Network scanning is a critical and foundational technique in the field of cybersecurity, serving
as an essential part of both offensive and defensive strategies.
It allows security professionals to map out a network infrastructure, identify vulnerabilities
and maintain the visibility of network devices and systems.
By scanning the network professionals are able to detect open ports, running services and
potential weaknesses that could be exploited by the attackers.
Conversely, attackers use network scanning for reconnaissance, gathering information
on available targets before launching more targeted attacks like exploits or denial
of service attempts.
The process of network scanning typically starts with host discovery which identifies
live devices on the network.
This can be achieved through tools that leverage address resolution protocol or ICMP using ping
sweeps, both of which are methods to determine which devices are currently active and responsive
within a specific range.
Once the live hosts are identified, scanning continues with port detection, where the
objective is to determine which ports are open, closed or protected by firewalls.
This is crucial because open ports often expose services that could potentially be attacked.
Several techniques exist for port scanning, including SYN scans which are stealthy and
not complete a full TCP handshake, making them harder to detect, connect scans which
complete the full handshake and are thus easier to detect, and more evasive methods such as
null scans, fin scans and or Xmas Tree scans.
These methods vary in their detectability and can be used depending on the attackers
need to avoid detection or bypass specific security mechanisms.
Once the port scanning phase is completed and that the state of the ports, open, closed,
filtered, is known, the next is service enumeration.
Service enumeration goes a step further by identifying the specific services running on
open ports.
This can be done through techniques like banner grabbing where the attacker sends a request
to the service and analyzes the response for information about the service version
or configurations.
For example, a simple HTTP request to a web server might reveal the server type.
For example, if it is using Apache or NGINX and its version.
Service enumeration allows security professionals to identify outdated services, misconfigurations
or services that are unnecessarily exposed, which can be exploited by the attackers.
A real-world example of network scanning would be a systems administrator scanning their
internal subnet, for example, .1.0, to identify active hosts, open ports and services.
The administrator could use Nmap, a popular network scanning tool, to perform a scan
with various tools like -sS for a SYN scan, -sV for service version detection,
and -O for operating system fingerprinting.
Running a command, such as Nmap -sS -sV -O, would return a comprehensive map of the
network listing active directories, active hosts, their open ports, the services running
on these ports, and the operating systems of the devices.
This map enables the administrator to detect risks, unauthorized devices, or vulnerable
services that might be exposed to the threats.
Network scanning is typically broken down into three sequential phases, host discovery, port
scanning, and service enumeration.
Each phase builds upon the previous one, creating a comprehensive picture of the network and
its associated risks.
Host discovery, the first phase of network scanning is host discovery, where the objective
is to identify which devices or systems are active on a network.
Host discovery can be achieved using different techniques, such as ICMP echo requests, using
ping commands, ARP requests for local networks, or TCP UDP probes.
Tools like Nmap and ARP scan are often used for this purpose.
For example, a penetration tester might run the command Nmap -sn, and then the network
IP, to perform a ping sweep across a corporate subnet.
This scan will return a list of active hosts, which are the devices or systems currently
responding and connecting to the network.
Host discovery is a crucial first step, because it helps the tester focus efforts on live
devices, ignoring those that are offline.
The port scanning, once active hosts are identified, the next phase is port scanning.
That determines which communication endpoints the ports are open on the live hosts.
By probing these ports, the tester can assess the state of each port, whether it is open,
closed, or filtered by a firewall, or other reason.
Different types of port scanning techniques exist, including SYN scans, connect scans,
-sT, and UDP scans, -sU.
SYN scans are typically favored for stealth, as they only send the SYN packet without
completing the TCP handshake.
For example, after conducting a SYN scan, the tester might find that port 80 or port
22 for SSH are open on several hosts, providing valuable information on the services
running on those systems.
Then it's service enumeration.
The final phase of the network scanning is called service enumeration, where the
goal is to gather detailed information about the services or applications running on the
identified open ports.
This step is essential, because it helps to identify potential vulnerabilities or
misconfigurations.
Service enumeration typically uses version detection, -sV, or using more advanced
methods like Nmap scripting engine, NSE, to interact with services and determine
their exact configurations.
For example, the tester might run the Nmap command using -sV to identify service
versions.
This can reveal that the host running HTTP on port 80 is using Apache 2.4.2.9 and SSH
on port 22 that is using open SSH version 7.6, for example.
Such information is very valuable for your penetration testers, because it can be
highlighted outdated or vulnerable software that needs to be patched.
An example scenario considers a penetration tester that evaluates a corporate
subnet such as 10.0.0.0.
The tester begins the host discovery, running a ping sweep or ARP scan, then
to identify 12 active hosts on the network.
These are devices that are connected inside the network.
They perform a SYN scan on each of the identified hosts to probe for open ports,
revealing that ports 80 or 22 are open to some of the devices.
