Lecture 4

Scanning
 Understanding networking scanning concepts

Understanding various scanning tools

various host discovery and

Module Understanding
port scanning techniques

Objectives Understanding OS discovery

various techniques to scan

Understanding
beyond IDS and Firewall

Drawing Network Diagram

Network Scanning Concepts
 Overview of Network Scanning
 Network Scanning refers to a set of procedures used for
identifying host , ports, and services in a network
 Network Scanning is one of the components of intelligence
gathering which can be used by an attacker to create a profile of
the target organization
Objectives of Network Scanning
 To discover live hosts, IP Addresses, and open ports of live hosts
 To discover operating systems and system architecture
 To discover services running on hosts
 To discover vulnerabilities in live hosts
 NMAP
Hping2 / Hping3
Metaspolit
Scanning NetScanTools Pro
Tools
SolarWinds Port Scanner
Unicorn Scan
PRTG Network Monitor
Scanning Tools for Mobile
 IP Scanner
 Fing
 Network Scanner
Example : nmap –sT –v <Target Address>
nmap –sS -v <Target Address>
Nmap –sX –v <Target Address>
ACK Flag Probe Scan
ACK Flag Probe Scan(Contd)
 It can also be used to check the behavior of a firewall
 Attackers send TCP probe packets with an ACK flag to a remote
device and then analyze the header information (TTL and Window
Field) of received RST packets to determine if the port is open or
closed
 If there is no response, then it implies that the port is filtered(a
stateful firewall is present)
 If there is a response, then it implies that the port is not filtered
ACK SCAN
Nmap –sU –v <Target Address>
Banner Grabbing
 It is the method used to determine the operating system running on a
remote system
 This technique can gain information from banners and configurable
text-based welcome screens from network hosts.
 Service ports that are used for the Banner Grabbing technique are
HyperText Transfer Protocol (HTTP), File Transfer Protocol (FTP),
and Service Mail Transfer Protocol (SMTP).
Active VS Passive Banner Grabbing
OS Banner Grabbing
Example
 Configure firewalls and IDS to detect and block probes.

Use custom rules to lock down the network and block unwanted
Counter ports.

measures Run port Scanning tools to determine whether the firewall accurately
detects the port Scan activities.
against Port
Scanning Security Experts should ensure the proper configuration of anti-
scanners and anti-spoofing rules.

Security experts of an organization must also ensure that the IDS,

routers, and firewall firmware are updated to their latest releases.