>> Welcome to the Nmap lesson
>> on TCP and UDP port scanning.
>> In many ways, Nmap is best
known and most widely used for
its exceptional port scanning abilities
and this reputation is well-deserved.
Even though Nmap is much more than a port scanner,
its ability to effectively craft packets to probe
TCP and UDP ports and analyze their responses is
certainly the foundation of
the rest of Nmap's capabilities.
Let's take a look at how to create
Nmap statements that interrogate target ports.
>> Here are the learning objectives for this lesson.
First, we'll start with the basics and
talk about what port scanning is.
Next, we'll discuss the different port states
recognized by Nmap.
Then we'll answer the question, why scan ports?
Then we'll move on to the practical application of
this knowledge and that is how to scan
TCP and UDP ports in
Nmap followed by a lab
>> that demonstrates these concepts.
>> Let's get started. What is port scanning?
Nmap is the most popular and
widely used port scanning tool in the world.
This makes sense because it has
been around for a very long time,
is very refined, sophisticated,
it's free, and began as a port scanner.
Port scanning is the core and foundation
upon which everything else an Nmap is built.
To start off with, let's talk about what a port is.
Well, if you didn't know what a port is,
you probably wouldn't be interested in
this course to begin with.
But let's dig into the details a little bit.
Ports are used by layer 4 protocols,
namely TCP and UDP,
to help distinguish between communication channels.
IP, at layer 3,
uses IP addresses to do this.
We spoke about the TCP and UDP headers in
a previous lesson and I showed you
what the packets look like in Wireshark.
They're important for us because they are
simple ways for us to determine what services,
applications, and sometimes even operating
systems of the host we're interested in.
Port numbers go from 1-65,535.
There are three types of ports: one, well-known ports;
two, registered ports;
and three, dynamic and/or private ports.
The well-known ports are reserved ports that go
from 1-1,023 and are
registered with IANA for use with specific services.
A couple of common examples are TCP port 80 for
HTTP and UDP port 53 for DNS servers.
Registered ports go from
1,024-49,151 and have also been registered with IANA.
But most of them are not as
commonly used as the well-known ports.
The big difference is that unprivileged users
can bind to these ports to run various services,
which can't be done with well-known ports.
Several examples are TCP port
3389 for Microsoft Terminal Services or Remote Desktop,
and UDP port 1434 for Microsoft SQL Server.
Dynamic and/or private ports go
from 49,152-65,535 and are
used for proprietary services
and may otherwise be known as ephemeral.
What is port scanning?
The creator of Nmap defines it
as the act of remotely testing
numerous ports to determine what state
they're in. Sounds simple, right?
Well, the complicated part is
>> knowing what ports to scan,
>> how to scan them, and how to evaluate their responses.
This is where Nmap makes our lives easy.
Nmap does all the hard work so that we simply need to
learn how to critically analyze the results and output.
Of course, we have to create
effective Nmap statements to gather the information
we're looking for and
that is really what this course is all about.
If you're interested in going into
much more depth about how Nmap looks at port scanning,
see the reference provided in the last bullet point.
Nmap can probe TCP or UDP ports
on selected targets very quickly.
What is it trying to determine about these ports?
Well, to start with,
it's trying to establish the state that the port is in.
There are six port states recognized by Nmap.
The three most commonly observed are open,
closed, and filtered,
with the others being unfiltered,
open and filtered, or close filtered.
Finding an open port is
the primary objective of port scanning.
Every open port provides for an avenue of attack.
Essentially, it means that an application or service is
accepting a TCP connection or UDP packet on this port.
A closed port means that the board
receives in a response to Nmap probes,
but there's no application or service listening on it.
This still helps by showing that
a target is online and has an IP address,
so it's valuable for host discovery,
pink scanning, and a part of OS detection.
If you want to protect that host,
a more desirable port state is filtered,
which can be provided by a firewall device,
router rules, or a host-based firewall.
A filtered port is one in which Nmap
can't determine whether it is open
or not because of some sort of
packet filtering preventing probes from reaching it.
They provide little information to
the attacker and slow scans down considerably.
Unfiltered means that the port is accessible,
but Nmap is unable to
determine whether it is open or closed.
ACK scans classify ports into
this state and are good to map firewall rule sets.
After seeing an unfiltered port from an ACK scan,
you can try other scans
on that port to see if it responds.
If Nmap shows an open filtered state,
it means that it is unable to
determine whether a port is open or filtered.
This happens when a port is determined to be
open but provides no response.
UDP, IP protocol, FIN,
NULL, and Xmas scans classify ports this way.
Close filtered means that
Nmap can't tell whether a port is closed or
filtered and is only seen
>> while using an IP ID autoscan.
>> Port scanning provides a lot of valuable insight to
network admins and security professionals,
including penetration testers.
One key objective of
the information security professional is to reduce
the attack surface which means that we must
reduce the number of services
that provide an avenue of attack.
Running various port scans against targets gives
us critical information about what can be attacked.
In many cases, these responding applications
and services have been enabled by
default and the network administrator simply doesn't
know or hasn't done anything to protect them.
Once these applications are identified,
the attacker can use common exploitation tools
like Metasploit to break in.
Other key uses of port scanning include
the creation of an inventory of network assets,
both hardware and software for tracking network design,
policy compliance, availability, and network debugging.
We've already gone through
a lot of Nmap scans in this course,
but the purpose of this lesson is to focus on how
to scan specific TCP and UDP ports.
Almost every Nmap scan will scan
TCP or UDP ports even if none are specified.
One key exception to this is
the no port host discovery scan offered by
using the -sN command-line switch.
This slide gives you a quick list of
different port scanning command-line switches.
In the lab, we'll run
through how these command-line switches are
applied and where I
typically place them in a scan statement.
All of these command-line switches will be given to you
as a part of the cheat sheet provided in this course.