A Complete Users Guide To Port Scanning

Introduction:

Many people over look the importance of a port scanner. Although almost ever hacker and script kiddy has one in there tool box many don't understand the different types of port scanning. So I'm writing this tutorial on port scanning to give a complete listing of the different types of scans and a listing of exactly how the type of scanning is used. Its always important to remember you can also use port scanning to for banner grabbing so its good to have good knowledge of exactly what types of port scans does what.

Port Scanning: Port scanning is the process of connecting to TCP and UDP ports on a target system to determined what services are running or in a LISTENING state. Identifying listening ports is critical to determine the type of operating system and applications in use. Active services that are listening may allow an unauthorized user to gain access to systems that are misconfigured or running a version of software known to have security vulnerabilities.

Different Port Scanning Types:

TCP Connect Scan - This type of scan connects to the target port and completes a full three way handshake (SYN, SYN / ACK, and ACK). It's easily detected by the target system.

TCP SYN Scan - This technique is called half one scanning because a full TCP connection is not made. Instead a SYN packet is sent to the target port. If a (SYN / ACK) is received from the target port, we can deduce that it is in the LISTENING state. If an (RST / ACK) is received, it usually means that the port is not in the LISTENING state. An (RST / ACK) will be sent by the systems performing port scans so that a full connection is never established. This technique has the advantage of being stealthier than a Full TCP Connect is, and may not be logged by the target systems.

TCP FIN Scan - This technique send a FIN packet to the target port. The target system should send back an RST for all closed ports. This technique usually only works on a UNIX based (TCP / IP) stack.

TCP Xmas Tree Scan - This technique send a FIN, URG, and PUSH packet to the target port. Based on RFC 793, the target system should send back an RST for all closed ports.

TCP Null Scan - This technique turns off all flags. Based on RFC 793, the target system should send back an RST for all closed Ports.

TCP ACK Scan - This technique is used to map out firewall rulesets. It can help determine if the firewall is a simple packet filter allowing only established connections (Connections with an ACK bit site) or a stateful firewall that is performing advance packet filtering.

TCP Window Scan - This technique may detect open as well as filtered nonfiltered ports on some systems (AIX and FreeBSD) due to an anomaly in the way the TCP window size is reported.

TCP RPC Scan - This technique is specific for UNIX systems and is used to detect and identify Report Procedure (RPC) ports and their associated program and version numbers.

UDP Scan - This technique sends a UDP packet to the target port. If the target port responds with an "ICMP port unreachable" message, the port is closed. Conversely, if we don't receive an "ICMP port unreachable" message, we can deduce the port is open. Since UDP is known as a connectionless protocol, the accuracy of this technique is highly depend on many factors related to the utilization's of network and system resources. In addition UDP scanning is a very slow process if you are trying to scan a device that employs heavy packet filtering. If you plan on doing UDP scans over the Internet be ready for unreliable results.

Active Stack Fingerprinting: Stack fingerprinting is an extremely powerful technology that allows you to quickly ascertains each host operation system with a high degree of probability. Essentially, there are many nuances that very between one venders Internet protocol (IP) stack implementation and another's. Vendors often interpret specific RFC guidance differently when writing there TCP / IP stack. Thus by probing for these differences, we can begin to make an educated guess about the operating system in use. For maximum reliability, stack fingerprinting generally requires at least one listen port.

Passive Stack Fingerprinting: Passive stack fingerprinting is similar in concept to active stack fingerprinting. Instead of sending packets to the target system, however, an attacker passively monitors the network traffic to determine the operating system in use. Thus, by monitoring network traffic between various systems, we can determine the operating systems on a network

Passive Signatures: Various signatures can be used to identify an operating system. Below are several associated with a TCP / IP session.

TTL - What does the operating system set as time to live on outbound packets?

Window Size - What does the operating system set as the Window Size?

DF - Does the operating system set the Don't Fragment Bit?

Probes Used To Figure Out Target Operating Systems:

FIN Probe - A Find packet is sent to an open port. As mentioned RFC 793 states that the correct behavior is not to respond. However many stack implements (Such As Windows NT) will respond with as FIN/ACK.

Bogus Flag Probe - An undefined TCP flag is set in the TCP Header of a SYN packet. Some operating systems such as (Linux) will respond with the flag set in there respond packet.

Initial Sequence Number (ISN) Sampling - The basics premise is to find a pattern in the initial sequence chose by the TCP implementation when responding to a connection request.

Don't Fragment Bit Monitoring - Some operation systems will set the "Don't Fragment Bit" to enhance performance. This bit can be monitored to determine what types of operation systems exhibit this behavior.

TCP Initial Window Size - Initial window size on returned packets is tracked. For some stack implementations, this size is unique and can be greatly added tot he accuracy of the fingering mechanism.

ACK Value - Internet Protocols (IP) stacks differ in the sequence value used for the ACK field, so some implementations will send back the sequences number you sent, and others will send back a sequence number +1.

ICMP Error Message Quenching - Operating system may follow RFC 1812 and limit rate at which error messages are sent. By sending UDP packets to some random high numbered ports, you can count the number of unreachable messages received within a given amount of time.

ICMP Message Quoting - Operating systems differ in the amount of information that is quoted when ICMP errors are encountered. By examining the quoted message, you might be able to make some assumptions on the target operating system.

Type Of Service (TOS) - For "ICMP port unreachable" messages, the TOS is examined. Most stack implementations use 0,but this can vary.

Fragmentation Handling - Different stacks handle overlapping fragments differently. Some stacks will overwrite the old data with new data and vice versa.

TCP Options - By sending a packet with multiple options set, such as no operation, maximum segment size, window scale factor and timestamps, it is possible to make some assumptions about the target system.

Conclusion:

I hope you found this tutorial on port scanning hopeful. It's always important to have a good understanding of techniques used to gain vital information on target hosts or operating systems. If you the attacker don't have a good understanding of the tools your using, then you shouldn't be using them. Remember some Intrusion Detection Systems (IDS) might pick up port scanning attempts so its important to always block your host Internet Protocol (IP). This will help you stay anonymous on the Internet. If you have any questions or would like to contact me you can do so by contacting one of the following listed below.

MIRC: irc.dal.net #Antilamer, #cctc, #h4ckerz, #crystalz, #hackalot, #Hackfest, #Hack-i, #Hacku

E.Mail: gbrooks@mcintoshstudent.com

AOL IM: Myst1kal One

Other Documents I Have Written

In depth Guide Too Hacking Windows Using NetBIOS - February 7, 2003

A complete users guide to port scanning - February 06, 2003

A Quick Unix Command Guide - January 30, 2003

A Definitive Trojan Port Listing - January 30, 2003

Basics On How To Identify A Firewall - January 23, 2003

The Common Gateway Interface (CGI) - November 28, 2002

Microsoft IIS Unicode Exploit Explained - November 13, 2002