In simple words, Port Scanning is a series of attempts by a hacker or network administrator to examine which ports on a network are open/closed/filtered by attempting to connect to a range of ports and then gathering information from responding open ports to detect what applications or which service is associated or running on those ports. Port Scanning is accomplished by running port scanner against the host to scan 0 to 65536 potentially available ports on computer.
Now you all will be thinking why the hell, i am explaining different types of scans when we can simply do a normal port scan using any port scanning tool like NMAP or Free port scanner etc. Friends i am explaining this to you because different type of Port scan technique will result into different information gathering and scenerio will be different for each type. First of all we must need to choose which Port scanning technique we gonna use to scan the victim. Most elite hackers opt for Stealth Scan as its run in background without the knowledge of the user. So lets focus more on different scanning techniques..
|Different type of port scanning|
Different types of port scanning techniques:
1. Open Scan : Also known as vanilla scan. In this type of scan hacker try to connect to all the ports of the victim. This scan uses a normal TCP connection to determine port availability and utilizes a TCP 3-way handshake connection that typically every other TCP application will use on a network . Because of this fact this technique has a drawback that it can be easily detected and blocked.
The disadvantage of this scan technique is that the attacker cannot spoof his identity as spoofing would require sending a correct sequence number as well as setting the appropriate return flags to setup data connection. Moreover, most stately IDS and firewall detect and log this scan, exposing both the attempt and the attacker’s IP. The advantage is fast accurate scan that require no additional privilege.
2. Half Open Scan : Half open scan is similar to Open or vanilla scan. The only difference is that it does not establishes a complete connection with the host so it becomes little bit typical for victim firewall to detect it but it still detectable as for receiving ICMP echos a connection has to be established between your PC and victim.
However, some good IDS and firewall like zone alarm can detect a SYN packet from the void and prevent half open scan. Besides, this scan require attacker to make a customer IP packet, which in turn requires the access to SOCK_RAW (getprotbyname(‘raw’) under most system) or /dev/bpf (Berkeley packet filter), /dev/nit (Sun network interface tap). This requires admin privilege access.
3. Strobe Scan – In strobe scan, hackers try to scan only a selected number of port connections.(usually under 20) and rest of the working is similar to open scan. The only difference is that its light weight scan where hackers scan specific ports on the host and analyze the results. A strobe does a narrower scan, only looking for those services the attacker knows how to exploit. Almost 90% of crackers uses this technique as its fastest and accurate.
- SYN|ACK Scan
Client sends a SYN+ACK flag to the target. For a closed port, server will reply a RST response while an open port will not reply. This is because the TCP protocol requires a SYN flag to initiate the connection. This scan may generate certain amount of false positives. For instance, packets dropped by filtering devices, network traffic, timeouts etc can give a wrong inference of an open port while the port may or may not be open. However this is a fast scan that avoid three-way handshake.
- FIN Scan
Similar to SNY|ACK scan, instead a FIN flag is sent to the target. The closed ports are required to reply to the probe packet with RST, while open ports must ignore the packet in question. This scan attempt to exploit vulnerabilities in BSD code. Since most OS are based on BSD or derived from BSD, this was a scan that can return good result. However, most OS applied patches to correct the problem, still there remains a possibility that the attacker may come across one where these patches have not be applied.
- ACK Scan
The scan take advantage of the IP routing function to deduce the state of the port from the TTL value. This is based on the fact that IP function is a routing function. Therefore TTL value will be decremented by on by an interface when the IP packet passes through it.
- NULL Scan
In NULL scan, the packet is sent without any flag set. This takes advantage of RFC 793 as the RFC does not specify how the system should respond. Most UNIX and UNIX related system respond with a RST (if the port is open) to close the connection. However, Microsoft’s implementation does not abide with this standard and reacts differently to such scan. An attacker can use this to differentiate between a Windows machine and others by collaborating with other scan results. For example, if -sF, -sX or -sN scan shows all ports are closed, but a SYN (-sS) scan shows ports are opened, the attacker can infer that he is scanning a windows machine. This is not an exclusive property though, as this behavior is also shown by Cisco, BSDI, HP/UX, MVS and IRIX. Also note that the reserved bits (RES1, RES2) do not affect the result of any scan. Therefore this scan will work only with UNIX and related systems.
- Xmas Scan
In Xmas scan, all flags are set. All the available flags in the TCP header are set (ACK, FIN, RST, SYN, URG, PSH) to give the scan an ornamental look. This scan will work on UNIX and related systems and cause the kernel to drop the packet if the receiving port is open.
If a connection is established as a means of active data transfer processing (DTP), the client knows a port is open, with a 150 and 226 response issued by the server. If the transfer fails a 425 error will be generated with a refused build data message. The PASV listener connection can be opened on any machine that grants a file write access to the attacker and used to bounce the scan attack for anonymity. It does not even have to be an FTP server, any utility that will listen on a known TCP port and read raw data from it into a file will do.
Often these scan are executed as batch files padded with junk so that the TCP windows are full and the connection stay alive long enough for the attacker to execute this commands. Fingerprinting the OS scan help determine the TCP window size and allow the attacker to pad this commands for further access accordingly.
This scan is hard to trace, permits access to local network and evades firewalls. However, most FTP servers have patched this vulnerability by adopting countermeasures such as preventing third party connection and disallowing listing of restricted ports. Another measure adopted has been restrict write access.
6. Fragmented Packets Scans : FPS is an attempt to bypass rules in some routers. This approach is evolved from the need to avoid false positive arising from other scans due to packet filtering device. For any transmission, a minimally allowable fragmented TCP header must contain a destination and source port for the first packet (8 octet, 64 bit), the initialized flags in the next, which allows the remote host to reassemble the packet upon receipt through an internet protocol module that identifies the fragmented packets by the field equivalent values of source, destination, protocol and identification.
The scan works by splitting the TCP header into small fragments and transmitting it over the network. However, there is a possibility that IP reassembly on the server-side may result in unpredictable and abnormal results – such as fragmentation of the data in the IP header. Some hosts may be incapable of parsing and reassembling the fragmented packets and thus may cause crashes, reboots or even network device monitoring dumps.
Some firewalls may have rulesets that block IP fragmentation queues in the kernel (like the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel) – though this is not widely implemented due to the adverse affect on performance. Since several intrusion detection systems use signature-based mechanisms to signify scanning attempts based on IP and/or the TCP header, fragmentation is often able to evade this type of packet filtering and detection. There is a high possibility of causing network problems on the target network.
Also, this scanning technique is slow because of compensation for machines that implement the suggestions of RFC 1812 and limit ICMP error message rate. For example, a kernal may limit destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded.
Some people think UDP scanning is pointless – not so. Sometimes for example, Rpcbind can be found hiding on an undocumented UDP port somewhere above 32770. So it doesn’t matter that port 111 is blocked by the firewall. But can you find which of the more than 30,000 high ports it is listening on? With a UDP scanner you can.
The disadvantage to the attacker is that UDP is a connectionless protocol and unlike TCP does not retransmit packet if they are lost or dropped on the network. Moreover, it is easily detected and unreliable (false positive). Linux kernel limit ICMP error message rates with destination unreachable set to 80 per 4 seconds, thereafter implmenting a 1/4 second penalty if the count is exceeded. This makes the scan slow and moreover the scan requires root access. However it avoids TCP based IDS and can scan non-TCP ports.
Some more advanced techniques: