MODULE 5:- Scanning Network and Vulnerability

1. Introduction of port Scanning – Penetration testing
2. TCP IP header flags list
3. Examples of Network Scanning for Live Host by Kali Linux
4. important nmap commands in Kali Linux with Example
5. Techniques of Nmap port scanner – Scanning
6. Nmap Timing Templates – You should know
7. Nmap options for Firewall IDS evasion in Kali Linux
8. commands to save Nmap output to file
9. Nmap Scripts in Kali Linux
10. 10 best open port checker Or Scanner
11. 10 hping3 examples for scanning network in Kali Linux
12. How to Install Nessus on Kali Linux 2.0 step by step
13. Nessus scan policies and report Tutorial for beginner
14. Nessus Vulnerability Scanner Tutorial For beginner

Nmap Timing Templates:

Nmap timing has built with this ability to scan the target set faster or slower scanning speed than the normal or default speed. There are number of different settings can be selected based of timing templates.

#nmap –sU –T# -p1-100 {Target_IP_Address}

Or

#nmap –sU –timing paranoid –p1-100 {Target_IP_Address}

-T0 Paranoid

 This Type of scan is used for slow network scan than the normal speed in this situations, detection risks must be minimized. This is serial scan that will pause of 5 minutes; however, the max_delay setting of second is ignored, and scan_delay is set a higher value than the normal value.

Image description

–T1 sneaky

The –T1 or –timing sneaky scan is a little bit faster than the paranoid (-T0) scan, it happened by the reducing the scan time needed. This scan uses serial process to find the open port of target

-T2 Polite

The T2 or -timing polite scan is a build in velocity again over the T0 what’s more T1 scan and is the last scanning template to utilize the serial scanning method. The scan_delay for this scan is situated to 400 milliseconds, making this the first template to make utilization of the max_scan delay, a value that is still set to the default estimation of 1 second. With this format chose Nmap will start checking targets utilizing the scan_delay of 400 milliseconds yet has the capability to dynamically alter the postponement up to a most extreme of 1 second. By analyzing the time needed to finish the respectful sweep of the same 100 ports, general examining time has been decreased to only 544 seconds or only 9 minutes.

T3 Normal

The T3 or -timing normal scan is the default check for Nmap, implying that on the off chance that no timing layout or manual timing choices are set, the settings in this template will be utilized for the scan. This template is the first to utilize the parallel handling method, sending different probes out all the while, expanding the general speed. This output has a scan_delay of 0 seconds that can develop to a max_scan_delay that can develop to 1 second, significance the output will happen as fast as would be prudent yet following 1 second the current port scan will be complete and the following port will be filtered. The normal scan will finish the scan of chose ports on the target machine in 547 seconds, really slower than the amiable output for this situation, however this is not ordinarily the case.

T4 Aggressive

The T4 or -timing aggressive layout additionally runs its filtering in parallel expanding speed. The scan_delay for this template is situated to 0 seconds and can develop to a max_scan_delay of 10 milliseconds. Scan with a max_scan_delay of short of what 1 second are inclined to slips as some target Operating System have settings that oblige a base postpone between test reactions of 1 second. This scan finished the port scan of the metasploit virtual machine in only 477 seconds or simply under 8 minutes.

-T5 Insane

The T5 or -timing insane timing format is the quickest of the inherent timing template. This template utilizes the parallel scanning strategy with a scan_delay of 0 seconds and a max_scan_delay of 5 milliseconds. As expressed with the aggressive scan, this scan can result in mistakes focused around target machine Operating System and settings. This scan, the quickest, finished in simply under 22 seconds; be that as it may, the results are a considerable amount not quite the same as the majority of the scan to this point

Thanks for reading this articles, would you like to share what is missing in this article? please share in comment box. and also share your feedback. You can connect on social media

Cheers!

MODULE 5:- Scanning Network and Vulnerability

1. Introduction of port Scanning – Penetration testing
2. TCP IP header flags list
3. Examples of Network Scanning for Live Host by Kali Linux
4. important nmap commands in Kali Linux with Example
5. Techniques of Nmap port scanner – Scanning
6. Nmap Timing Templates – You should know
7. Nmap options for Firewall IDS evasion in Kali Linux
8. commands to save Nmap output to file
9. Nmap Scripts in Kali Linux
10. 10 best open port checker Or Scanner
11. 10 hping3 examples for scanning network in Kali Linux
12. How to Install Nessus on Kali Linux 2.0 step by step
13. Nessus scan policies and report Tutorial for beginner
14. Nessus Vulnerability Scanner Tutorial For beginner

How to use Nmap port scanner – Scanning

In the nmap port scanner “-s” (lowercase s) prefix is used to specify the type of scan should be launched on the target defined in the scan command. The selection of scan type can help the penetration tester to evade by some host and network security system for example IDS/IPS, Firewalls etc.

Half Open/Stealth Scan (-sS)

The stealth scan is the default type of scanning used by Nmap port scanner when no scan option is defined. In this type of scanning, pentester’s machine sends SYN packet to the target machine. The target machine will reply back with an SYN/ACK packet. The attacker will send RST packet instead of ACK (acknowledgment). If a port is closed then target machine send RST packed instead of SYN/ACK packet.

