Penetration Testing with Kali Linux OffSec

sudo nmap -sS 192.168.50.149
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-09 06:31 EST 
Nmap scan report for 192.168.50.149 
Host is up (0.11s latency). 
Not shown: 989 closed tcp ports (reset) 
PORT STATE SERVICE 
53/tcp open domain 
88/tcp open kerberos-sec 
135/tcp open msrpc 
139/tcp open netbios-ssn 
389/tcp open ldap 
445/tcp open microsoft-ds 
464/tcp open kpasswd5 
593/tcp open http-rpc-epmap 
636/tcp open ldapssl 
3268/tcp open globalcatLDAP 
3269/tcp open globalcatLDAPssl 
... 
Listing 58 - Using nmap to perform a SYN scan 
Because the three-way handshake is never completed, the information is not passed to the 
application layer and as a result, will not appear in any application logs. A SYN scan is also faster 
and more efficient because fewer packets are sent and received. 
Please note that term “stealth” refers to the fact that, in the past, firewalls would 
fail to log incomplete TCP connections. This is no longer the case with modern 
firewalls and although the stealth moniker has stuck around, it could be 
misleading. 
The next Nmap scanning method we’ll explore is named 
TCP Connect Scanning
, which, as the 
name suggests, performs a full TCP connection. 
259
(Nmap, 2022), https://nmap.org/book/synscan.html 

---

Penetration Testing with Kali Linux
PWK - Copyright © 2023 OffSec Services Limited. All rights reserved. 
145 
When a user running nmap does not have raw socket privileges, Nmap will default to the TCP 
connect scan
260
technique. Since an Nmap TCP connect scan makes use of the Berkeley sockets 
API
261
to perform the three-way handshake, it does not require elevated privileges. However, 
because Nmap has to wait for the connection to complete before the API will return the status of 
the connection, a TCP connect scan takes much longer to complete than a SYN scan. 
We may occasionally need to perform a connect scan using nmap, such as when scanning via 
certain types of proxies. We can use the -sT option to start a connect scan. 
kali@kali:~$