Name: - Rushikesh Arvind Kharchan
Class: - SY-A-ECE-67
Electronics and Computer Engineering
Roll No. : - SY2467
Subject : - Ethical Hacking (H/M)
Topic: - Network Scanning for Ethical Hacking
Network Scanning In
Ethical Hacking
Network scanning, a core aspect of ethical hacking, involves
systematically probing a network to gather information about active
hosts, open ports, and services. This information helps ethical hackers
assess the network's security posture and identify potential weaknesses
that could be exploited by malicious actors
Objectives of Network
Scanning
• Discover the network's live hosts, IP addresses, and open ports of the live
hosts. Using the open ports, the attacker will determine the best means
of entering into the system.
• Discover the OS and system architecture of the target. This is also known
as fingerprinting. An attacker can formulate an attack strategy based on
the OS's vulnerabilities.
• Discover the services running/listening on the target system. Doing so
gives the attacker an indication of the vulnerabilities (based on the
service) that can be exploited for gaining access to the target system.
• Identify specific applications or versions of a particular service. Identify
vulnerabilities in any of the network systems. This helps an attacker to
compromise the target system or network through various exploits.
Basics of Network Scanning
What is Network Scanning?
Discover hosts, open ports, and running services on a network.
TCP/IP Model
Essential for understanding how scanning interacts with network layers.
Port States
Open, closed, and filtered ports indicate service availability and security.
Objectives
Identify vulnerabilities and assess overall security posture.
TCP Connect Scan
Full TCP Connection
Establishes complete connections on target ports.
Advantages
Reliable and requires no special permissions.
Disadvantages
Highly detectable by firewalls and Intrusion Detection
Systems.
Example Command
Nmap scan: nmap -sT scanme.nmap.org
SYN Scan: Stealthy Port Discovery
Half-Open Scan
Sends SYN packets without completing full TCP handshake.
Pros
Faster and stealthier than TCP Connect scans.
Cons
Requires elevated privileges (root access).
Response Analysis
Uses SYN/ACK or RST to identify port status.
Example Command
Nmap scan: nmap -sS scanme.nmap.org
UDP Scan for Service Discovery
UDP Packet Sending
Sends UDP packets to target ports without handshake.
Benefits
Detects UDP-based services often missed by TCP scans.
Challenges
UDP's nature causes slower, sometimes unreliable scans.
Error Reliance
Uses ICMP port unreachable messages to infer port status.
Example Command
Nmap scan: nmap -sU scanme.nmap.org
Nmap: The Versatile
Scanner
Key Features Advanced
Automation
Host discovery, port, OS,
and version detection. Nmap Scripting Engine
(NSE) for custom scanning
tasks.
Example Usage
Aggressive scan: nmap -A -T4 scanme.nmap.org
Other Essential Scanning Tools
Masscan Nessus OpenVAS Burp Suite
Ultra-fast scanner for large Comprehensive Open source alternative to Web vulnerability scanner
networks. vulnerability scanner with Nessus for vulnerability focusing on application
many plugins. assessments. security.
Role of Scanning in
Penetration Testing
1 Information 2 Vulnerability
Gathering Assessment
Network mapping and Detecting weaknesses and
identifying potential misconfigurations.
targets.
3 Reporting
Documenting findings and recommending remedies.
Ethical Considerations in Network Scanning
Legal Boundaries Scope & Permission Data Handling
Comply with laws like GDPR and CCPA Scan only authorized networks within Protect sensitive information
when scanning. agreed scope. uncovered during scans.
Conclusion and Next Steps
Key Takeaway Continuous Learning Empowerment
Responsible network scanning is Stay updated on tools and Use scanning knowledge to
critical for effective security. evolving techniques. proactively defend networks.
THANK YOU.!!
