Back to Scanning Techniques

Port Scanning

Dive into the world of port scanning: Explore techniques, tools, and Visualization simulations.

What is Port Scanning?

Port scanning is a method for determining which ports on a network are open and could be receiving or sending data. It is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it.

Types of Port Scans

TCP Connect Scan

Attempts to complete a full TCP three-way handshake (SYN - SYN ACK - ACK) with each port.

SYN Scan

Sends a SYN packet and analyzes the response without completing the handshake. Same as TCP but without the final ACK packet.

UDP Scan

Sends UDP packets to identify open UDP ports. If the port is close ICMP Destination Unreachable (Type 3, Code 3) response indicating that the port is closed. If the port is open, no response (no ICMP error) or the service processes the request and replies

FIN Scan

Sends a FIN packet to elicit a response from closed ports. If the port is open, the packet is ignored and no response is sent. If the port is closed, the system will respond with an RST packet.

XMAS Scan

Sends packets with FIN, URG, and PUSH flags set. If the port is open, the system will ignore the packet and not respond. If the port is closed, the system will respond with an RST packet.

Port Scan Visualization

Port Open
Port Closed
21
FTP
22
SSH
23
Telnet
25
SMTP
53
DNS
80
HTTP
110
POP3
143
IMAP
443
HTTPS
3389
RDP

Port Scanning Tools and Commands

Nmap

Scan all ports on the specified IP address

nmap -p- 192.168.1.1

Nmap (SYN Scan)

Perform a SYN scan on the default 1000 ports

nmap -sS 192.168.1.1

Nmap (UDP Scan)

Perform a UDP scan on specified ports

nmap -sU -p 123,161,500 192.168.1.1

Nmap (Service Version)

Attempt to determine service/version info for open ports

nmap -sV 192.168.1.1

Netcat

Scan ports 1-1000 on the specified IP address

nc -zv 192.168.1.1 1-1000