1.4 Scanning and Enumeration

After the active and passive reconnaissance stages of system hacking have been completed, scanning is performed. Scanning is used to determine whether a system is on the network and available. Scanning tools are used to gather information about a system such as IP addresses, the operating system, and services running on the target computer.

Scanning is the process of locating systems that are alive and responding on the network. Ethical hackers use it to identify target systems’ IP addresses. 

Qlists the three types of scanning.

Port scanning
Port scanning is the process of identifying open and available TCP/IP ports on a system.
Ports are virtual communication endpoints used by network protocols to enable communication between devices. 
Port-scanning tools enable a hacker to learn about the services available on a given system. Each service or application on a machine is associated with a well-known port number. For example, a port-scanning tool that identifies port 80 as open indicates a web server is running on that system. Hackers need to be familiar with well-known port numbers.

Port scanners send network packets to target devices, attempting to establish connections to various ports and observing the responses. Based on the responses received (e.g., open, closed, filtered), the scanner determines the state of each port.
Common port scanning techniques include SYN scanning (also known as half-open scanning), TCP connect scanning, UDP scanning, and stealth scanning (e.g., using tools like Nmap).

Network scanning
Network scanning involves the comprehensive scanning of an entire network or range of IP addresses to identify active hosts, devices, and network infrastructure components.
Network scanning is a procedure for identifying active hosts on a network, either to attack them or as a network security assessment.
Hosts are identified by their individual IP addresses.
Network-scanning tools attempt to identify all the live or responding hosts on the network and their corresponding IP addresses.
Network scanners send probes or packets to target IP addresses, examining responses to determine the status and characteristics of network devices (e.g., routers, switches, firewalls).
Network scanning techniques include ping sweeps, ARP scanning, TCP SYN scanning, OS fingerprinting, and service version detection.

Vulnerability scanning
Vulnerability scanning is the process of proactively identifying the vulnerabilities of computer systems on a network.
It involves scanning target systems for known security vulnerabilities, weaknesses, misconfigurations, and software flaws that could be exploited by attackers.
Generally, a vulnerability scanner first identifies the operating system and version number, including service packs that may be installed. Then, the vulnerability scanner identifies weaknesses or vulnerabilities in the operating system. During the later attack phase, a hacker can exploit those weaknesses in order to gain access to the system.  
Vulnerability scanners automate the process of identifying vulnerabilities by comparing system configurations, software versions, and patch levels against a database of known vulnerabilities 
Examples of vulnerability scanning tools include Nessus, OpenVAS

CEH Scanning Methodology

The Certified Ethical Hacker (CEH) scanning methodology outlines the systematic approach used by ethical hackers and cybersecurity professionals to conduct network reconnaissance, identify potential vulnerabilities, and assess the security posture of computer networks. It ensures that no system or vulnerability is overlooked and that the hacker gathers all necessary information to perform an attack.

1.  Check for Live systems
   to identify active hosts on the network and Determine which IP addresses are responsive and reachable, indicating live systems.
   network scanning techniques, such as ping sweeps or ICMP echo requests is used
2. Check for Open Ports
   identify open ports on live systems.
   tools like Nmap to scan for open TCP and UDP ports, revealing potential entry points into the network are used
3. Service Identification
   the services running on open ports are determined by sending probes to each port to gather information about the corresponding services.
   Identify the protocols, versions, and configurations of the services running on the open ports.
4. Banner Grabbing/Os Footprinting
   banner grabbing is performed to extract additional information about the services, such as service banners or version strings.
   Banner grabbing involves opening a connection to a target system and reading the banner or response sent by the application running on that system.
   OS fingerprinting techniques is used to identify the operating system running on the target hosts based on responses to network probes.
5. Vulnerability Scanning
   to identify known security vulnerabilities and weaknesses in the target systems.
   Use vulnerability scanning tools like Nessus, OpenVAS,
   
6. Draw network diagrams of vulnerable hosts
   Documentation of the network architecture and layout is done and network diagrams to visualize the relationships between hosts, subnets, and network segments are created.
7. Prepare Proxies
   proxy servers or intermediary systems to anonymize and obfuscate the source of attacks is created
   Proxy service route network traffic through intermediary hosts hiding the attacker's IP, address and location.
8. Attack
   Finally,Exploitation of the vulnerabilities identified during the scanning and reconnaissance phases to gain unauthorized access to target systems.

