Port Scan with Nmap allows you to discover which TCP or UDP ports are open on your target host.
Ports are the entry points to a machine that is connected to the Internet service that listens on a
port is able to receive data from a client application process it and send a response back. Malicious
client can sometimes exploit vulnerabilities in the server code. So they can gain access to sensitive
data or execute malicious code on the machine remotely.
That is why testing for all ports is necessary in order to achieve a thorough security verification
Port scanning is usually done in the initial phase of a penetration test in order to discover all network
entry points into the target system.Port scan takes the biggest part of our Nmap lectures. In "
the most basic port scan types" lectures, we
we see the followings: Nmap options of the port scanning, SYN scan, TCP scan, comparison between the SYN Scan and TCP Scan.
TCP Scan, UDP scan and some other types of port scan.
SYN scan is the default and most popular scan option for good reasons. It can be performed quickly,
scanning thousands of ports per second on a vast network not block by restrictive firewalls.
It's also relatively stealthy since it never completes TCAP connections.
It also allows clear reliable differentiation between open closed and filtered States.
This technique is often referred to as half open scanning because you don't open a full TCP connection
You send a SYN packet, as if you are going to open a real connection and then wait for a response.
A SYN/ACK indicates the port is listening (open), while a RST (reset) is indicative of a non-­listener.
If no response is received after several retransmissions, or an ICMP unreachable error is received,
the port is marked as filtered. If you receive a SYN/ACK from the target system,
you send RST instead of ACK packet and you do not complete the three-­way handshake.
Let’s perform a Nmap SYN scan in our virtual network. Go to Kali and open a terminal screen.
First, let’s look at the IP address of Kali to understand the IP block.
Here, my IP block is 172.16.99
This is because the netmask is 255.255.255.0
I don’t want to go further in network basics in this course.
You know what.
Okay fine.
I’m going to add an IP v4 document to the course resources.
Let’s create the SYN scan command: nmap is the command itself,
­sS is to SYN scan. Since it’s default scan type for privileged users and I’m already privileged user
user in Cali.
This parameter is not necessary for a SYN scan.
Now is the target IP block: 172.16.99.0/24.
As we talked before, this is the IP address block from 172.16.99.0
and 172.16.99.255
Let’s keep it fast, scan for the top 50 ports. I use
I use top ports parameter for this purpose and hit enter.
Now let's look at the scan results.
Here we have the computers who have the IP addresses 172.16.99.1 and 2.
These are the gateway and DNS server for my virtual network, vmnet. Ignore them for now.
In fact one is my host machine at the same time.
Here there is a system and the it’s open ports in top 50.
There's another machine.
And of course it's open ports.
Machine with IP 254 is the DHCP server of my vmnet. Ignore that as well.
And last machine found is the Kali itself.
OK.
OK, let’s open Wireshark and see what’s happening when a SYN scan is performed:
Run wireshark first. Double click eth0 to start to listen that interface. Skip the packets
which we are not interested in.
I add a filter.
I only want to see the traffic from my destination computer 172.16.99.139 and I want to see the TCP traffic only.
TCP traffic only. Clicked the blue arrow next to the filter bar to activate the filter. OK.
Now go to the terminal screen.
I’d like to analyse the SYN scan packets for an open port first.
172.16.99.139 is my destination system,
and I know that port 80 of that system is open. Hit enter and run the nmap query.
Yes, the port is open as I remember.
Go back to Wireshark.
I want to stop Wireshark by clicking red square at the upper left corner to avoid unwanted packets.
So here we have three packets.
The first packet is from an arbitrary port of Kali to the 80th port of the system 139
the destination system
It is a packet to start a three way handshake.
Second packet is a SYN/ACK sent by the destination system.
The third packet is a RST sent by Kali. Because it’s a SYN scan, the 3-­way handshake is not completed
and corrupted by a RST packet.
Now I restart the wireshark packet capturing to clean it screen by clicking the upper left blue button.
OK so this time I scan a close port for example port 81.
Now, the first packet is again a SYN packet to start the 3-­way handshake again.
The source system is Kali and the destination system is again 139.
The second packet is, for this scan, a RST packet. Because the port 81 is closed, the destination
the destination system sent us a RST packet.
Let’s see how Nmap interprets the results of SYN scan: When we send SYN packet,
the destination system replies a SYN/ACK packet to show that it’s ready for a connection.
And we send RST to corrupt the hand shake. Nmap interprets this result as the port is open.
If the destination system replies a RST packet for our SYN packet, that means: the port is accessible,
but it’s closed.
If the destination system doesn’t respond to our SYN packet, Nmap thinks that the packet is dropped,
or, filtered. It’s a common behaviour of the firewalls.
If the destination system replies an ICMP unreachable packet for our SYN packet, again it’s interpreted as “filtered”.
filtered.
This is another type of firewall behaviour.