CMU6XX

Ethical Hacking

Session 3: Scanning & Enumeration

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct TCP/UDP network communication for port scanning.
  • Analyze the mechanisms of Nmap (TCP Connect vs SYN Stealth scans).
  • Automate vulnerability discovery using the Nmap Scripting Engine (NSE).
  • Perform deep enumeration of specific protocols (SMB, SNMP).
  • Identify misconfigurations leading to unauthorized data exposure.

Seminar Structure (3 Hours)

Part 1: Network Scanning (1.5 hrs)
  • The TCP Three-Way Handshake
  • Port Scanning with Nmap
  • Task 1: Nmap Scripting Engine (NSE)
Part 2: Deep Enumeration (1.5 hrs)
  • Moving from Port to Service
  • Enumerating SMB and SNMP
  • Task 2: SMB Null Session Exploitation

Part 1: Network Scanning

Duration: 1.5 Hours

The Three-Way Handshake

Port scanning relies on abusing standard network protocol behaviors.

  • Standard Connection:
    1. Client sends SYN.
    2. Server responds SYN-ACK (Port Open).
    3. Client responds ACK (Connection established).
  • TCP Connect Scan (-sT): Completes the full handshake. Highly reliable but noisy; logged by the operating system.

SYN Stealth Scanning (-sS)

The default and preferred method for pentesting. Requires root/admin privileges.

  1. Client sends SYN.
  2. Server responds SYN-ACK (Port Open).
  3. Client responds with RST (Reset) instead of ACK.

Why? The connection is torn down before it is fully established. Historically, this bypassed basic application logging mechanisms, earning the name "stealth." Modern IDSs easily detect this, however.

UDP Scanning (-sU)

UDP is connectionless, making scanning extremely slow and difficult.

  • If you send a UDP packet and receive no response, the port is marked open|filtered. It could be open, or a firewall could have dropped the packet.
  • If you receive an ICMP Port Unreachable error, the port is definitely closed.
  • UDP scanning often requires sending protocol-specific payloads (e.g., an actual DNS query to Port 53) to provoke a response.

Introduction to Task 1

Nmap is not just a port scanner. It contains a full Lua-based scripting engine capable of executing vulnerability checks and automated exploitation.

We will utilize the Nmap Scripting Engine (NSE) to identify vulnerable services.

Task 1: Nmap Scripting Engine (NSE)

Timing: 45 minutes

Using the command line, construct an Nmap command to achieve the following against a mock target IP (e.g., 10.0.0.5):

  1. Perform an aggressive scan (-A) against the top 1000 ports.
  2. Run the vuln script category to automatically check open ports for known CVEs.
  3. Output the results into all three formats (Normal, XML, Grepable) for later parsing.
  4. Review a sample Nmap XML output and identify the version of the SSH daemon running on Port 22.
Practical Resource: Nmap Scripting Engine Documentation

15 Minute Break

Please return promptly for Part 2.

Part 2: Deep Enumeration

Duration: 1.5 Hours

Scanning vs Enumeration

Scanning tells you Port 445 is open. Enumeration tells you exactly what data that port is exposing.

  • Enumeration: Extracting usernames, machine names, network resources, shares, and services from a system.
  • It represents the bridge between Discovery and Exploitation.
  • Requires protocol-specific tools (e.g., enum4linux for SMB, snmpwalk for SNMP).

Server Message Block (SMB)

The core file and printer sharing protocol in Windows environments (Port 445).

  • Historically riddled with vulnerabilities (e.g., MS08-067, EternalBlue).
  • Null Sessions: A legacy feature in Windows allowing an anonymous, unauthenticated connection to the IPC$ (Inter-Process Communication) share.
  • Once a Null Session is established, an attacker can enumerate the entire Active Directory user list and password policies without a password.

Simple Network Management Protocol

Used to monitor and configure network devices (routers, switches) via UDP Port 161.

  • Community Strings: Act as passwords for SNMP. The default string for read access is almost universally public. The default for write access is private.
  • If an attacker finds an exposed SNMP service with the public string, they can extract massive routing tables, ARP caches, and exact OS versions.
  • Mitigation requires SNMPv3 (which enforces encryption and strong authentication).

Introduction to Task 2

Misconfigured SMB shares are the number one vector for lateral movement in internal pentests.

We will simulate connecting to a Windows server via an unauthenticated Null Session.

Task 2: SMB Null Session Exploitation

Timing: 50 minutes

You have identified Port 445 is open on a target Windows Server 2012 machine.

  1. Write the smbclient command syntax required to list the available shares on the target using a Null Session (blank username and password).
  2. Assume you found an open share named BACKUPS. Write the syntax to connect to it.
  3. Discuss the remediation steps a sysadmin must take to disable Null Sessions via Group Policy (GPO).

Summary & Next Steps

  • Port scanning establishes the attack surface; enumeration maps the internal logic of the applications.
  • Legacy protocols (SMBv1, SNMPv1/v2) default to insecurity and rely purely on network perimeter defenses.
Next Week: Vulnerability Analysis (Identifying Weaknesses)