After identifying the open ports, the tester moves to a service enumeration
and tries to determine the version of each system, Apache version X and open SSH.
This version information is critical and might have well-known vulnerabilities.
The tester can now recommend specific mitigations, such as patching those
versions to prevent exploitation by the attackers.
After identifying the live host, the Nmap tool can perform detailed port scans
to identify which ports are open as we explained before.
However, when dealing with large networks of vast address spaces,
speed becomes a significant factor.
This is where Masscan shines.
Unlike Nmap, which is known for detailed scan, Masscan is optimized for speed.
I can send millions of packets per second, making it extremely fast
for conducting initial reconnaissance across large IP ranges.
Masscan uses its own TCP IP stack, which enables the tool to scan
entire subnets or large networks rapidly.
For example, if a security analyst is tasked with scanning a large
organization network, they might use Masscan with a command like
Masscan and then the network IP.0.0, the specific -p and the port numbers
and the rate that defines how much size the packets would be,
which will scan an entire subnet at a very high rate for common ports
like SSH, which is in 22, HTTP or the HTTPS.
This rapid scanning capability allows the analyst to quickly identify which ports are up
and which ports are open, providing a list of potential targets for further investigation.
Once Masscan has identified active hosts and open ports,
Nmap is typically used to perform more detailed scans on these targets.
For instance, we can use the tags that we used before,
like -sV, -O to conduct SYN scans and so on.
This will provide details on the version of the Apache and so on.
For those who prefer a more visual interface to manage network scans,
ZenMap is a great choice. ZenMap is an official graphical user interface for
Nmap designed to make the Nmap powerful features more accessible to users
who may not be very comfortable with command line operation.
ZenMap provides an intuitive interface for configured Nmap scans and
displaying the results visually. It simplifies the process of choosing scan types,
setting targets and intercepting results while Nmap requires detailed command line input
to configure scans. ZenMap offers a user-friendly alternative,
which can be especially helpful for network administrators and less experienced users
who still want to leverage the full power of Nmap for the scanning capabilities.
Angry IP scanner is another tool that offers simplicity and ease of use for basic network scanning tasks.
This tool makes excellent tools for administrators or users to make the scans.
Finally, Netcat, or as it's called NC, is a versatile tool that is often underappreciated,
but incredibly powerful when it comes to network testing.
Netcat is an open command line utility that can be used to test and open ports and data
between the devices and different established factors in team exercises.
One of the most common uses for Netcat is banner grabbing, which involves connecting to an open port
to extract information about the service running on that port.
For instance, if the analyst finds an open HTTP port on 8080,
they can use Netcat to manually interact with the service by typing NC,
Netcat, the IP address, and then the port number.
This could allow the analyst to send a very low-level HTTP requests
or receive banners that reveal the service version and other details
that might be useful for identifying the vulnerabilities.
Returning back to Angry IP Scanner, it's a lightweight cross-platform.
It's ideal for quickly determining which devices are active on the network.
It's like the mass scan or the Nmap scanning to identify open devices
that are connected to the network.
This makes it an excellent tool, Angry IP Scanner, for users to
to conduct a fast enumeration and to check the health and so on.
But it's very intrusive.
In practice, a security analyst may combine those tools in a layered approach to scanning.
First, they might use a mass scan to quickly identify live hosts and open ports across a
large address space.
Once potential targets are identified, Nmap can be used to conduct more in-depth analysis,
revealing the services running on those open ports, and identify their versions.
If there is a suspicious service is found, the analyst can use Netcat to manually interact
with the service, retrieve banners, or probe further using crawl packets in a low level.
For less experienced users, they can use a host discoverer like Angry IP Scanner or ZenMap
that it's very simple to use and a more approachable way to perform,
but it's like if you need more advanced tools and more advanced configurations,
eventually you go to the Nmap scanning.
That's it.
Each tool in the Net Cross Scanning toolkit brings unique advantages and technical
trade-offs, depending on the specific goals and circumstances of the scan.
Nmap is an industry standard tool known for its versatility and depth of functionality.
One of the key strengths is nmap scripting engine, the NSE scripts,
which allows users to automate a wide variety of tasks such as vulnerability scanning,
brute forcing credentials, and even performing complex service detection, or DoS attacks.
Nmap also excels at stealth scanning, enabling different configuration options,
and other advanced settings, which makes it harder for intrusion detection systems to
detect if they are used very advanced, so very sophisticated.
These capabilities make Nmap ideal for comprehensive network assessments that
are deep insight into services and vulnerabilities.
We have seen Netcat and MassScan and all of these tools that can be used for the
network scanning. However, network scanning, regardless of the tool that is used,
is not without legal and ethical considerations.
