Port Scanning :- Port scanning is carried out to determine a list of open ports on the remote hosts that have certain services or daemons running. In port scanning, the attacker connects to various TCP And UDP ports and tries to determine which ports are in listening mode.
1). TCP Ports scanning :- Almost all ports scans are based on the client sending a packet containing a particular flag to a target port of the remote system to determine whether the port is open.following list contains the list of flags a TCP packet header can contain.
URG = This flag tells the receiver that the data pointed at by the urgent pointer required urgently .
ACK = This flag is turned on whenever sender wants to acknowledge the receipt of all data send by
the receiving end.
PSH = The data must be passed to the application as soon as possible.
RST = There has been a problem to the connection and one wants to reset the connection with
another
SYN = If system X wants to establish TCP connection with system Y, then it sends its own
sequence number to Y,requesting that a connection be established.Such a packet is known
as SYN packet
FIN = If system X has finished sending all the data packets and wants to end the TCP/IP
connection that it has established with Y, then it send a packet with FIN flsg to system Y.
A typical TCP/IP has a three-way handshake as,
1) The client sends a SYN packet to the server .
2) The server replies with a SYN packet and acknowledge the client’s SYN packet by sending an
ACK packet.
3) The client acknowledges the SYN sent by the server .
Different techniques TCP port Scanning are ,
1) TCP connect port scanning .
2)TCP SYN scanning (half-open scanning )
3)SYN/ACK scanning
4) TCP FIN scanning
5)TCP NULL scanning
6)TCP Xmas scanning
2). UDP port scanning :- In this scenario a packet is sent to each port on the target host one by one .If remote port is closed, then the server replies with a port unreachable ICMP error message.
If the port is open then no such error message is displayed.
3).FTP bounce port scanning:- This technique was developed by Hobbit. He discovered an interesting loophole that allowed users to connect to the FTP service of a particular system to connect to any port of any system.This loophole allows anonym port scanning.
Recommended Tools
1) Nmap
2)Superscan
Silent Poison Hack 