3.2 Network port scanning
Module 3 – Network scanning. Section 3.2: Port scanner
A port scanner is an application designed to probe a
server or host for open ports.
• This is used by admins to verify security policies of a network and by attackers to identify network services running on a host and exploit vulnerabilities.
• Portsweep is to scan multiple hosts for a specific listening port.
Well-known port numbers
• 21: FTP 22: SSH 23: Telnet
• 25: SMTP 110: POP3
• 143: IMAP 53: DNS service
• 123: NTP 161: SMP
• 80: HTTP 443: HTTP Secure (HTTPS)
Scan results
In TCP/IP network services are referenced using two
components: a host address and a port number.
Ex. 192.168.1.1:22 (host:port)
The result of a scan on a port is usually generalized into one of
three categories:
– Open or Accepted
– Closed or Denied or Not Listening
– Filtered, Dropped or Blocked
Ports threats
• Open ports present two vulnerabilities:
– Security and stability concerns associated with the program responsible for delivering the service - Open ports.
– Security and stability concerns associated with the operating system that is running on the host - Open or Closed ports.
• Filtered ports do not tend to present vulnerabilities.
Scanning types
– TCP scanning
– SYN scanning
– UDP scanning
– ACK scanning
– Window scanning
– FIN scanning
– Other scan types
TCP scanning
• TCP scan completes the TCP three-way handshake, and the port scanner closes the connection to avoid performing a Denial-of-service attack. Otherwise an error code is returned.
• The services can log the sender IP address and Intrusion detection systems (IDS) can raise an alarm.
• Nmap calls this mode connect scan, named after the Unix connect() system call.
Scanning
SYN scan is TCP scanning also known as "half-open scanning".
• The port scanner generates a SYN packet. If the target port is open, it will respond with a SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed.
• If the port is closed but unfiltered, the target will instantly respond with an RST packet.
UDP Scanning
• UDP port scanners send a UDP packet to a port and if that port is not open, the system will respond with an ICMP port unreachable message.
• The absence of a response is considered that port is open.
• If a port is blocked by a firewall, this method will falsely report that the port is open.
• Example, sending a DNS query to port 53 will result in a response, if a DNS server is present.
ACK Scanning
ACK scanning does not exactly determine whether the port is open or closed, but whether the port is filtered or unfiltered.
• This is especially good when attempting to probe for the existence of a firewall and its rulesets.
Window scanning
Window scanning is rarely used and is untrustworthy
in determining whether a port is opened or closed.
– It generates the same packet as an ACK scan, but checks whether the window field of the packet has been modified.
FIN scanning
Firewalls block generally SYN packets.
FIN packets can bypass firewalls without modification. Closed ports reply to a FIN packet with the appropriate RST packet, whereas open ports ignore the packet on hand.
This is typical TCP behavior and is in some ways a loophole.
Other scan types
• X-mas and Null Scan
• Protocol scan
• Proxy scan
• Idle scan
• CatSCAN
• ICMP scan
Port filtering by ISPs
• Many ISPs restrict their customers' ability to perform port scans to destinations outside of their home networks.
• Some ISPs implement packet filters or transparent proxies that prevent outgoing service requests to certain ports.