Let's talk about port scanning.
I'm Josh Mason, your instructor for this lesson.
We'll go through the purpose, the process, and the tools
for some port scanning.
Now, we did our host discovery and found a whole bunch of IP
addresses and Mac addresses.
Now we need to turn those into something a little more useful.
So we will identify some operating systems
and then identify some services running on those machines.
This will help us understand whether we're
looking at firewalls or servers or desktops.
And then we can later enumerate, find some vulnerabilities
perhaps, and exploit these machines
like an attacker would.
We identify the operating systems
based on what's revealed by their signatures
or by services.
We will send out requests to the machines,
and then they will send back a response.
The tools that we'll use like Nmap
will examine those responses and compare them to the signature
database and give us a best guess at what that operating
system is.
And we can expect to see something
like 80% solution, maybe 100%.
Some operating systems are very obvious.
Others are not.
And we'll take whatever we can get from the scan.
Also, sometimes services or programs
that are running on those machines
will tell us exactly what the operating system
is because the version of the software
includes the operating system itself.
So how do we do this?
How do we scan for services?
Well, we'll try to connect to the different ports,
and we'll check back for responses.
So the normal TCP three-way handshake,
if we connect we send a SYN, we get a SYN ACC.
We send an ACC.
We know that the port is open, and then we'll
send a RST ACC just to close that connection.
And that's standard, three-way handshake.
If we get that back, then we know that port is there.
And then we'll close the connection
and move on to the next port.
If the port is closed, we'll try to connect to it.
And the machine will send back our RST ACC.
And our scanner will know that connection is not there.
It's not possible.
There's a stealthy scan.
The creators of Nmap and some others
realized that their scans were being caught.
Firewalls and IDSs and IPSs were catching
on to all of these connections and dropped connections.
So the stealthy scan came about where
it sends a SYN, gets a SYN ACC in response,
and rather than finishing the connection,
it sends the RST just to drop it there.
So if it gets a SYN ACC back, it knows it's open,
and then it will drop the connection.
This is also less stealthy now because they caught on
very fast because that's how this business works.
If you change something and you tell people,
hey, it's changed so that they'll then use it,
well, the people creating the IDSs and the firewalls
and the IPSs will then take that new signature and apply it.
Fortunately, sometimes we can get away with things
because people haven't made the updates.
So then how can we do service enumeration?
Well, we'll do our three-way handshake, a SYN, SYN ACC, ACC.
And then with that ACC, we'll grab a banner.
So initial connection to a service, if it's there it'll
send us back some information.
So with the service enumeration, we'll
actually expect that back, listen for it, and gather it.
It's not quiet.
It is very loud.
But if we can do it on our pen test,
that's OK so long as you don't break anything that you're not
supposed to break.
We'll probably be OK.
There's connections to UDP as well.
They're slower.
And usually what you get back is either
it can be an open-filtered, which
means that didn't drop it.
But it's filtered, so you don't know the status.
UDP connections can be sped up by applying certain flags
in your Nmap scan.
Speaking of Nmap, let's dive in.
Nmap is a very powerful tool, and let's look
at the help page for Nmap just to see how powerful.
There are a lot of flags that you can throw in with Nmap,
a lot of switches.
Some things we want to look at, we already did this ping scan
before in hopes of discovery.
And we talked about doing a SYN scan.
There's also a full-connect scan and a few other ways
of scanning if you want to avoid detection.
If you want to pick specific ports, that's doable.
We can look at service detection,
-sV will do service detection.
There's some scripting available in Nmap with Nmap
scripting engine.
If we run the -sC it'll run the default scripts.
Our -O will do that operating system detection
that we talked about.
And if you don't mind being loud,
if you've got some firewall evasion,
IDS evation if you want, down here under miscellaneous
we've got -A. I think of it as aggressive.
It does OS detection, version detection,
does the script scanning and a traceroute.
It can be very useful.
Let's look at what we get as our outputs.
If we run just the normal Nmap of--
I put all of our IPs into this file here called IPs.