Ping Sweep Techniques

Ping Sweep

1. The simplest, although not necessarily the most accurate, way to determine whether systems are live is to perform a ping sweep of the IP address range.
2. A ping sweep is also known as an ICMP sweep or ping scan.
3. It is a network scanning technique used to identify live hosts within a range of IP addresses.
4. It involves sending ICMP echo requests (ping) to multiple IP addresses and analyzing the responses to determine which hosts are active and reachable on the network
5. All systems that respond with a ping reply are considered live on the network. 
6. Ping sweep can be performed using command-line utilities or network scanning tools that support ICMP echo requests.
7. Common tools include the ping command in Unix/Linux, ping utility in Windows, and network scanning tools like Nmap.
8. multiple ICMP echo requests can be sent simultaneously to multiple IP addresses.
9. Parallel ping sweep tools can send ICMP echo requests in parallel threads, allowing for faster scanning of large IP address ranges.
10. Instead of scanning entire IP address ranges, targeted ping sweeps focus on specific subnets, IP ranges, or network segments.

Detecting Ping Sweeps / its Limitation

1. One considerable problem with this method is that personal firewall software and network based firewalls can block a system from responding to ping sweeps. 
2. Another problem is that the computer must be on to be scanned.
3. Most modern intrusion detection systems (IDS) and intrusion prevention systems (IPS) are configured to detect and alert on unusual network activity, including ping sweeps.Ping sweeps generate a significant amount of ICMP traffic, which can trigger alarms in network monitoring systems.
4. If ping sweeps do not yield conclusive results due to network defenses or configuration settings, attackers may resort to more intensive port scanning techniques.

Scanning Ports and Identifying Service
Port Scanning

Port scanning is the process of systematically scanning a target network to discover open ports on networked devices, such as computers, servers, routers, and IoT devices.

Ports are virtual communication endpoints used by network protocols to enable communication between devices. Each port is associated with a specific service or application.

Port scanning helps assess the attack surface of a network, identify potential entry points for attackers, and uncover vulnerabilities in networked devices and services.Popular port scanning tools include Nmap (Network Mapper)

Port scanning tools provide detailed output and analysis of scan results, including lists of open ports, services, versions, and potential vulnerabilities. port scanning techniques include: TCP Connect Scan,SYN Scan ,UDP Scan, ACK Scan

Identifying Service
Service identification is the third step in the CEH scanning methodology

It’s usually performed using the same tools as port scanning. By identifying open ports, a hacker can  usually also identify the services associated with that port number.

it involves determining the specific services or applications running on open ports within a target network. By identifying services associated with open ports, security professionals can gain insights into the network's attack surface, potential vulnerabilities, and configuration details.

Each port number is associated with a specific network service or application according to the assigned port numbers by the Internet Assigned Numbers Authority (IANA) and other standards organizations.
For example, port 80 is commonly associated with HTTP (Hypertext Transfer Protocol) used for web traffic

Port-Scan Countermeasures

Countermeasures are processes or tool sets used by security administrators to detect and possibly

thwart port scanning of hosts on their network.
minimizes the risk of exposing network vulnerabilities. 

1. Deploy IDPS- Intrusion Detection and Prevention Systems solutions to monitor network traffic for suspicious or anomalous behavior associated with port scanning activities.
2. Firewall Configuration:
   Configure firewalls to block or restrict access to unused ports and services.Use stateful inspection and deep packet inspection (DPI) to analyze incoming and outgoing traffic and enforce security policies.
3. Only needed ports should be kept open. The rest should be filtered or blocked.
4. The staff of the organization using the systems should be given appropriate training on security awareness. They should also know the various security policies they’re required to follow.
5. Network IDS should be used to identify the OS-detection method used by some common hackers tools, such as Nmap.
6. Deploy honeypots and honeynets to deceive and gather information about potential attackers
7. Conduct regular security audits and vulnerability assessments to identify and remediate security weaknesses, misconfigurations, and outdated software.
   

Understand Nmap Command Switches
Nmap (Network Mapper) is a powerful open-source network scanning tool used for discovering hosts and services on a computer network, thus creating a "map" of the network.

It quickly and efficiently performs ping sweeps, port scanning, service identification, IP address detection and OS detection.

It can scan large no. of machine in single session.

It is supported by Windows,Linux,Unix and many other OS.

It is available as both a command-line utility and a graphical user interface (Zenmap) for ease of use and accessibility.

Nmap provides flexible output formats for scan results, including human-readable text, XML, grepable output, and various interactive modes.

The state of the port as determined by an Nmap scan can be open, filtered, or unfiltered. 

Open means that the target machine accepts incoming request on that port. 

Filtered  means a firewall or network filter is screening the port and preventing Nmap from discovering whether it’s open. 

Unfiltered  mean the port is determined to be closed, and no firewall or filter is interfering with the Nmap requests. 

