okay so in this video we're going to
talk about some more nmap options
specifically we're going to be talking
about the null scan and the christmas
scan
sure you've seen these but let's make
sure that we understand how they work
and why we would use them so stick
around
all right so you know the deal let's go
ahead and get out nmap and a copy of
wireshark and let's capture what these
scans look like so as you can see here i
have kali linux but i also have a couple
other virtual machines running now one
is a linux server and the other one is a
copy of windows 10. so i'm going to run
these scans against those two different
types of operating systems so not just
to capture them but also to understand
how different operating systems will
respond all right so let's go ahead and
start off with the christmas scan we're
gonna run it toward the server first
let's see what happens gonna go ahead
and come in here now let's think about
what our syntax is gonna be so first is
gonna be sudo but what is the switch
that we're gonna use think christmas
scan scan christmas okay it's going to
be dash s capital x all right so let's
go ahead and punch that in and scan our
server
all right we can see those packets
coming in and wireshark in the
background and we can see that there's a
whole lot of ports that are open on this
server and we found them with that
christmas scan now notice with the
christmas scan it says open
filtered okay let's come over here and
let's actually see what that looks like
or what that means i'm gonna go ahead
and open up wireshark just expand this
out just a little bit for you gonna go
ahead and zoom in just a little bit and
reorient my columns and just get myself
a little bit of screen in real estate
there so in the background first i wanna
notice what is an open port that we have
over here let's go ahead and pick on
port 21 and see what that looks like and
why it showed open
filtered see that's different than like
the syn scan or the connect scan those
just show open but this one says open
filter let's see why all right so if i
come up here i'm just going to do
tcp.port
equals equals 21 and that's going to set
a filter for just conversations on that
port so first let's go ahead and take a
look at this packet so here we can see
that this is a tcp packet we can see in
our info column up here the different
tcp flags that are set all right we have
the thin flag the push flag and an
urgent flag now if we expand that out in
our tcp header we can actually see those
with a little bit more detail but notice
the acknowledgement flag is not set and
that's pretty unusual typically
past the sin in most conversations
you're going to see the acknowledgement
flag so really these are all the extra
flags it's lit up like a christmas tree
and that's why it's called a christmas
scan so basically all the flags except
for some of these other important ones
like sin reset or acknowledgement it's
all the rest of them okay so we send
this packet out and what's the response
well if you notice we didn't get a
response from the server at all we
didn't get a reset
that would indicate that the port is
closed
but we just got nothing so what nmap
sees is no response so that's why it
flags it as open but the thing that it
can't tell is was this packet filtered
by a firewall that simply wasn't
responding that's why it says that it's
possible that this is open but filtered
and that's why we didn't get a response
okay so we can see how this looks when
we pointed this scan to the server now
let's go ahead and point it to the
windows box and see if it's any
different i'm going to go ahead and set
up the scan over here and i'm just going
to come over and go and rerun my trace
file continue without saving and let's
just go ahead and run our scan okay so
it says here the scan results all 1000
scan ports on this device are closed
and we can see the response or at least
to port 21 in the back remember i had
that filter set there for port 21. so we
send out that christmas scan we got a
reset back that means that that port is
closed
now what's interesting about this i'm
just going to go ahead and remove this
filter here and so this was a bit of a
different response that we saw with
windows right but is that because it
just doesn't have any ports open well
let's find out remember that we had a
thousand scan ports and all of them were
listed as closed but let's go ahead and
run a stealth scan against that windows
box and see what happens it's going to
hit up arrow but this time i'm going to
come back over here instead of s x
what's it going to be for a stealth scan
s capital s right stealth scan okay good
job so let's go ahead and
run that scan okay and as you can see in
the background we were still capturing
but notice we have a few open ports here
we have port 135 we have 139 and 445 all
of those ports are open on the windows
box
all right so why would the stealth scan
show some ports open
but the christmas can show nothing open
right this is important to know i'm
going to come over here i'm going to
stop my capture this time let's go ahead
and filter for a port that showed as
open but not open in the christmas scan
all right so i'm just going to say
tcp.port let's go ahead and filter for
135. all right so here we can see that
we have two different behaviors
on the one hand we can see that this
packet comes in this is the christmas
scan and immediately it gets a reset ack
so the windows box is saying nope i'm
not talking on that port but with a sin
we can see that the device responds with
a synack so it says yep okay i'm willing
to talk to you we can go ahead and talk
if this is a sin
so what does that tell us well some
operating systems are tuned this way
they're going to respond with a reset
if it looks like something's out of
sorts which really the christmas scan is
just that it's not normal
usually you wouldn't see normal healthy
tcp packets that look like this so the
windows box is designed to say you know
i'm not going to participate in this
conversation something looks funny here
while the cell scan worked it did
confirm that there was an open port so
as you can see some operating systems
will respond with a reset and others
will not okay so that was the christmas
scan let's go ahead and take a look at
the null scan and see how that's
different okay so i'm going to go ahead
and restart my capture
and say continue without saving
and let's come over and let's just clear
out our
terminal
all right so now we're going to do the
null scan so let's just go ahead and do
sudo and map and this time we're going
to go ahead and do the null scan and
anyone remember what that switch is dash
s and capital n all right nice job all
right okay so we're going to do 192 168
and fired off to the server so here's
our results it's really the same list as
we saw with the christmas scan at least
toward the server let's go ahead and see
why it's called a null scan all right so
we're going to come over here we're
going to stop our capture and let's go
ahead and set that filter for tcp port
21. okay so let's examine what this
packet looks like i'm just going to
click it and we can see in the info
sneak peek that we have none no flags
are set if we come down here into the
tcp
we have flags of none and look at that
all of the bits in the flags area of the
header are zero
so again
very rare this wouldn't be usually there
in a normal healthy tcp
conversation okay just a little side
note something that we can do here we
can always just say right click on flags
we can go prepare as filter selected and
check us out now we have a filter for a
null packet that's a nice one to save if
we have a security profile so i'm just
going to say tcp
null
scan so now i have a filter i don't have
to remember that flags parameter now i
can come up here and i can hit tcp null
scan and i go ahead and set that so i
can find these types of scans so we can
see how these scans work the christmas
scan the null scan we just captured and
saw those and really we can even further
manipulate the headers to adjust certain
flags now it really just depends on the
operating system on how it will respond
but why would we use these scans in the
first place why wouldn't we just use a
sin scan all the time well if we just
peek at the nmap site right away it says
the key advantage of these scan types is
they can sneak through certain
non-stateful firewalls and packet
filtering routers okay so what that
means is basically along the path or
even at the end point those devices may
be expecting a sin
to start a tcp conversation so when they
see a packet that comes and it doesn't
have a sin bit checked it's possible
that they might pass it through now keep
in mind a lot of times operating systems
and ips ids systems are designed these
days to watch for this so it's really
not as stealth as it used to be however
it is interesting to be able to see how
a device would respond right away we
were able to tell that some operating
systems will respond a certain way to
these scans and others won't it's also
possible that an operating system might
not log this
right so if we hit it with a sin it
might go oh there was a sin attempt here
but if we hit it with a null scan or a
christmas scan or that type of scan it's
possible that it won't log that
connection so keep on practicing by
capturing those nap scans with wireshark
and understanding more about how they
work and why we would use them thanks
for stopping by the channel i'll see you
again on another video
[Music]
you