Scanning Flashcards
What are the goals of scanning?
- Open ports
- Find live network hosts, firewalls, routers, printers…etc
- Potential Vulnerabilities
- OS type used
- Work out networktopolgy.
What is network scanning?
A set of procedures, for identifying hosts, ports, and services in a network.
What are the objectives of network scanning?
- To discover live hosts, IP addresses, and open ports of live hosts.
- To discover OS and system architecture
- Discover vulnerabilities on live host
- Discover services running on hosts.
What are the types of TCP flags?
- URG: data in the packet must proceed immediately
- RST: resets a connection
- PSH: sends all buffered data immediately
- ACK: acknowledges the receipt of the data
- SYN: initiates a connection between hosts
- FIN: there will be no further transmisstions
what is an ARP scan?
a Linux-based command-line tool, which scans a subnet of a network for live hosts.
it displays IP adress and MAC adress
List the reasons to use ARP scan for host discovery?
-Takes the least amount of time
-Least amount of cost
-It identifies hosts that are configured with a local firewall
-
ARP scan must be run as__
root user
What is the command used to scan a single host inARP scan?
Sudo arp-scan [IP address]
What is the command used for ARP scan to scan all the network?
Sudo arp-scan [IP address] /24
Explain how does an ARP scan works?
send an ARP request for every host on a subnet, and if it receives an ARP reply, then the host is considered “alive”
What is the command used for ARP scan to scan the local network?
sudo arp-scan -l
OR
sudo arp-scan –localnet
What are the nmap options used for ARP host discovery and why?
- sn: limit Nmap to perform only host discovery and not port scanning
- PR: supports ARP scanning
What is the password recovery & network discovery tool for windows called? It is used for ARP host discovery
Cain and Abel
What is the command used for ARP scan to scan local network?
Sudo arp-scan -l
OR
Sudo arp-scan –localnet
What is the disadvantage of using ARP for host discovery?
It only scans internal/local networks, therefore, it is impractical for scanning systems on a distant network.
how to fix?
We should use ICMP or TCP/UDP discovery for that.
What is ICMP?
- Internet Control Message Protocol is an error reporting protocol, mostly used by network administrators for troubleshooting network connections.
- includes ping and traceroute
- note: it is rarely used by regular users
How to check for live systems using ICMP?
Send ECHO request and if the host is alive it will send ECHO reply in return.
What does the command Traceroute (Linux)/ Tracert (win) do?
used to identify the hops between you and your destination
How to set the maximum number of hops to search using Tracert command? using what option?
-h
tracert -h [max number] [target]
ex:
tracert -h 2 www.google.com
What does the option -PE in nmap do?
sends an ICMP ECHO request packet (type 8)
note: must be executed as root or else it will perform TCP pinging.
What does the option -PP in nmap do?
sends ICMP timestamp message
What is Hping3? and what it is used for?
a packet crafting tool that allows you to define any combination of flags, on any combination of packet types.
It is now shipped with nmap and called “nping”
used for?
- port scanning
- host discovery
- spoofing (MAC or IP or anything else)
what is Superscan4?
it is a tool that sends out multiple ICMP ECHO requests in parallel and simply waits and listens for responses.
You can discover hidden hosts behind traditional firewalls using it.
Why do pen testers perform TCP/UDP host discovery? and what is the downside?
If a web server is blocking ICMP requests (ping), they must have a port open for a client to connect to. Usually, TCP port 80 is open to accept HTTP traffic.
An attacker can probe port 80 and if there is a response it means that the host is alive, however, not all servers are web servers with TCP port 80 open so the attacker must blindly guess and probe several different ports. this takes time and is very noisy which is risky
