Ethical Hacking and Penetration Testing Guide

Command
:
nmap –sA
UDP Port Scan
UDP stands for “user datagram protocol”; it does not ensure the reliability of the communication 
and is not used for communication, where the data are very important to us. There are many ports 
that use UDP; the UDP port scan can be used to determine the common services that are listening 
upon UDP. Some of the popular UDP services are DHCP, SNMAP, and DNS.
The UDP port scan works by sending an empty UDP header; any kind of UDP response from 
the target port would reveal that the port is 
open
. No response would mean that either the port is 
open
or it is 
filtered
. A closed port is determined on the basis of ICMP error messages; if it responds 
with “ICMP Port unreachable error,” this would mean that the port is closed. Any other ICMP 
response means that the port is filtered.
Command
:
nmap –sU

---

Target Enumeration and Port Scanning Techniques
◾ 
107
Anonymous Scan Types
We discussed a variety of scan types, including both TCP and UDP. We also discussed some of 
the scans that can be used for anonymous scanning; in other words, your host iP would not be 
revealed at the destination when you are performing port scanning. These types of scans are very 
useful if you wish to remain anonymous while scanning your target. Both the scan techniques we 
have discussed in this chapter rely specifically upon using another host/server to perform a scan 
for you.
IDLE Scan
The IDLE scan is a very effective and stealthy scanning technique. The idea behind the IDLE 
scan is to introduce a zombie to scan another host. This technique is stealthy because the victim 
host would receive packets from the zombie host and not the attacker host. In this way, the victim 
would not be able to figure out where the scan originated.
However, there are some prerequisites for launching the idle scan, which are as follows:
1. Finding a good candidate whose IP ID sequence is incremental and recording its IP ID.
2. The host should be IDLE on the network.