-: Port scanning.
So we just talked about mapping your network,
let's take it a step further and not just do a ping
and see what's up and down,
but let's take it a little bit further and see
what's actually running on a box.
So that's where port scanning comes in for us.
So port scanning is a very common method to
gather information on networks
and devices on those networks.
Port scanners perform multiple functions
including host discovery,
finding what's online and offline,
port scanning and service identification,
what ports are open and what services are running
on those ports,
service version identification,
those services, what version are they?
So for instance, are you running Apache version two
or version three?
That kind of thing.
And operating system identification,
are you running Windows or Linux?
And not just are you running Windows
but are you running Windows XP
or are you running Windows 7 or 8 or 10?
You can find all that out through these port scanners,
especially ones like Nmap
and Zenmap which is the graphical version.
Port scanners are used for network inventory tasks
and security audits as well
because if you have a system administrator that says
hey I've closed down the web server.
There's nothing running on port 80
and you do a scan and find port 80's open,
you found out they lied to you right?
That's a good way to check and do a security audit on them
and inventory task is you can do a sweep of the
whole network and find out what systems are there.
So you may think you only have 50 computers on your network,
you do a scan and you find out you have 53.
Well now you've got to figure out where those other
three are.
So let's talk about service scanning
and all the pictures I'm going to show you here
are from Zenmap.
Nmap does the same thing in text-based format.
Zenmap puts it in a graphical format for you.
And so service identification here,
it's going to attempt to identify the service
and its version through doing banner grabbing
or comparing its responses on TCP
and UDP packet responses based on some known signatures.
So if you look here,
I scanned a subnet of 10.3.1.1/24.
I scanned 255 possible hosts or 254 possible hosts.
Of that, I was able to find there was four machines up.
As you see on the left column there,
with the .1, .2, .6, .7 and .250.
So excuse me, there's five machines up.
Now if I click on .1 there,
you'll see I had three ports that were running
and in those there were three services, http,
https, and myxql.
That's a service scan.
Now this took it a step further based on the responses
it got and it actually identified what versions
of software was running.
So in our case here, this is a Linux box
and it's running Apache web server 1.3.28
and I know exactly the version and what it's using.
So if there's a vulnerability or a bug that comes out
for Apache, I can scan and go oh, there's a bug in .28.
I need to go to the next version
and I'll know that based on this service scan.
So if I want to scan for the OS,
as I said in the last one,
this .1 machine is a Linux machine.
Well I can actually look and find out not only is it Linux
but it's a Linux machine between 2.4.18 and 2.4.35,
somewhere in there
and it says it's likely embedded which means
this may not actually be an actual machine,
like a web server, like I originally thought
but it may be something like a NES
or something like that that's hosting a web server on it.
OS fingerprints are going to use the TCP/IP stack responses
from both those TCP and UDP responses it gets
and identify if it's Windows, Linux, Unix, OSX,
and even the version and sometimes it will give you
a range of versions
but often it will give you the exact version as well.
So OS scanning is something you can do here
using these port scanners.
Now when you talk about port numbers,
there's two different ranges of port numbers.
There's from zero to 1023 which is know as
our well-known ports
and we have 1024 through 49151
which is our registered ports.
On the exam if you're taking the CSA plus,
you need to know these two terms,
well-known ports and registered ports
because there are some questions now and then
that will say somebody has a port open of 80
and you'll have to define that that is a well-known port
because that one is actually http or web browsing
or if you get one that says a,
you're looking through a log
and someone connected from port 41235,
was that a well-known port, an ephemeral port,
a registered port, or a,
or some other kind of port right?
And the answer would be a registered port
because there 41 thousand 235 or whatever number
I just said.
So that's the idea here.
So just keep those in mind as well
when you're talking about ports.
Well-known and registered ports.
Now when you scan, where you scan from matters right.
If you're scanning from inside the network,
you're going to see a lot more stuff
because there's not a firewall blocking you.
If you scan from outside the network,
that's the attacker's view
and you'll probably see a lot less
because there might be natting issues
like network address translation.
There might be firewalls or other things
based on ACLs that are blocking you from seeing everything.
Now which should you scan from?
I would tell you if you're doing it as
a vulnerability assessment, you'd want to do it
from the inside.
If you're doing it as a penetration test,
you want to do it from the outside
and just keep that in mind
because your viewpoint and your perspective
is going to change the amount of data you're going to see
and that's important when you're doing port scanning.