-sT TCP Connect Scan/Full Open Scan

TCP connect scan can mostly be used to gather more information about the target. In this case, the attacker sends an SYN packed to target. Target machine hopefully gives the reply with SYN/ACK packet. The attacker completed the communication by sending a final ACK packet.

-sA Acknowledgement Scan by nmap port scanner

Acknowledgment scan is used to determine TCP port is filtered or unfiltered. In this scan, Attacker communicates with the target machine with ACK (acknowledgment) flag. If the RST (reset) response from target means the port is unfiltered, and if no response or response with unreachable error indicates the port is filtered.

-sX Xmas Scan

In this type of scanning, attacker sends packet with FIN, PUSH, URG flag. If no response from target side indicates the port is open, and if the target response with RST (reset) packet indicates the port is closed.

-sP FIN Scan by nmap port scanner 

In this type of scanning, attacker sends a packet only with FIN flag. If no response from targets side means the port is open, and if target response with RST/ACK packet indicate the port is closed.

-sN Null Scan

In Null Scan sends the packet without flags to the target host. I response from target side indicates the port is open if target response with RST/ACK indicates the port is closed.

-sU UDP Scan by nmap port scanner

The UDP scan evaluates the UDP ports on the target system. Dissimilar to filtering TCP ports, UDP scans hope to get a response back from target that has the tested ports shut. packets sent to open UDP ports are not reacted; then again, if the packet sent inspires a response from the target, then the port being tested is open. In the event that no response is accepted, then the port could be open alternately could be separated by a gadget like a firewall. Shut UDP ports might be recognized by an ICMP response with a sort 3 and code 3 response Finally, ports that are affirmed to be filtered will have an ICMP response of sort 3 with codes of 1, 2, 9, 10, or 13, demonstrating different inaccessible errors.

Thanks for giving your valuable time to reading this article, if you have any question related this article or nmap scanning series let me know in comment box

Thanks & Cheers!

MODULE 5:- Scanning Network and Vulnerability

1. Introduction of port Scanning – Penetration testing
2. TCP IP header flags list
3. Examples of Network Scanning for Live Host by Kali Linux
4. important nmap commands in Kali Linux with Example
5. Techniques of Nmap port scanner – Scanning
6. Nmap Timing Templates – You should know
7. Nmap options for Firewall IDS evasion in Kali Linux
8. commands to save Nmap output to file
9. Nmap Scripts in Kali Linux
10. 10 best open port checker Or Scanner
11. 10 hping3 examples for scanning network in Kali Linux
12. How to Install Nessus on Kali Linux 2.0 step by step
13. Nessus scan policies and report Tutorial for beginner
14. Nessus Vulnerability Scanner Tutorial For beginner

After completing first phase (reconnaissance) of Penetration testing by Penetration tester, they will enter into second phase scanning. The main aim of scanning phase is to gathering specific information about the computers and devices are connected with the targeted Network of the organization. Throughout this phase, Pentester get the information about live hosts, Operating System, Services for example: web service, SMTP, FTP, SSH etc, and the vulnerabilities. Scanning is done by using different tools. For example: Nessus, Nmap, Hping3 etc.
Before starting network Scanning understand about network first

Ports and Firewalls:

One of the most important method to secure the network by implementing a firewall between the private and public network. A firewall is a software or Hardware device which is filter inbound or outbound traffic by using access control Lists, which traffic does not meet the criteria of the Access Controls are dropped by firewall. All this process happened by opening or closing particular ports to allow or deny network traffic.

Ports are the different way, used for computer to computer communication. Total number of TCP ports are 65,535 and another 65535 for UDP ports that can be used for communication. A little number of ports are designated for a specific purpose for example Port 80 is used by HTTP (Hyper Text Transfer Protocol).

IP Protocols:

Protocols is a set of rules for communication on computer network. These protocols ensure the communication between computer and network devices according predefined rules.

TCP (Transmission Control Protocol)

TCP is one of the main protocol used for network communication. TCP is connection oriented protocol, implying that the machines on each one side of the communication channel recognize that the session is open and the messages are, no doubt gained on each one side of the association. Previously, numerous individuals have related this to a telephone call.

Three Way Handshake:

First Way: Computer A sends packet to the Computer B with SYN (Synchronize) flag.

Second Way: The Computer B give the reply with SYN/ACK packets to the Computer A.

Third Way: In the Final stage of create communication is, the Computer A again send another packet with ACK Flag.

After completing three way handshake the communication will be started. And connection is established.

UDP (User Datagram Protocol):

The UDP is a protocol that has less overhead than the TCP connections. On the off chance that the TCP communication procedure is undifferentiated from a telephone call where both gatherings guarantee the communication is, no doubt gained as sent at both sides of the interchanges channel, UDP is more like a radio broadcast where the communication is conveyed and none, of these the sender or beneficiary confirm, by default, that a correspondence parcel has been gained.  Applications that utilization UDP communications quality lower overhead and higher speed over the expanded dependability, for example, streaming video and music.

ICMP (Internet Control Massage Protocol)

ICMP is a health and maintenance protocol for the network. This protocol is used to find devices in a network are communicating properly or not. ICMP transport messages from network devices, computers and server applications. It contained their headers, a set of specific code or number. These sets are broadcast messages provide information about host or nodes in the network. These code helps for penetration tester to determine what the computer are on the target.