Hey everybody! So in this video, in addition to wireshark and looking at packets,
we're going to take a look at nmap and how some of those scans work at the packet level. Now I know
if you're like me, if you're studying for any certifications... right now i'm going for a couple
of cyber security certifications and nmap switches are a big thing to remember. So something that's
helped me is analyzing how those scans work at the packet level. So I thought I would start out with
the stealth scan and show you how that's different than the full tcp connect scan. Hopefully this
helps you get a better understanding of those nmap commands and how they will be useful when
you're enumerating networks. So get out nmap and wireshark and let's go ahead and get to it.
All right so first let's break down how an nmap stealth scan works so here on my kali linux box
I've got a terminal on the left and that's where I have nmap. And on the right i've got my wireshark
there. I'm going to go ahead and capture what these scans look like, take a deeper look at what
is actually going on in the wire. All right so let's go ahead and first generate just a simple
stealth scan. Now some scans in nmap do require admin privileges, so I'm just gonna do "sudo nmap"
and that's where I got my scan type is stealth. That's how i remember it's like scan stealth
-sS. All right and then i'm gonna just throw in my target and let's go ahead and let this fly.
All right so this target has a lot of different ports opening on it so what i'm going to do is to
actually capture this go ahead and do this again. I'm going to capture this but this time I'm just
going to add a port value. All right so let's just say port 80 because that's open. Okay I'm going to
come over here to wireshark. Let's go ahead and start this guy up and i'm going to go ahead and
run that scan. All right so I'm just going to go over here and stop. So to take a look at what this
looks like in Wireshark, just to blow this up a little bit for you, now again this was our
stealth scan, so all right. Our ARPs went ahead and went over. So I go ahead and send out that SYN
and this port is open and available on that server. So it responds with a SYN/ACK and come over here
and that just took about a millisecond or so, and then after that what I would normally expect to
see is I would expect to see the last packet of the three-way handshake - the final ACK SYN, SYN/ACK,
ACK. Now here instead of seeing that I actually see a reset from the device that's doing the nmap
scan. Now why would it do that? You see if i send acknowledgement, what that means is I'm telling
the other link partner - "okay let's go ahead and establish state let's go from our tcp listening
state to an actually open state where we can begin to use data on this connection". But in this case I
don't want to do that. Basically what I'm doing is I'm knocking on the door, I'm waiting to hear
a response, and then I run away. Thank you, now I know you're open, I'm out of here. Don't worry about
officially and formally connecting with me. So what this does is it makes it to where that server is
not bothered with establishing a true connection because it never gets an ACK from me and on my end
I never actually fully initiate the tcp connection, and because i'm sending a reset i'm done with it.
So that's why it's called a stealth scan it's like we're knocking on the door and then we're getting
out. Okay so hopefully that helps you remember how that stealth scan looks on the wire. Now one other
thing that i'd like to mention about the stealth scan is that this is nmap generated itself and it
requires raw packet privileges of the system. But let me show you why I say that. If you take a look
at the SYN just something i want you to notice about the difference between this scan and the
one that we're about to go into the full connect, if you come here now notice down in the tcp header,
if you take a look i'm just going to collapse ip come down to tcp and if you take a look at the
tcp options, notice here that the only option that i have in this TCP SYN is this MSS value of 1460.
And also my window size is only 1024. Now if you've seen any of my videos or if you've done
any tcp analysis yourself this is actually pretty weird these days. Usually you see
a SACK option, you might even see a time stamp or you'll see a window scale factor. In the
handshake so right here this SYN is basically nmap generated this is not intended to be a full
connection that an application would use, this was just a quick test run by nmap just to see if that
port is available on tcp. So let's go ahead and contrast that by what we see with the full connect
scan. So let's go ahead and come over here to our command and we're just going to just hit up arrow
and instead of -sS i'm going to type in and what is it everybody what's the full connect scan switch.
Well instead of -sS, it's -sT. alright so st, and i'm going to leave that port
value of 80 and then that same target. So let's come over here let's go ahead and capture this.
But I like you remember what we see here, we only see that mss okay, so let's go ahead and start our
capture again, continue without saving, let's come in here, and just i'm going to run that full scan.
Okay going to come over here and I'm going to stop it. So first of all, if I take a look at the first
SYN, there now notice that this is a little bit different than what we saw before. First of all
our window size is actually a useful tcp window not 1024 bytes which is so small we can hardly
use it from the stealth scan, this full syn scan is actually run by the operating system
stack itself. So nmap actually passes the connect command to the operating system stack it says hey!
We want to actually initiate a full tcp connection here not just a little ping
if you will, but we want to actually initiate a connection that could be used if we wanted to.
So that's why we see here we see a full or a window that's actually useful and if i come down
here check out my tcp options i've got 1460. I've got SACK, permitted time stamps, window scale, all
that stuff is useful things that we're typically going to see in a tcp handshake. If we take a look
at our SYN/ACK, we see the same here. We see the different options. That final ACK and now we have
a true tcp connection that was established between the actual operating systems that were involved.
So that's an absolute full connect scan. So we can see that that's pretty different isn't it?
Now since nmap doesn't actually want to use that connection to send any data that's why we see that
reset after this that reset goes off and we say "Hey never mind, I just established this handshake
but let's go ahead and shut this down and move on with our lives". Now you might be thinking - why
don't we just do this tcp full connect every time? Well remember that it's possible on the receiving
device, it's possible that this connection attempt could be logged possible depending on the device.
It might say "oh there was a connection attempt and it'll log it so that's why the stealth scan if
we don't want that log to happen that's why we're going to do that half open, SYN, SYN/ACK, reset thing
because it's less likely that that will be logged. Just something to consider when we're trying to
decide between those two scans. Okay so I hope this gave you a bit more practice and some better
understanding about how those switches work in nmap. We looked at the stealth scan and the tcp
full connect scan, how they look in wireshark and why we might use one or the other. Thanks
for sticking with me on this learning journey and i'm definitely going to be posting more videos
about how nmap works in the future. I'll leave you take care and i'll see you in another video!