Nmap support several types of scans

1. TCP Connect Scan:Also known as full connect scan, this technique establishes a full TCP connection with each target port to determine its status (open, closed, or filtered). TCP connect scan is more reliable than SYN scan but may be slower and more easily detected by security devices.
2. Xmas Tree scan : sends packets with various flags set (FIN, URG, and PSH).The attacker checks for TCP services by sending XMAS-tree packets,
3. SYN stealth scan : this is also known as half-open scanning The hacker send a SYN  packet and receives a SYN-ACK back from the server. It’s stealthy because a full TCP connection isn’t opened.
   
4. Null scan  : This is an advanced scan that may be able to pass through firewalls undetected or modified. Null scan has all flags off or not set. It only works on UNIX systems.
5. Windows scan  This type of scan is similar to the ACK scan and can also detect open ports.
6. ACK scan This type of scan is used to map out firewall rules. ACK scan only works on UNIX. ACK scan does not attempt to determine whether ports are open or closed but focuses on identifying filtering rules.

the syntax for performing an Nmap scan at the Windows command prompt

nmap [scan type] [target IP address] [additional options]

Example :nmap -sT 192.168.0.1

Nmap Commands

Understand SYN, Stealth, XMAS, NULL, IDLE and FIN Scans

SYN

The SYN scan, also known as a TCP SYN scan or half-open scan, is one of the most common and widely used scan types in Nmap.

The SYN scan starts by sending TCP SYN packets to the target ports specified by the user.

A SYN packet is the first step in the TCP three-way handshake, used to establish a connection between a client and a server.

When a port is open, the target system responds with a SYN-ACK (synchronize-acknowledge) packet if the port is listening for incoming connections.
If a port is closed, the target system responds with a RST (reset) packet to indicate that no service is listening on that port.
If a port is filtered by a firewall or other network device, the target system may not respond at all, or it may respond with an ICMP error message (e.g., ICMP unreachable).
SYN scans are considered stealthy and less likely to be detected by intrusion detection systems (IDS) and firewall logs compared to full connect scans.

SYN scans are generally faster than full connect scans because they do not establish full TCP connections with target ports.

 Syntax : nmap -sS [target IP address]

XMAS

The XMAS scan is a type of TCP scan used in network reconnaissance to identify open ports on a target system. It gets its name because it "lights up" target ports in a variety of ways, similar to a Christmas tree.

In an XMAS scan, Nmap sends a series of TCP packets to the target ports with specific flags set. These flags typically include the FIN (Finish), URG (Urgent), and PSH (Push) flags

If a port is open and receiving connections, it should ignore or respond with certain responses to these packets.

If a port is closed, the target system may respond with an RST (Reset) packet, indicating that no service is listening on that port.

If a port is filtered by a firewall or other network device, the response may vary, including no response at all, an ICMP error message, or other behavior depending on the firewall configuration.

don’t work against any version of Windows. 

XMAS scans work only on target systems that follow the RFC 793 implementation of TCP/IP 

nmap -sX [target IP address]

NULL

The Null scan is a type of TCP scan used in network reconnaissance to identify open ports on a target system. It is called a "Null" scan because it sends TCP packets with no flags set

In a Null scan, Nmap sends TCP packets with no flags set (all flags set to zero) to the target ports. This includes no SYN, FIN, ACK, RST, PSH, or URG flags.

If a port is open and receiving connections, it may respond in a certain way or not respond at all to the Null packets.

If a port is closed, the target system may respond with an RST (Reset) packet, indicating that no service is listening on that port

If a port is filtered by a firewall or other network device, the response may vary, including no response at all, ICMP error messages, or other behavior determined by the firewall configuration.

nmap -sN [target IP address]

FIN

In a FIN scan, Nmap sends TCP packets with only the FIN flag set to the target ports. The FIN flag is typically used to close an established TCP connection.

By sending packets with the FIN flag set and no other flags, the FIN scan attempts to exploit certain behaviors in TCP/IP stack implementations to identify open ports.

If a port is open and receiving connections, it may respond in a certain way or not respond at all to the FIN packets.

If a port is closed, the target system may respond with an RST (Reset) packet, indicating that no service is listening on that port.

If a port is filtered by a firewall or other network device, the response may vary, including no response at all, ICMP error messages, or other behavior determined by the firewall configuration.

nmap -sF [target IP address]

IDLE

The IDLE scan, also known as the Zombie scan, is an advanced and stealthy TCP scanning technique used in network reconnaissance. It allows an attacker to scan a target system without direct interaction, using an intermediary host (the "zombie") to conceal their identity and evade detection. 

The attacker sends specially crafted TCP SYN packets to the target ports on the target system.

These packets have the source IP address spoofed to appear as if they originate from the zombie host.

