‫Active scanning is done through sending multiple probe requests and recording the probe responses because
‫passive scanners are limited to looking at existing traffic they suffer in terms of overall completeness
‫and accuracy.
‫For example, a passive scanner can't detect an application that no one ever uses, and it can be fooled
‫easily by a system intentionally spewing out misinformation and disinformation.
‫The all seen on the slide are a few examples of active scanning tools in this course we will examine
‫the end map and Nessus tools in detail.
‫HP is next on command.
‫Mine oriented TCP IP packet assembler analyzer.
‫The interface is inspired by the Ping eight Unix command, but each ping isn't only able to send ICMP
‫echo requests.
‫It supports TCP, UDP, ICMP and IP protocols as a traceroute mode, the ability to send files between
‫a covered channel and many other features.
‫So a subset of the stuff you can do using age being.
‫Firewall testing, advanced port scanning, network testing, using different protocols, deoxy fragmentation.
‫Manual performed to you, Discovery advanced trace route under all the supported protocol, remote OS
‫fingerprinting.
‫Remote uptime guessing.
‫And don't forget, TCP IP stacks auditing.
‫HPN can also be useful to students that are learning TCP IP, although it's a packet analyzer tool,
‫it's widely used for deoxy denial of service tests and attacks to create IP spoofed packets and send
‫them to the target system.
‫Let's see how we can use the ping command to scan the network, simply go to Cali and open a terminal
‫screen.
‫Being three is embedded into collee and defined in the path so you can use it anywhere.
‫Just typing the name of the command, paying three.
‫Type HPN three Dash H or H being three dash help to see the detailed usage of the Ping three command.
‫Let's look at a few parameters important for scanning mode.
‫Under the Mode title, we have a scan mode and the help shows a sample usage of the motor as well,
‫we'll use scan or eight parameter to use each ping and scan mode.
‫Under TCP UDP title, we have the parameters to set the flags of TCP or UDP packet.
‫Well, you'll see the flags and meaning in this course in following lectures.
‫So just see the thing in action now.
‫For example, uppercase s or sin parameter is used to set the sin flag of TCP or UDP packet.
‫Let's prepare the command to make a network scan, the first parameter is scan to use and scan mode.
‫Here, we should say, in which ports we will scan in this example, zero to 500 means that the ports
‫between zero and 500 will be scanned.
‫You can give a port range like this with a dash between the lower bound in the upper bound, or you
‫can give the ports one by one, separating them by a comma, or you can use a combination of these two.
‫Now I want to set the scene flag of the pack, because all TCP connections start with a simple packet.
‫Well, again, we'll show you how a TCP handshake is made later on in the following lecture's.
‫Here comes the IP address to scan, hit, enter to start the scan.
‫Here we have the responding ports and the flags column says what the reply is, we sent send packets
‫and get sent backpacked.
‫That means ports are accessible and open to us.
‫Now, let's make another scan.
‫This time, I'll use upper case X to make a Christmas scan in the scan, push urgent and Fynn flags
‫are set in the packet, which is not seen in regular traffic.
‫Sensitive packets they receive are not valid packets, they've dropped them.
‫And returned, no response.
‫Although it's not the subject of our cause because it's very common usage, I'd like to show you how
‫to perform an IP spoofed Deacy or denial of service attack using the Bing tool.
‫Going to attack my own server first, I'll test if I can connect to the application.
‫So open a terminal screen and ping the application that was a dot com.
‫OK, I have a connection through the application.
‫Open a browser and visit the Web site.
‫Here I click a few links to show the response time of the server.
‫Well, it's really fast, it responds as soon as I click onto links.
‫Now, let's prepare the command to prepare a deoxy attack.
‫The first parameter, the command is Dasch Flood.
‫You know what, let's run each paying three dash help in another terminal screen to see the meanings
‫of the parameters.
‫Flood parameter is used to send packets as fast as possible.
‫To make it a sin flood attack, I said the sin flag using that parameter when I send the sin packet,
‫since it's a legitimate TCP handshake starter.
‫The server will try to respond to all the packets at the start of the TCP communication.
‫So the server will be very, very busy.
‫Dash V is the open, verbose mode that means we'd like to see the results have sent packets.
‫The next parameter is rand sauce, this parameter will randomize the sauce IP addresses as if they are
‫requested by different systems.
‫So the attack is distributed denial of service now.
‫And since the IP addresses are random, the victim doesn't know about you.
‫You have the target domain is the last parameter.
‫Oh, by the way, the order of the parameters is not important.
‫It enter to start the attack.
‫Now, because we're in flood mode, no reply to show, let's try to click a few links to see the response
‫time of the server while it's under attack.
‫Click a link.
‫It's waiting, waiting, waiting is obviously so down, maybe our request will be timed.
‫So this is how a simple denial of service attack is before.
‫I'll stop the flood by stopping the run of the command using control psyche's.
‫As you see in less than a minute, we sent more than a million Synn packets to the victim server, no
‫package received because we randomize the source IP addresses of the packet.
‫That means the responses were sent to different IP addresses.
‫This is why we didn't receive any packets since I stopped sending packets.
‫The server is now responding in good time again.
‫Now, let's repeat the attack while Wireshark is running to see what's happening under the hood.
‫Start Wireshark, since we're using the ethe zero interface of Colly, I'll double click the e0 on the
‫home screen to start to listen to the traffic passing through the user interface.
‫There's still some packets on the queue.
‫Because of our previous attack, I restart capturing by pressing the green button at the upper left
‫corner of Wireshark to clean the screen before the second attack.
‫Continue without saving, OK, Wireshark is running and clean.
‫We're ready to repeat the attack.
‫You can see the number of packets at the bottom of Wireshark, as you see, we sent hundreds of thousands
‫of packets in seconds.