is easy.
So launch the MSF console here and then here.
And so it may take some time here.
So as you can see, some Metasploit Framework Council and here just, uh, right up here.
So as you can see, if we can start anywhere from in Metasploit console.
So um, this if you connect can is the most basic and defaults can type in anima.
So it follows a three way handshake process to detect the open pulse and the target machine.
So let's perform this scan, uh, on one of our targets.
So let me let me know.
Uh, here.
The conflict.
So now we will do a port scan here, so um, I looked at our target man machine.
I look along prejudice, so any map and map?
Is he and then your target API, others, so for example, in my case, is one hundred ninety one nine
two one one nine two.
One.
Six eight.
And then.
One six, eight one eight, eight, one eight, eight and one three five one three four.
So it can also scan the land addresses and to find to find the land comments.
Or as Phil, I um, have I had the opportunity to look from my scan, my lunch, um, IP address and
find this IP address from it.
But I just, uh, for instance, I just looked at it.
So and but the more examples will be, uh, on this picture.
So.
And press enter after what I think you're right, this, as you can see here, we have a several IP
addresses open here.
So and we have here on IPO, this IAC X11 show logging exists, making Microsoft as nebulous as this
and how should it be as empty it as FTP and so much we have port here.
So, um, actually now let's uh.
So as you can see here, um, the.
Scan is the most basic and default type scan and map, so as you can see, we passed the test parameter,
which denotes that the we want to perform a typical next scan.
So it is typical next scan is based on three Hanshin process, and the returns results of the scan are
considered accurate.
So then using an MMA fighter space-faring, the range in maps, scans, scans the most common 1000 points
for each protocol, so this is seen as synchronization scan.
So what?
What synchronization scan is and have to do?
It is not a study, but the S.
S see it.
So the synchronization scan is considered a stealth scanning technique.
So as it never forms a complete connection between the target and the scanner.
So hence, it is also called how open scanning.
So let's analyze synik scan on Italian.
So any map as is.
And after this, they will specify the potential here and map as is.
And they will come from port 22 to 22 to 5000, 5000 feet.
So this needs root privileges here.
The Soviet built sudo and enter your password, as you can see in the entries started.
So.
Is this perimeter here?
Is this parameter here?
Can you see it?
Oops, I'm sorry.
Here.
Yes.
So.
Um, the SS perimeter here will instruct the map to perform a synchronization scan on the target machine.
S So what this does is TCP is early in.
So this means the synchronization come on, uh, Typekit machine.
So the output of the is if you connect and, uh, sync scan here, as you can see here, maybe similar
are similar in most of the cases.
But the only difference lies in the fact that this synchronization scan are difficult to detect by firewalls
and intrusion detection systems.
It is, however, modern firewalls are capable enough to catch synchronization scans as well.
So the parameter here, uh, p parameter here, uh uh, typical British, uh, shows, uh, the range
of ports numbers that we want to scan.
So using P 22, uh, from 22 uh to 5000 we used in this year.
But uh, we can use, um, zero to sixty five thousand to smell, uh, over sixty five thousand five
hundred thirty five.
So this is for all portraits, uh, included here.
So.
The UDP skull, so the issue we will think about here is you saw the the big scan, is it scanning technique
to identify the open UDP ports?
So.
Here, let me read it here.
For UDP ports.
So is you for is you deep thoughts?
So the two identified the UDP or the reports on the Typekit, so is it Obuebite UDP packets are sent
to the surrogate machine and the recipient of an icy and purported unreachable message box.
To that, the port is closed or otherwise it is considered open, but it can be used like that.
For example, as you just on target IP, others see it and then execute the program, actually execute
the command.
It's not mandatory to use sudo.
I just mistake the user, but it's not a problem here.
So.
As you can see here.
Um, and in this comment, we will check, um, we will check thousand ports with tested Peltier's thousand
most popular, uh, protocols and protocol ports here, so.
They are doing you can now.
So how how these how these port scanning works here, so we have analyzed three different types of scarcity
that can be very helpful during penetration testing.
So any map provides the lots of different modes for scanning a target machine.
So here we will focus on three scan types aim, namely do these typical next scan the synchronization
stealth scan and the lastly you deep scan here.
So.
Uh, the different scan options of any map can also be combined in a single scan in order to perform
a more advanced and sophisticated scan over the target.
So let's move ahead and start the scanning process here.
So during a penetration test, the scanning process can provide lots of useful results here, so signs
the information collected here will form the basis of penetration testing, of course, so proper knowledge
of scan types is highly recommended.
So let's now take the deeper look into each of these plastic nukes.
Uh, that we just learned.
So the TCB Connect scan is the most basic scanning technique in which a full connection is established
with the port on the test.
It uses the operating systems network functions to establish connections.
So the scanner since a synchronization packet here and then um.
So it's kind of a sense, a signalisation package to the target machine, so uh, if the if the port
is open, it'll turn to and acknowledge a secret here.
Let me right here.
Uh, not bad.
Synchronization.
I ask to limit.
And I think I'm mistaken with grandmother here, but never mind, you understand.
So this kind of an acknowledgement package back to the target showing this successful establishment
of a coalition.
So this is called the three way Hanshin process.
The connection is terminated as soon as it is over.
So the technique is has its benefits, but it's easily traceable by firewalls and intrusion detection
systems.
I.
D. S. M. Synchronization scan is another type of TCP scan, but it never forms a complete connection
with the target.
It doesn't use the operating systems network functions.
Instead, it generates a IP packets and pointers for responses.
If the port is open, then the target will respond with an acknowledgement message.
So this scanner then sends a reset connection or steam message and ends the connection.
Hence, it is also called Have Open Scanning.
So this is considered as a stealth scanning technique as it can avoid or raising a flag in some misconfigured
firewalls and intrusion detection systems ideas.
So UDP scanning is a collection list scanning, hence no notification is sent back to the scanner.
Whether the packet has been received by the target or not.
So if the port is closed, then and I see an airport unreachable message is sent back to the scanners.
If no message is received, then the port is reported as open.
So this method can return faster results as farmers can block the data packets and therefore no response
message will be generated.
And it's kind of a report to port as open.
Uh, but in reality is not open just because the firewall.