So now that we have reviewed many of the potential port scanning techniques,
let's move back into the demonstration environment
and show them in use with Scapy.
The first thing we need to do is get into Scapy,
clear the screen so we can see what we're doing.
We're going to create a packet, in this case,
we're going to use a Layer 3 packet.
We're going to set a destination of the ports we've been using up to this point,
which is 102.
You'll set the sport to random port number,
destination port, in this case, it's going to be a range from 1 through 1024.
And to make it a syn scan, we're going to set the syn flag equals there we go.
And in this case, we're going to use the sr command,
we're going to use 2 variables here,
we're going to put a timeout on it of 10 seconds,
let's put a retry on it of 2 so we're not sitting here forever,
and we're going to put a filter on it of the port range
that we're expecting traffic back on, so the same port range from 10,
1‑1024.
And once we hit Enter here, we'll speed up and see what our results look like.
There we go.
So obviously from the little stars,
we know that there are a number of different ports that responded.
So out of those ports from 1‑1024, we received 516 responses.
If you look at that, all of those responses came from there and all of them are,
most of them are RAs so they give a RST ACK back.
In this case,
I know that device is not running a firewall so it's going to respond to
everything that it potentially would have a service on,
a whole bunch of stuff.
And one thing we will notice here, if you look closely into the the void,
a whole bunch of stuff here,
there are these two here that responded with SYN ACKs,
instead of RST ACK, so that means it's actually listening on those two ports.
And an easier way to look through this list,
instead of individually looking through this list,
is use some of the additional display commands that
we showed in the last module.
So we take the answer that we had and we took the
summary output that we had before, but we put a filter on it with the lambda.
So we're going to be only looking at the responses that's the S and
the R of what was sent out and the response back.
Use the sprintf command, and inside that,
we can say we want to see sport and the flags that were set.
Now that cleans up our output a little bit.
We can see all the Rs, the RAs, and then if we keep going up here,
we'll see some SAs, so much.
So much.
Let's see here.
We still have to look through it a bit, don't we?
There is two SAs.
And see, that was hard to find.
How can we further filter that?
For that, we would add to this command a little bit.
And instead of just being a display of those source ports and flags,
we're going to filter that with the lfilter command.
Using another function, true,
if that long spiel here directly put in my parentheses and my quotes.
And when we use that command,
clear this and run again, we can see that of all those ports
that only two of them returned with SYN ACKs.
So if you combined all of these different commands that we've reviewed,
we can get an output that is much more useful,
but keep in mind, this is only filtering the output,
this is not filtering anything else.
So now we're going to review and take a look at how to do a UDP scan.
In this case, our packet will be framed a little bit differently.
Instead of using TCP, we'll be using UDP.
We're still using a random source port,
and we're still using the same destination port range.
The sr packet that we've made and the sr command that we use here,
this is the one that we used previously with a
timeout of 10 seconds and retry of 1,
but the 1 thing that we need to change is this filter because since we
don't expect any specific return traffic back with UDP,
usually we're looking for ICMP traffic back.
So we change the filter to use ICMP and send it.
We can see from this output that we received 18 different answers.
We show each one of these and it looks like all the
ports from 1 through 18 responded, but all the other ones didn't.
Now let's move on and show an example of a FIN scan.
And as you would imagine, the FIN scan looks very similar to a SYN scan,
except we're setting the FIN by itself in the flag section of the TCP header.
Still using the same filter from the TCP scan, we send it.
Okay, we received a whole bunch of different responses.
Next, we can look at a NULL scan, and in this case,
we're setting all of the flags to nothing,
which also is abnormal, that's not something that would normally happen.
In this case, we're also using the same sr command and setting it.
Okay.
And again, we received a whole bunch of RST ACKs back,
and last, but not least, is going to be a XMAS attack.
And in this case, a XMAS attack sets a number of different flags on,
again, that normally wouldn't be on by themselves in any normal capacity.
In this case, we're setting the URG flag,
the PSH flag, and the FIN flag at the same time,
and the SR command, again, is the same, and we go again,
and again, if we do a show on all these,
whole bunch of RST ACKs on 500 or so of all the ports.
And with that,
that's all of the different scan types that we covered in the previous module,
and from here,
we're going to move back into the slide deck and cover the
functionality of traceroute using Scapy.