Nmap - TCP Connect & Stealth (SYN) Scanning

Key Takeaways

hey guys hackersploit here back again with another video welcome back to the penetration testing boot camp in this video we're going to be talking about the um we're going to be talking about nmap scans uh more specifically we're going to be talking about the connect scans or the tcp connect scans and then the half open syn scans or stealth scanning as it's called right so let's start off with your tcp connect or the full open scan right so this scan the reason it it's actually called a tcp connect scan is because it actually establishes a three-way connection and the reason it does this is to give us a more accurate result when talking about service and operating system enumeration and generally speaking the accuracy of the of the information you're getting in regards to what ports are open what ports are closed so on and so forth now of course that comes with an additional or an added disadvantage and that is that these scans are typically very slow because you're going through it's connecting to every port individually so it's actually performing or establishing a tcp connection with every port and when i say that i mean the entire connection so syn synack and then of course ack and then it resets it using the rst tcp flag right and uh when talking about the full open scan of course these scans based on um based on the type of connection they're trying to establish with a particular port these are very easily these are very easy to detect and prevent through firewalls right so that's why you typically don't see this scan being used but in the event you there's really nothing preventing you from performing these scans it's a very accurate way of getting results and the way you run it is by typing nmap st right so that is your tcp connect scan and then we type in the ip address so 192.168.1.38 now in this case i don't want to waste too much time with the scanning process so i'll limit the ports to i'll say port 22 or 0.21 and i'll limit the port to maybe something like let's see 8080 right and it's only going to scan for services or the ports between that range so i can just hit enter and we're going to let that scan run and of course this is going to take time because as i said it's connecting to every port and it's establishing the three-way handshake on every port so i'm gonna let this scan complete all right so the scan is complete and it went through the port range and it's given us the various ports and the services remember we've not included service enumeration which we can if you want to get more information regarding the services and of course operating system enumeration so in this case you can see it it actually gives us the ports and the the services running so there's nothing special there it's just a more reliable scan because again as i said it completes the connection to it actually completes the tcp connection right uh the disadvantages of course as i've mentioned is very slow and number two is very easy to detect and prevent uh you know through firewall so on and so forth uh now let's talk about the interesting scan which is uh the one that many of you are probably familiar with but really don't understand how it works and why it's so cool and that is the stealth scan or the half open scan all right so the stealth scan is quite similar to the uh to the tcp open scan or the tcp connect scan sorry in that you're actually going to establish a tcp connection but you're going to just uh cut it short before it the the whole process is completed so what will happen is you will send you being the the host will send the target a syn packet and of course the the target is then going to respond with the synack and then you will reset the connection now what what does this do well this first of all reduces the scan time because all you're waiting for ideally is a response from the target and that response helps you deduce whether the port is open whether the port whether that that port has a service running etc etc right now if the port is open uh you will send a syn packet and the target will respond to the synap that's quite simple if it's closed you'll send a syn packet and if if the port is closed the the target will respond with an rst uh with the packet with an rsd header or the rst flag sorry in the header so what's happening is you as i said you just had a sin if it's open it said that the target's in the syn ack back and then of course you respond with an rsd and you close it uh if if in in the event the the port is closed it it responds with the rst after your sin or your initial synchronization packet is sent so it's a fairly simple now uh again as i said one advantage of this is uh is of course it's much much quicker and secondly it's able you're able to avoid firewalls or to evade firewalls rather and and it really doesn't raise that much attention because you're not establishing a connection with all the ports now to run it and as i said most of you will already be familiar with it if you've been scanning various boxes on hack the box on one lob is nmap ss right so lowercase s and uppercase s and then you type in your your particular device here and you will see that it's going to be much much faster than the uh the the connect scan the tcp connect scan and this is the the preferred way of running nmap scans so there we are you can see that was extremely quick i didn't even have to pause the video and of course you can then combine it with us with stuff like service uh service version enumeration and of course that will take a bit a bit more time but it it will give you uh much faster results based on on the amount of services and the port range that you have specified so again i'll just wait for this it shouldn't take too much time at all uh but i again given that it's going through this these uh it's going through all the services and through the 1000 ports what i can do is i can just shorten the the scan period and we will take a look at timing options with nmap for now let's just stick to to actually the let's stick to understanding the scan types so um i'm just going to enter and we're going to run that and we'll specify the port range so that should run marginally faster so i'll wait for this to complete all right so the scan is complete and as you can see we get uh the same result just that we've filtered or we've reduced the amount of ports that nmap is going to scan with and we got the service versions right over here displayed so again microsoft ftpd open sh 7.1 so on and so forth now the cool thing about running nmap scans and if you're a student and you're trying to learn about nmap and the various tcp uh flags that are being sent and the the tcp through handshake is the cool thing is you can actually use a tool like wireshark to analyze these packets and you can actually see all of these packets being sent so what i'm going to do is i have wireshark open right over here right and i'm just going to double click on my on my capture device here and i'm going to stop that right and the reason being is i'm going to start the scan uh i'm going to start a very very light uh lightweight scan here i'm just going to run a stealth scan well let's let's actually run a connect scan and i'm just going to run this on port 21 right because i know port 21 is actually running on this particular windows server and i want to actually capture the packets and you'll actually be able to see this since this is a connect scan you'll be able to see the syn synack ack and then of course rst or the reset a flag being sent or the reset packet sorry so what i'm going to do is i'm just going to start the capture now continue without saving and i'm going to run the scan and there we are so you can see it did it very very quickly and i'm just going to stop that now and there shouldn't be too much data here so you can see it right over here we have the initial syn which is being sent from my ip or the kali ip address 192.168.1.51 the destination is the windows server so that is your syn packet you can analyze the the contents of this so again this sorted based on the the various layers so you have your frame uh your ethernet frame so again if you if you have learned about the uh the osi model uh this will be quite simple for you then have you so you have your data link network um transport layer so on and so forth and if we click on tcp here uh you can take a look at the source and destination ports and the various flags but the the flag here is a syn flag there you are so you can see that right over here and if we take a look at the options um i don't know whether i want to cover that right now because i'm not covering wireshark until a later section so uh you can look at the flags for now so that's your syn flag right and then you have your um let's see we have your synack that's going to be sent back from the server so that's 192.168.1.30 that's being sent back from windows server back to my device and again i can click on the flag you can see it's synack and so on and so forth so you guys you can actually try this out yourself if you're trying to understand how this works so we then have the ack being sent from calais to the window server and then the final packet which is the rst as i mentioned and that's being sent to terminate the connection so what i'm going to do now is i'm going to run the stealth scan and we'll actually see the difference now right and we're going to run it for the same port and i'm just going to start a new capture here continue without saving and i'm going to run that scan and i'll run it very quickly and i'll stop the captcha and there we are all right so let let's explore the the results now so um we have only a few we have arp a few arp packets here or requests rather uh which is pretty cool but i'll get to that later so we have our synack there we are so sorry we have our syn first that's being sent by kali to the server the server then responds with synac and then we immediately terminate with our rsd and let me just resize that back over here and there we are we can see the rst so that resets the connection and the scan is much quicker as you can see than running a connect scan so that's uh that's how to differentiate between them in terms of the in terms of the tcp flags that are being sent and how they are handled so you're not starting to understand how nmap utilizes tcp flags to to actually to actually create these really really specialized scans based on what you require and again this will get really interesting when you're talking about firewall evasion and nmap scripts and stuff like that um but yeah that's going to be it for this video let me know if you have any questions on the hackersploit forum at forum.hackersploit.org or in the comments section and i'll be seeing you in the next video