If we don't have to scan the whole subnet,
it'll go a little faster.
We'll just run Nmap -iL of our IPs.
Pressing V while it's scanning will increase verbosity,
so you can see what's happening.
And you can see we got a return back.
We have some services, different ports
on these different machines.
Now it's taking a guess at the service
is based off of known ports because all it did
was that simple SYN scan or that simple scan to connect and see
if the ports are open.
If we want to add onto that, we can
run a service detection and also the operating system detection.
And there's, of course, sudo which is also
going to do a stealth scan.
Pressing spacebar in the middle will give you
a heads up of what's happening.
If your scan is taking a long while, press the spacebar
and you can see an update, perhaps how much time is left.
We can see that operating system detection
takes a little more effort.
And now our results have a lot of information.
So our first machine, 111.1, we've got open SSH.
And it's the FreeBSD 20100308.
That's helpful because when we look at our operating system
scan results, it says, just guessing, OpenBSD 4.X.
And then the aggressive guess is, again, the same, 4.3.
And we can back that up with our service.
We see that it's running open SSH
for FreeBSD, which makes sense.
There's also a DNS mask and lighttpd.
What we'll do with those we'll get to you later.
On our .6 we've got open SSH, and it
says it's running the Debian version.
So when we look down at no exact OS matches,
it also gives us a fingerprint.
We could go and submit and say that this fingerprint goes
with Debian.
You can make a good guess based off
of the service that's running on that machine.
On this .48, even more useful--
while our operating system scan says there's no exact matches,
we see we're running Microsoft Windows RPC, Microsoft Windows
NetBIOS, Microsoft Windows XP Microsoft TS.
There's a good chance this machine is
running Windows XP on port 445.
I feel like a net API attack.
We'll get to that.
It's just a known, good exploit on Windows XP.
This next machine, again, we have no exact OS matches.
But it's running on port 80 Apache
HTTPD and the Debian version.
So we can make a good guess that this is a Debian Linux web
server.
On our .100, it said it scanned all the ports.
And there were too many fingerprint matches
to have specific OS details.
So one's a little interesting.
It's a little different.
Perhaps it's a firewall.
And then our .99, we again have open SSH and it says FreeBSD.
And similar results again--
OpenBSD and OpenBSD 4.3.
213-- another Debian web server, even though it says
no exact OS matches.
And that's the basics that you can get away with.
If we wanted to, we could add in some scripts.
And some of the default scripts will be discovery scripts.
Some are some vulnerability scripts.
Now what's a little different here
is after that operating system detection,
then we've got a little more work for it
to do because it'll run the scripts based off
of the services that it finds.
And this scan takes much longer.
You can see it's initiating the NSE, that Nmap scripting
engine.
Now we have our results.
Some of those scripts, not only do
we have the version of SSH, open SSH,
but now we've got the SSH host key.
We have some PHP session ID information, our HTTP server
headers, which adds even more.
I mean, that's how we found out what version it was here.
And as we continue looking down, we
can see what services are running
and make good guesses on what operating
systems we're looking at.
Then we'll look at the ports that are open,
the versions of the services that are on those machines,
and try to find some operating system information.
There are a handful of tools that we can also use for this.
Zenmap is the GUI version of Nmap.
And it will take all of this console information
and put it into that nice interface
that we saw in the last lesson.
There's also Nmap Automator, which based off of the subnet
that you give it, based off of what it finds,
it will run new scans.
And it will continue enumeration all throughout what
we'll get to later.
Masscan is a very fast port scanner.
It works by multithreading, and it's very powerful.
Rustscan runs off of Rust, which operates at a lower level, as
a lower-level language, and is then able to work a lot faster.
And Autorecon, similar to Nmap Automator,
based off of what it initially finds it'll run a quick scan.
It'll run a more deep scan.
And really, what it's doing is it
is continuing to scan either a single host or subnet
or based off of a list, same as Nmap,
and continue to scan and enumerate
until everything that could possibly
be known about it from scanning is complete.
And it'll get into some other tools
that we will get into in later lessons--
very powerful tools there.