Ethical Hacking and Penetration Testing Guide

 4 
Target Enumeration and Port Scanning Techniques ..................................................97
Host Discovery ................................................................................................................ 97
Scanning for Open Ports and Services ........................................................................... 100
Types of Port Scanning .................................................................................................. 100
Understanding the TCP Three-Way Handshake .............................................................101
TCP Flags .......................................................................................................................101
Port Status Types ............................................................................................................102
TCP SYN Scan ...............................................................................................................102
TCP Connect Scan .........................................................................................................103
NULL, FIN, and XMAS Scans ......................................................................................104
NULL Scan ....................................................................................................................104
FIN Scan ........................................................................................................................105
XMAS Scan ....................................................................................................................105
TCP ACK Scan ..............................................................................................................105
Responses .......................................................................................................................106
UDP Port Scan ...............................................................................................................106
Anonymous Scan Types ..................................................................................................107
IDLE Scan ......................................................................................................................107
Scanning for a Vulnerable Host ......................................................................................107
Performing an IDLE Scan with NMAP .........................................................................109
TCP FTP Bounce Scan ..................................................................................................109
Service Version Detection ...............................................................................................110
OS Fingerprinting ..........................................................................................................111
POF ................................................................................................................................111
Output ............................................................................................................................112
Normal Format ......................................................................................................112
Grepable Format ....................................................................................................112
XML Format .........................................................................................................113
Advanced Firewall/IDS Evading Techniques ..................................................................113
Timing Technique ..........................................................................................................114
Wireshark Output ..........................................................................................................114
Fragmented Packets ........................................................................................................115
Wireshark Output ..........................................................................................................115

---

x
◾ 
Contents
Source Port Scan .............................................................................................................115
Specifying an MTU ........................................................................................................116
Sending Bad Checksums ................................................................................................116
Decoys ............................................................................................................................117
ZENMAP.......................................................................................................................117
Further Reading .............................................................................................................119