Open ports may cause the IP ID sequence to increment, indicating that the target system responded with SYN-ACK packets.

Closed ports may not cause any change in the IP ID sequence, indicating that the target system did not respond.

Filtered ports may cause the IP ID sequence to increment or decrement unpredictably, depending on the behavior of the filtering device.

SYN—Synchronize. Initiates a connection between hosts.

ACK—Acknowledge. Established connection between hosts.

PSH—Push. System is forwarding buffered data.

URG—Urgent. Data in packets must be processed quickly.

FIN—Finish. No more transmissions.

RST—Reset. Resets the connection

Anonymizers

Anonymizers are services or tools designed to enhance online privacy and anonymity by routing internet traffic through intermediary servers. They work by obscuring the identity and location of users accessing the internet.

The first anonymizer software tool was developed by Anonymizer.com; it was created in 1997 by Lance Cottrell.

Anonymizers act as intermediary servers between a user's device and the websites or online services they wish to access. When a user sends a request to access a website or online resource, the request is first routed through the anonymizer server.

The anonymizer server forwards the user's request to the target website, but it does so using its own IP address instead of the user's. This effectively hides the user's real IP address from the target website, making it difficult for the website to track the user's location or identify them personally.

When the target website responds to the user's request, the anonymizer server receives the response on behalf of the user.The anonymizer then forwards the response back to the user's device, completing the communication cycle.

To visit a website anonymously, the hacker enters the website address into the anonymizer software, and the anonymizer software makes the request to the selected site. All requests and web pages are relayed through the anonymizer site, making it difficult to track the actual requester of the webpage.

HTTP Tunneling Techniques

HTTP tunneling techniques involve encapsulating non-HTTP protocol traffic within HTTP packets, allowing it to pass through firewalls and other network security measures that may only permit HTTP traffic. 

This technique is commonly used to bypass restrictions and access resources that would otherwise be blocked

It is a popular method of bypassing a firewall or IDS is to tunnel a blocked protocol (such as SMTP) through an allowed protocol (such as HTTP)

Almost all IDS and firewalls act as a proxy between a client’s PC and the Internet and pass only the traffic defined as being allowed.

HTTP proxy tunneling involves establishing an HTTP connection to an external proxy server that supports tunneling.

Once the connection is established, non-HTTP protocol traffic, such as FTP or SSH, is encapsulated within HTTP requests and responses.

The proxy server forwards the encapsulated traffic to its destination, allowing it to bypass firewall restrictions.

Most companies allow only HTTP traffic because it’s usually benign web access. However, a hacker using a HTTP tunneling tool can subvert the proxy by hiding potentially destructive protocols, such as IM or chat, within an innocent-looking protocol packet. 

HTTPort, Tunneld, and BackStealth are all tools to tunnel traffic though HTTP.

IP Spoofing Techniques,

A hacker can spoof an IP address when scanning target systems to minimize the chance of detection.

IP spoofing is a technique used to forge the source IP address of packets to conceal the sender's identity or impersonate another entity. While it has legitimate uses, such as in certain network testing scenarios, it is commonly associated with malicious activities like DDoS attacks, session hijacking, and network reconnaissance. 

IP source routing allows the sender to specify the route that a packet should take through the network.

Attackers can manipulate the source routing options in packet headers to route packets through intermediary hosts or bypass network security measures.

Source routing uses a reply address in the IP header to return the packet to a spoofed address instead of the attacker’s real address. 

To detect IP address spoofing, you can compare the time to live (TTL) values: The attacker’s TTL will be different from the spoofed address’s real TTL.

One drawback of spoofing an IP address is that a TCP session can’t be successfully completed.

SNMP Enumeration, Steps Involved in Enumeration

Enumeration occurs after scanning and is the process of gathering and compiling usernames, machine names, network resources, shares, and services. It also refers to actively querying or connecting to a target system to acquire this information

The objective of enumeration is to identify a user account or system account for potential use in hacking the target system. It isn’t necessary to find a system administrator account, because most account privileges can be escalated to allow the account more access than was previously granted. 

SNMP (Simple Network Management Protocol) enumeration is a process used by network administrators or attackers to gather information about devices on a network that support SNMP. SNMP is commonly used for monitoring and managing network devices, such as routers, switches, servers, and printers. SNMP enumeration involves querying SNMP-enabled devices to retrieve information about their configuration, status, and performance metrics

COUNTERMEASURES

The simplest way to prevent SNMP enumeration is to remove the SNMP agent on the potential

target systems or turn off the SNMP service. 

If shutting off SNMP isn’t an option, then change the default read and read/write community names.

In addition, an administrator can implement the Group Policy security option Additional

Restrictions For Anonymous Connections, which restricts SNMP connections.