CYS405 · Chapter 3 · Annotated SlidesScanning
Original
Overview

Scanning

Port, network and vulnerability scanning, TCP flags and the three-way handshake, ICMP and ping sweeps, full-connect, stealth (half-open), inverse-flag, Xmas, ACK, idle and UDP scans, countermeasures, banner grabbing and OS fingerprinting, and Nmap and other scanners.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 43 slides
  1. 1 Chapter 3
  2. 2 Learning Objective
  3. 3 Key Concepts
  4. 4 Overview of Network Scanning
  5. 5 § The purpose of scanning is to discover exploitable
  6. 6 Types and Objectives of Scanning
  7. 7 1- Port Scanning – Lists the open ports and services:
  8. 8 2- Network Scanning (Lists IP addresses): Discover the network’s
  9. 9 TCP Communication Flags
  10. 10 TCP Communication Flags
  11. 11 Slide 11
  12. 12 TCP/IP Communication
  13. 13 Creating Custom Packet Using TCP Flag
  14. 14 Scanning Techniques
  15. 15 Port Scanning: Common Port Numbers
  16. 16 Scanning Techniques
  17. 17 ICMP Scanning - Checking for Live Systems
  18. 18 Ping Sweep-Checking for Live Systems
  19. 19 Ping Sweep Tools
  20. 20 TCP Connect / Full Open Scan
  21. 21 Stealth Scan (Half-open Scan)
  22. 22 Inverse TCP Flag Scanning
  23. 23 Xmas Scan
  24. 24 ACK Flag Probe Scanning
  25. 25 ACK Flag Probe Scanning (cont..)
  26. 26 IDLE/IPID Header Sca
  27. 27 UDP Scanning
  28. 28 Port Scanning Countermeasures
  29. 29 Banner grabbing
  30. 30 How to Identify Target System OS
  31. 31 Drawing Network Diagrams
  32. 32 Scanning Pen Testing
  33. 33 Scanning Pen Testing (cont’d)
  34. 34 Nmap
  35. 35 Slide 35
  36. 36 Nmap (Cont.)
  37. 37 Using Nmap
  38. 38 SuperScan
  39. 39 Scanrand
  40. 40 THC-Amap
  41. 41 Mapping the Network
  42. 42 Analyzing the Results
  43. 43 Summary
Slide 1 / 43

Chapter 3

Slide 1: Chapter 3
Slide 2 / 43

Learning Objective

Slide 2: Learning Objective
Slide 3 / 43

Key Concepts

Slide 3: Key Concepts
Slide 4 / 43

Overview of Network Scanning

Slide 4: Overview of Network Scanning
Slide 5 / 43

§ The purpose of scanning is to discover exploitable

Slide 5: § The purpose of scanning is to discover exploitable
Slide 6 / 43

Types and Objectives of Scanning

Slide 6: Types and Objectives of Scanning

Notes

  1. Types: port scanning (open ports/services), network scanning (live IPs), vulnerability scanning (known weaknesses).

Slide 7 / 43

1- Port Scanning – Lists the open ports and services:

Slide 7: 1- Port Scanning – Lists the open ports and services:
Slide 8 / 43

2- Network Scanning (Lists IP addresses): Discover the network’s

Slide 8: 2- Network Scanning (Lists IP addresses): Discover the network’s
Slide 9 / 43

TCP Communication Flags

Slide 9: TCP Communication Flags

Notes

  1. TCP flags: SYN (start), ACK (acknowledge), FIN (finish), RST (reset), PSH (push), URG (urgent).

Slide 10 / 43

TCP Communication Flags

Slide 10: TCP Communication Flags
Slide 11 / 43

Slide 11

Slide 11: Slide 11
Slide 12 / 43

TCP/IP Communication

Slide 12: TCP/IP Communication
Slide 13 / 43

Creating Custom Packet Using TCP Flag

Slide 13: Creating Custom Packet Using TCP Flag
Slide 14 / 43

Scanning Techniques

Slide 14: Scanning Techniques
Slide 15 / 43

Port Scanning: Common Port Numbers

Slide 15: Port Scanning: Common Port Numbers
Slide 16 / 43

Scanning Techniques

Slide 16: Scanning Techniques
Slide 17 / 43

ICMP Scanning - Checking for Live Systems

Slide 17: ICMP Scanning - Checking for Live Systems
Slide 18 / 43

Ping Sweep-Checking for Live Systems

Slide 18: Ping Sweep-Checking for Live Systems
Slide 19 / 43

Ping Sweep Tools

Slide 19: Ping Sweep Tools
Slide 20 / 43

TCP Connect / Full Open Scan

Slide 20: TCP Connect / Full Open Scan

Notes

  1. TCP connect (full open) scan: completes the handshake. Reliable but logged.

Exam angle

PredictionQ1

Which scan completes the full three-way handshake?

