Scanning Networks
Press Next → or use ← → arrow keys
From Recon to Scanning
Live hosts · open & closed ports · the OS · running services & processes · the presence of firewalls/IDS · system architecture · and ultimately vulnerabilities. It turns a list of addresses into a live map of the attack surface.
Rattling Every Doorknob
Internet-wide scanners hit every public IP constantly — a new server is typically found and probed within minutes of going online. The exposed, unpatched service you forgot about is exactly what the scan is built to find first.
The Language of Scanning — TCP Flags
Most scans work by sending TCP packets with specific flags set and reading the reply. Six flags matter:
| Flag | Meaning | Flag | Meaning |
|---|---|---|---|
| SYN | Initiate a connection | PSH | Push buffered data now |
| ACK | Acknowledge a packet | FIN | Gracefully end a connection |
| URG | Data is urgent, process first | RST | Reset / refuse the connection |
TCP is connection-oriented (handshake, reliable). UDP is connectionless — no flags, no handshake, so it's scanned differently.
Every scan type below is defined by which flags it sets and what reply it expects — that's the whole trick.
The TCP Three-Way Handshake
A sends SYN → B replies SYN+ACK → A replies ACK. That's a live TCP session. Every scan is a deliberate deviation from this dance — completing it, half-completing it, or sending nonsense flags to see how the target reacts.
The Scanning Methodology
Find who's alive → find what's open → evade detection → grab banners (service/OS) → scan for vulnerabilities → map the network → route through proxies → and document everything. Defenders run the same steps against themselves.
Host Discovery — Who's Alive?
Send an ICMP echo request; a reply means the host is live. A ping sweep does this across a whole range at once (nmap -sn 10.0.0.0/24).
When ICMP is blocked, scanners use TCP/ARP pings, SSDP, and tools like Angry IP Scanner or nmap to find hosts anyway.
The Port-Scan Family Tree
UDP scanning vs TCP scanning — and TCP splits into open (complete the handshake), stealth (half-open & weird-flag scans that dodge logs), and third-party/IDLE (bounce off a zombie to hide the source).
Full-Open vs Half-Open (Stealth)
Full-open completes the handshake — reliable but logged by the application. Half-open sends RST instead of the final ACK, so the connection never fully forms and older logging often misses it. An open port answers SYN+ACK; a closed port answers RST.
Xmas, FIN & NULL Scans
These "inverse-flag" scans exploit a rule in the TCP spec (RFC 793): a closed port must reply RST; an open port stays silent.
| Scan | Flags sent | Open port | Closed port | nmap |
|---|---|---|---|---|
| Xmas | FIN+URG+PSH | No response | RST | -sX |
| FIN | FIN only | No response | RST | -sF |
| NULL | no flags | No response | RST | -sN |
A packet with no valid session looks like noise, so it can slip past simple filters that only watch for SYN.
They only work on RFC-793 stacks. Modern Windows ignores them, so "no response" becomes ambiguous — a known limitation.
ACK Probe & the IDLE (Zombie) Scan
Sends a lone ACK. A returned RST = the port is unfiltered (reachable); no reply = a stateful firewall is filtering it. It maps firewalls, not open ports.
The attacker never touches the target directly — they bounce packets off a "zombie" host and read its IP-ID counter. The target logs the zombie, not the attacker.
Scanning the Silent Protocol — UDP
UDP has no handshake, so an open port simply stays silent — the scanner infers state from the absence of an ICMP "port unreachable." It's slow and lossy (nmap -sU), but essential: DNS, SNMP, and many trojans live on UDP.
What a Scan Actually Tells You
$ nmap -sS -sV 10.0.0.6
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2
80/tcp open http nginx 1.18
443/tcp open https nginx 1.18
3306/tcp closed mysql
8080/tcp filtered http-proxy
MAC Address: 00:0C:29:… (VMware)-sV adds the exact software & version (OpenSSH 8.2, nginx 1.18). That's what an attacker matches against a vulnerability database — and what a defender patches first.
OS Fingerprinting & Banner Grabbing
| OS | TTL | TCP Window |
|---|---|---|
| Linux | 64 | 5840 |
| FreeBSD | 64 | 65535 |
| Windows XP | 128 | 65535 |
| Windows Vista / 7 / Server 2008 | 128 | 8192 |
| Cisco Router (iOS 12.4) | 255 | 4128 |
Many services announce their name & version in a banner (via Telnet, Netcat, etc.). Defense: disable or fake banners, mask the server header, hide file extensions.
Scanning Beyond the Firewall & IDS
A modern IDS/IPS reassembles fragments, correlates slow/distributed probes, and normalizes traffic — turning most evasion tricks back into detectable patterns.
Proxies, Proxy Chaining & Anonymizers
Bouncing through multiple proxies so each hop only knows the previous one — the target logs the last proxy, not the attacker.
Tor, VPNs, and tools like Tails strip identity to make activity untraceable — a double-edged tool used by both attackers and privacy-conscious defenders.
The Scanning Toolkit (Awareness)
Blue teams run these against their own networks — an authorized scan is the fastest way to find the open port or unpatched service before an attacker does.
Detecting & Defending Against Scans
You can't stop the internet from probing you — but a spotted scan tells you who's interested and where they're looking, buying time to harden before exploitation.
Golden Rules of Scanning
Know Every Door Before They Do
Scanning is the attacker walking your perimeter, testing every port to learn what's alive, open, and exploitable — using TCP-flag games and stealth to stay quiet. The defender wins by scanning first, closing what shouldn't be open, hiding what must stay, and watching for the knock. Find your own open doors before someone else does.
Open replies SYN/ACK, closed replies RST, filtered says nothing — master that, and you can read any scan. Next in the kill chain: Enumeration, where open ports become usernames, shares, and footholds.
📡 End of tutorial · Press ← to review, or click Restart