Network Discovery
Network Discovery
Network discovery is a critical phase in penetration testing that involves identifying hosts, open ports, services, and operating systems within a target network.
Host and Port Scanning
After determining that a host is online, we need to gather detailed information:
Open ports and their services
Service versions
Operating system details
Port State Responses
When probing ports with Nmap, six possible response states can be identified:
State
Description
open
Connection to the scanned port has been established. These can be TCP connections, UDP datagrams, or SCTP associations.
closed
The TCP protocol indicates that the packet received contains an RST flag. This scanning method can also determine if a target is alive.
filtered
Nmap cannot identify whether the port is open or closed because either no response is returned or an error code is received from the target.
unfiltered
This state only occurs during TCP-ACK scans and means that the port is accessible, but it cannot be determined whether it is open or closed.
open|filtered
No response for a specific port leads to this state. This indicates that a firewall or packet filter may protect the port.
closed|filtered
This state only occurs in IP ID idle scans and indicates that it's impossible to determine if the scanned port is closed or filtered by a firewall.
Scan Types
Different scan types serve various purposes during network discovery:
-sS
SYN Scan: Sends only one SYN-flagged packet and does not complete the full TCP handshake. Requires sudo privileges
-sT
TCP Connect Scan: Completes the full three-way TCP handshake.
-sU
UDP Scan: Tests UDP ports which often host important services like DNS, SNMP, and DHCP.
-sV
Service Version Scan: Identifies the version of services running on open ports.
-sA
ACK Scan: Sends only ACK-flagged packets, useful for mapping firewall rules.
Scan Parameters
Optimize your scans with these parameters:
--disable-arp-ping
Disables the default ARP ping, useful in complex networks.
-n
Disables DNS resolution, speeding up scans.
--packet-trace
Shows all packets sent and received, valuable for debugging.
--reason
Displays the reason why Nmap made a particular determination.
-Pn
Disables host discovery (ICMP Echo Requests), treating all hosts as online.
-p-
Scans all 65535 ports.
--stats-every=5s
Checks and shows scan status every 5 seconds.
-v
Increases verbosity for more detailed output.
-A
Enables aggressive scanning: OS detection, version detection, script scanning, and traceroute.
Example Scans
Basic Port Scan with Service Detection
Output:
Recommended Scanning Strategy
Initial reconnaissance: Broad scan to identify live hosts
Quick service enumeration: Scan common ports of discovered hosts
Thorough enumeration: Full port scan with service detection
Targeted scanning: Focus on specific services with specialized scripts
OS detection: Identify operating systems
By following a structured approach to network discovery, you can efficiently map a target environment and identify potential entry points for further testing.
Last updated