Slide 21 / 43

Stealth Scan (Half-open Scan)

Slide 21: Stealth Scan (Half-open Scan)

Notes

  1. Stealth / half-open (SYN) scan: SYN → SYN/ACK means open → send RST instead of ACK. Less likely to be logged. nmap -sS.

Exam angle

PredictionQ1

In a SYN scan, an open port replies with:

PredictionQ2

Nmap option for a SYN (stealth) scan:

Slide 22 / 43

Inverse TCP Flag Scanning

Slide 22: Inverse TCP Flag Scanning

Notes

  1. Inverse TCP flag scans (FIN, NULL, URG/PSH): no response = open (or filtered); RST = closed. Do not work against Windows.

Slide 23 / 43

Xmas Scan

Slide 23: Xmas Scan

Notes

  1. Xmas scan: FIN + URG + PSH set ("lit up like a Christmas tree"). No reply → open; RST → closed.

  2. Trap In SYN scans a reply means OPEN; in Xmas/FIN/NULL scans NO reply means open.

Exam angle

PredictionQ1

An Xmas scan sets which flags?

Slide 24 / 43

ACK Flag Probe Scanning

Slide 24: ACK Flag Probe Scanning

Notes

  1. ACK scan: maps firewall rules (filtered vs. unfiltered), not open ports.

Slide 25 / 43

ACK Flag Probe Scanning (cont..)

Slide 25: ACK Flag Probe Scanning (cont..)
Slide 26 / 43

IDLE/IPID Header Sca

Slide 26: IDLE/IPID Header Sca

Notes

  1. Idle (zombie) scan: uses a third host’s predictable IP ID to scan without revealing your address.

Exam angle

PredictionQ1

The scan that hides the attacker’s IP by using a zombie host’s IP ID is the:

Slide 27 / 43

UDP Scanning

Slide 27: UDP Scanning
Slide 28 / 43

Port Scanning Countermeasures

Slide 28: Port Scanning Countermeasures
Slide 29 / 43

Banner grabbing

Slide 29: Banner grabbing

Notes

  1. Banner grabbing (telnet, netcat) reveals service names and versions; OS fingerprinting identifies the OS (active with Nmap -O, passive by sniffing).

Exam angle

PredictionQ1

Connecting with netcat to read a server’s version string is:

Slide 30 / 43

How to Identify Target System OS

Slide 30: How to Identify Target System OS
Slide 31 / 43

Drawing Network Diagrams

Slide 31: Drawing Network Diagrams
Slide 32 / 43

Scanning Pen Testing

Slide 32: Scanning Pen Testing
Slide 33 / 43

Scanning Pen Testing (cont’d)

Slide 33: Scanning Pen Testing (cont’d)
Slide 34 / 43

Nmap

Slide 34: Nmap

Notes

  1. Nmap: -sT connect, -sS SYN, -sU UDP, -sX Xmas, -sN NULL, -sF FIN, -sA ACK, -O OS detection, -sV version, -p ports, -Pn skip ping.

Slide 35 / 43

Slide 35

Slide 35: Slide 35
Slide 36 / 43

Nmap (Cont.)

Slide 36: Nmap (Cont.)
Slide 37 / 43

Using Nmap

Slide 37: Using Nmap
Slide 38 / 43

SuperScan

Slide 38: SuperScan
Slide 39 / 43

Scanrand

Slide 39: Scanrand
Slide 40 / 43

THC-Amap

Slide 40: THC-Amap
Slide 41 / 43

Mapping the Network

Slide 41: Mapping the Network
Slide 42 / 43

Analyzing the Results

Slide 42: Analyzing the Results
Slide 43 / 43

Summary

Slide 43: Summary