Nmap Discovery - Part 3
Back to Nmap help again. And we can see the next discovery options, which is essentially to do a SYN and ACK or UDP or an SCTP type discussion.
We pop over to here. So here we've got the PS selectors, so that's the SYN ping.
Now this option sends an empty TCP packet with the SYN flag set, the default destination port is 80.
If none of these are selected or rather none of them are specified.
And then note obviously as normal continues on with the port scan.
So think of this as discovery, but with specified ports to check, to see if the host is active.
So you would use this, if you think the standard check for discovery, isn't good enough.
And there we go.
It's found the same ports lets clear this.
Now let's change the target, the second tier.
So we'll do a -I and all which is random.
We're going to choose 10 random.
Got it. On the boast there again.
And we're going to add the minus S and N which, if you remember, that means it's going to do no port scan.
So this is going to be discovery only for 10 random IP addresses.
And I'm going to press a V here to increase the verbosity level, see that it changes to, 2 press enter see how far we through it, 87%.
And there we go is found zero hosts.
Let's try that again. Just if we can find some.
And there we go.
We found a couple of things, one in Brazil.
And to know that Amazon AWS server and these were discovered by sending syn packets to these ports here.
And then afterwards it didn't no scan because we've got this selected the no scan.
The sin flag suggest to the remote system that you were attempting to establish a connection.
Normally the destination port will be closed because well, most ports are closed and a reset or S T packet is sent back.
If the port happens to be open, the target will take the second step of ATCP three-way handshake by responding with a syn ack TCP.
The machine running and map, then tears down the connection by responding with a reset RST rather than sending an ACK packet, which would complete the three-way handshake and establish a full connection.
The RST, the reset packet is sent by the kernel of the machine running Nmap in response to the unexpected SYN ACK, not by Nmap itself Nmap does not care whether the port is open or closed.
Either the reset or the SYN ACK response tells Nmap that the host is available and responsive effectively that it is active.
And here we are back in Nmap help.
That was the SYN scan.
We've got the ACK we've got the UDP got the SCTP.
And if we go here, we can see in much the same way as we did with the SYN scan.
We can change this to a, and we can do an ACK scan instead, and you can see that's also very quickly.
So the ACK scans are explained before it's sending an ACK to those ports in order to do the discovery.
And if we come here, we can see in the same light, we can do UDP as well with the PU, just to remind you PSPA PUPY.
And here we doing PU for UDP. So here we're doing a scan and we're looking or doing discovery against port 53 on UDP, which is DNS.
We're it against random host 10 random host.
Let's see what we get here.
So nothing as you can see here, we've got received no response because we've got the verbose on their exchange that to VVV.
So if we get anything extra, no.
And let's change that to 100 host.
You'd say if we're lucky to get a DNS server and there we go, we can see that it's potentially a DNS server.
At least it's responded anyway, although it's saying port on unreachable, so they're probably not DNS servers actually, but there you go.