Now let's move away from the basics of sending and receiving
traffic generally and show how these same commands can be used to
perform a port scan on a targeted host.
But first, let's ask the same question that we have in the previous sections.
Why do you think an engineer would need this knowledge?
As was noted in the first section, the ability to create,
modify,
and then send and receive traffic is especially important when your focus
is on the network and on network security specifically.
With this module,
we will take the knowledge that we have built up to this point
and use it to show how to perform a port scan.
This knowledge of the port a device has opened can tell
us a good bit about a device's status.
If we just look at the open port numbers,
we can assume the types of services that a device is running and then use
this information to further interrogate the device.
This process has the ability to help determine the specific applications in use,
as well as help us determine the running operating system.
From a network security perspective,
devices should only be showing ports open for the services that
are absolutely required as information can be used by malicious
intruders to gain access to them.
Now let's talk about port scans and the various types that exist.
There are a few common types of port scan that are traditionally used.
These include a TCP scan, also referred to as a half open scan,
a FIN scan, a NULL scan, an XMAS scan, and a UDP scan.
Each of these is designed to find the available ports on a
device using both normal and abnormal means.
What we mean by this is that some methods use the same technique
that would be used to normally open a port,
while others try to find ports that the device isn't trying to show as open.
Now let's take a quick look through each of these before
moving back into the demonstration environment.
Let's start with a TCP scan.
A typical TCP port scan uses TCP SYN packets in a traditional way
by attempting to start a three‑way handshake.
If a device has a service that is available on the probed port,
it will send back a response packet as the second part of the
three‑way handshake with the SYN and ACK flag set.
If it is up, but no service is available on the port,
it could respond in a couple of ways.
It could respond back with a reset or a reset and an ACK
message indicating that a service isn't available on that
port or it could not respond at all.
If you know a device is up, but doesn't respond to a specific scanned port,
then it is filtering that port.
A SYN port scan is usually considered the most upfront version of a port
scan as it replicates a normal message that would be sent to a device if
it was thought a service was running on it.
Next, we have a FIN scan, that is the first of three different stealth scans.
The TCP FIN, or finish,
message is normally used when a connection is already
established and it needs to be closed.
A port scan with a FIN without an established connection can
sometimes be used to get a host to respond on a port that it
wasn't intending to utilize.
The response received back, if any, will likely be either a reset or a reset ACK,
or an ICMP message indicating a destination is unreachable.
Of course, either of these responses confirms that a device is operational.
The second stealth scan still uses TCP,
but without any flags and is referred to as a NULL scan.
This type of TCP packet isn't used in normal traffic and is
designed to find devices that are responding,
even when they are not supposed to.
If there is a response, it will likely be either a reset,
a RST ACK, or an ICMP message indicating a destination is unreachable.
And the third stealth scan again, still uses TCP,
but sets the PSH, FIN, and URG flags.
This type of scan is referred to as an XMAS scan because of the
multiple lights it would light up on a tree.
The purpose of this combination is to elicit a response from a device,
even when it isn't supposed to respond.
And again, if there is a response,
it will likely be either a RST or a RST ACK
indicating a destination is unreachable.
And the final scan type we are going to review is a UDP scan.
Unlike TCP,
UDP is a connection‑less protocol and because of this
doesn't use handshakes or acknowledgments.
Any responses back from the initial packet will indicate that a port is
open while a return ICMP unreachable message will indicate that the port
is either closed or filtered by the device.
And so now with these reviewed,
let's move back into the demonstration environment and show how we can
use Scapy to perform these different types of scan.