Unauthorized scanning, even if done with the intent of improving security,
can lead to significant legal consequences.
For example, laws like the computer fraud and abuse act CFAA in the United States,
or the cyber crime directive in the European Union,
make it illegal to access or tamper with computer systems without authorization.
In some cases, even conducting simple reconnaissance activities such as port scanning
may be considered a violation of these laws, particularly if the scan is intercepted
as a precursor to an attack. Ethically, network scanning should always be performed
with the appropriate permissions. Security professionals are expected to follow
responsible disclosure practices, ensuring they have explicit authorization
before conducting any scans. Disauthorization is typically granted
through rules of engagement or ROE, or contracts that outline the scope,
goals and boundaries of the scan. These documents serve as a legal safeguard for
both the professional and the organization, ensuring that the scanning activities are
in the line with ethical guidelines and do not inadvertently disrupt services
or breach user privacy. By adhering to ethical guidelines and legal framework,
security professionals can ensure their scanning activities contribute to improving
security than unintentionally causing any harm.
Let's break down the scenario where Network Administrator is auditing a local
subnet.1.0 for example. Users can map to gain insights into the active devices
and services within the network. The process starts with a simple host
discovery step. The administrator runs their command Nmap -sn,
and then the IP of the network. This command sends ICMP echo requests, also as
ping request to the entire subnet. Additionally, on local networks and
map can use ARP scan to identify active devices, as ARP works even when
ICMP is blocked by firewalls. It's like a public available information using the
address resolution protocol. The -sn switch tells nmap not to
perform any import scanning, it only checks for the presence of live hosts.
If the device responds Nmap flags it as active, providing the administrator
with a list of devices that are online within the subnet.
Next, the administrator zooms in on a specific device, for example .1.1, and checks for common
open ports using the command Nmap -p 22,80,443. This scan is focused on checking
whether the target device has specific ports open, like SSH, HTTP and HTTPS.
These are typically used for remote access and web-based services.
The command sends SYN packets and discovers if the ports are open, closed or filtered by the firewall.
This process is helpful for identifying potential attack vectors on a specific device.
To gain more granular information about the services running on a specific port,
you can use -p 8 and thus discover a specific port, or have a range from
1 to 1,000 and check which ports of them are open actually.
The -sV will remind that this is about the version and will provide the version of
the specific service that has the port open. The -sn is used to perform the ping scan
and -p for the ports and -sV for the versions.
So another important option is timing options that can adjust how quickly Nmap performs scans,
with slower scans being less likely to trigger alerts from the intrusion detection systems.
So -T has its own variables to set up the threshold of the timing,
and also there are other options like output formats. You can extract the result of the
Nmap on a specific file, defining -oN or -oX, let the administrator
save scans in different formats like plain text or XML or JSON and so on.
The NSE scripts allow for the execution of the scripts that can automate the vulnerability
scanning, so this is very important to handle on Nmap.
To begin with, students will initiate the process with a basic host discovery scan.
By using the command Nmap -sn and then the network IP.
Normally in the network IP on the host only adapt there is 56.0,
but this can be configured otherwise if you want.
They will identify which virtual machines VMs are currently activated on the network,
so they will discover webgoat, dvwa or whichever vulnerable machine they have
uploaded on their network. This step mimics the first stage of a network
assessment where security professionals establish which hosts are online
and ready for further examination. Once they have identified live hosts,
the next task will be the port scanning. For instance, by executing the Nmap
scanning -p and then they define the range of the port
numbers and the IP address of the specific VM, the students will be able
to check the common services such as FTP, SSH, HTTP and so on.
These are typical ports of interest in the core security scan.
Finally, students will delve into service integration with a command like -sV
to find the specific versions of the vulnerable service.
Through this lab students will also explore several advanced Nmap options
and to customize their scans they will use -v, -oN,
-oX for extracting to XML and they can use timing options like
T3 in order to adjust the scan's timing, balancing speed with stealth,
which is important in real-world scenarios where avoiding detection is often a priority.
It is crucial that scans are conducted only on sandbox or permission-granted systems,
controlled environments such as NAT network and virtualization tools like virtual box
will provide this opportunity. Otherwise, the students can use also scanme.nmap.org
which is a website offered by Nmap in order to do test scans without any legal issues.
By working with the control settings, students can test and tweak their scanning techniques
without worrying about violating policies or causing any disruptions.
The results of the scans should be documented carefully and the students
should analyze the data critically. They will be asked to interpret
the significance of each port and the associated service.
For example, an open SSH port could indicate a potential vector for remote login attacks
if weak passwords are in use using brute force attacks, while an open HTTP port
could expose a vulnerable web application exploitation. Encouraging students to think
about the security implications of each scan will result, will help them develop not only
their technical proficiency but also their analytical thinking which is essential
for effective cyber security practices in real world scenarios.