Scanning
2.1. Introduction
2.1.1. Ports, Protocols, and Services
Ports, Protocols, and Services (PPS) help us in identifying the types of application running on a system and subsequently any potential weaknesses. This is due to the fact that, in the past, security researchers not only discovered vulnerabilities for specific applications, but also, created exploits that would allow adversaries to take advantage of these weaknesses.
In order to effectively utilize PPS information, one must know where to uncover information about services and applications running on a specific port. This is also valid for potential malware that may already exist on the target systems.
While there are many references available on the internet, having a locally stored copy ready for easy reference is always beneficial.
Good reference for PPS: Service Name and Transport Protocol Port Number Registry
Of course, you can always use search engines to find this information, but be sure to search for recent posting dates, as many of the available resources are dead.
The best option in identifying PPS would be to scan all ports of the remote system. Despite the fact that this is true, you should be aware that scanning all 65535 ports takes a very long time. Moreover, this type of scan will surely expose you presence on the network. Therefore, it is best to create jobs for specific smaller port ranges.
By default, most of the tools that we are going to use scan only a small set of ports. This means that they will scan only the most common applications and services such as telnet, FTP, SSH, HTTP, etc.
Note: A skilled network administrator may deploy anti-enumeration techniques. In addition, network administrator may deploy a service to a port that commonly identifies as hosting malware.
2.1.2. TCP - Three Way Handshake
All TCP based connection begin with a simple exchange of messages called three way handshake.
Header fields involved in the handshake:
Sequence number
Acknowledgement number
SYN and ACK flags
Steps:
First, the client sends a TCP packet to the server This packet has the SYN flag enabled and a random sequence number set (i.e.: Client -SYN--[Seq:329 Ack:0]-> Server)
Then, the server replies by sending a packet with both SYN and ACK flag set and contains another random sequence number The ACK number is always a simple increment of the SYN number sent by the client (i.e.: Client <-SYN/ACK--[Seq:498 Ack:330]- Server)
Finally, the client completes the synchronization by sending an ACK packet Note that the client behaves just like the server when sending ACK packets (i.e.: Client -SYN--[Seq:330 Ack:449]-> Server)
More resources:
RFC for communication protocols
Last updated