‫TCP scan, also known as TCP Connect Scan, is the default TCP scan type when Sin Scan is not an option.
‫Well, when is this is again, not an option?
‫Do you remember the trip of data packet on a DNS query in that lecture?
‫I said that layer three and layer four packets are managed by the operating system of your device.
‫That means user does not interfere with the TCP three way handshake.
‫The whole process is managed by the operating system itself.
‫In a sense, can we interrupt the three way handshake and don't send the last act packet to complete
‫the handshake?
‫You have to be a privileged user to be able to interrupt the handshake if you're not a privileged user.
‫You cannot interrupt.
‫Three way handshake and cannot perform a sin scan as well.
‫So instead of writing raw packets as most other scan types do, which needs admin privilege and map,
‫asks the underlying operating system to establish a connection with a target machine in port by issuing
‫the native connect system call.
‫So you don't need to be a privileged user to perform TCP Connect scans.
‫When since scan is available, it is usually a better choice and Map has less control over the high
‫level connect call than with raw packets making it less efficient.
‫The system call completes connections to open target ports rather than performing the half open reset
‫that since scanned does.
‫Not only does this take longer and require more packets to obtain the same information, but target
‫machines are more likely to log the connection not to stealthy.
‫The steps of TCP connection scan is exactly the same as DHCP three way handshake.
‫You send the send packet to open a real connection and then wait for a response.
‫A sinek response indicates the port is listening or open while a wrist reset is indicative of a non
‫listener.
‫If no response is received after several Re transmissions or an ICMP unreachable errors received, the
‫port is marked as filtered.
‫If you receive a snack from the target system, you send an egg packet to complete the three way handshake.
‫Since we have nothing to say at the moment, we send risk to end the conversation.
‫Let's see what happens under the hood when we perform a TCP scam and then compare the sins scan with
‫a TCP scan.
‫Let's perform an end map TCP scan in our virtual network first.
‫Go to Carly and open a terminal, scream.
‫I want to scan my Metasploit voidable system.
‫So let's check if the host is up first.
‫I know the IP address of my Metasploit voidable VM, so type ping one seven two one six nine nine two
‫zero six and hit enter.
‫OK, we received response packets.
‫The system is up.
‫Let's create the TCP scan command and map is the command itself as uppercase T is TCP scan.
‫MN is to avoid the DNS resolution, I'd like to see the IP addresses uppercase pen is to avoid the host
‫discovery.
‫I already know that the host is up, although you should make it a habit to use pen while you're scanning
‫a single system.
‫Now we have the target IP address one seven two one six nine nine two zero six.
‫And let's keep it fast scan for the top ten ports only.
‫I use top ports parameter for this purpose and hit enter.
‫Here are the states of the top 10 ports of Metasploit.
‫About seven ports are open and three ports are closed.
‫OK, let's open Wireshark and see what's happening when a TCP scan is performed.
‫So you got to run Wireshark first.
‫Double click eth0 start to listen to that interface.
‫The skip the packets, which we are not interested in.
‫I had a filter.
‫I only want to see the traffic for my destination computer one seven two one six nine nine two zero
‫six And I want to see the TCP traffic only.
‫Click the Blue Arrow next to the filter bar to activate the filter.
‫To clear the package, we've already caught a restart Wireshark packet capturing.
‫OK, now go to the terminal, scream.
‫I'd like to analyze the TCP scan package for an open port first.
‫I'm going to run the latest and map query again, but this time I run the query for Port 80 only.
‫Hit, enter and run the map query.
‫Yes, the port is open, as I remember.
‫It's good to know I'm not losing my memory.
‫Go back to Wireshark.
‫I want to stop Wireshark by clicking the Red Square at the upper left corner to avoid unwanted packet.
‫Now here we have three packets.
‫The first packet is a sin packet to start the three way handshake.
‫It's from an arbitrary port of call to the 80th board of Metasploit, the destination system.
‫Second packet is a sin accent by the destination system.
‫The third packet is a nack sent by Collie to complete the TCP three way handshake, and the fourth packet
‫is a receipt sent by Collie again to end the conversation.
‫This time I want to scan a closed port, for example, Port 81, before running the query I restart
‫the Wireshark packet, capturing to clean it screen by clicking the blue button in the upper left corner.
‫In the terminal screen, I hit enter to run the query, as you see Port 81 is closed.
‫Now let's look at the Wireshark interface to see what happened when we scan a closed port.
‫The first packet is, again, a sin packet to start the three way handshake the sewer system is clearly
‫in the destination system is Metasploit.
‫The second packet is for this scan a wrist pack because Port 81 is closed, the destination system send
‫us a receipt packet.
‫So here we have a comparison between sin scan packets and TCP scan packets for an open port.
‫Incense scan and map has corrupted the three way handshake by respect.
‫And TCP scan, on the other hand, the three way handshake is completed and the communication is established.
‫So let's see the differences between the since scan and the TCP scan and a table that we've only really
‫talked about up to now, three way handshake is not completed Ensign scan while it's completed in TCP
‫scan.
‫A risk packet is sent when a snack is received and since scan, while an act packet is sent in TCP scan.
‫Target machines are more likely to log the connection when the connection is established in TCP scan
‫no log for since scans because three way handshake is not established because the native operating system
‫call is interrupted.
‫Since scan has to be run by a privilege user, TCP scan uses the system call so it does not need extra
‫privileges.