1
00:00:00,060 --> 00:00:04,380
‫Well, what do open, closed or filtered actually means?

2
00:00:04,410 --> 00:00:10,290
‫Let's take a closer look at the results of unmap when A sends packets to a port and receives a positive

3
00:00:10,290 --> 00:00:10,830
‫response.

4
00:00:11,280 --> 00:00:17,760
‫The port is assigned the state of open, for example, since Gane receives a Sinak from the destination

5
00:00:17,760 --> 00:00:19,320
‫system if the port is open.

6
00:00:20,540 --> 00:00:26,960
‫If Unmap determines that a port is not available, it assigns it the closed state, this signifies it,

7
00:00:26,960 --> 00:00:31,490
‫and MAP has received a result that clearly shows that the port is closed.

8
00:00:32,150 --> 00:00:37,910
‫A sin scan receiving a receipt in response to a port query is an example of a closed port.

9
00:00:39,020 --> 00:00:44,990
‫Filtered ports are the result of a packet filter or firewall when no response at all is received from

10
00:00:44,990 --> 00:00:45,860
‫the remote device.

11
00:00:46,720 --> 00:00:48,260
‫The port is considered to be filtered.

12
00:00:49,340 --> 00:00:56,120
‫A response isn't received from the port and map of an retries communication to the port to ensure that

13
00:00:56,120 --> 00:01:00,110
‫the packet wasn't simply dropped due to error or congestion.

14
00:01:00,920 --> 00:01:04,820
‫Please note that this type of response is categorized differently.

15
00:01:05,150 --> 00:01:12,800
‫If this is a different scan type, such as a UDP scan or a fin scan, the next result, open filter

16
00:01:12,800 --> 00:01:13,630
‫is coming in a minute.

17
00:01:14,090 --> 00:01:19,520
‫On the other hand, if the destination systems return, an unexpected response.

18
00:01:19,940 --> 00:01:21,860
‫Again, the port is considered to be filtered.

19
00:01:22,970 --> 00:01:28,450
‫If we get an ICMP unreachable response in a sense scan, the port is flagged as filtered.

20
00:01:29,090 --> 00:01:34,760
‫Now, in some cases, the lack of a response may not necessarily mean that a port is filtered.

21
00:01:35,450 --> 00:01:42,320
‫Lack of a response might mean that the port might also be open now in these situations, and map signifies

22
00:01:42,320 --> 00:01:47,240
‫that the port is either filtered or open, for example, in a UDP connection.

23
00:01:47,240 --> 00:01:53,470
‫In most cases, the destination system does not send a response when it receives a UDP packet.

24
00:01:54,380 --> 00:02:01,220
‫So if the destination system does not respond and map categorizes it as open, filtered makes sense.

25
00:02:02,330 --> 00:02:06,470
‫In this slide, you see some of the most known default ports.

26
00:02:07,440 --> 00:02:12,880
‫So here's a question, if the Port 22 is open, is the service running there?

27
00:02:12,900 --> 00:02:13,710
‫Absolutely.

28
00:02:13,710 --> 00:02:16,440
‫And S.H., could there be another service?

29
00:02:17,370 --> 00:02:20,490
‫Well, these are the default port numbers of the services.

30
00:02:20,850 --> 00:02:23,180
‫You can run any service in any port.

31
00:02:23,940 --> 00:02:27,480
‫You can run HTP on board 22, for example.

32
00:02:28,050 --> 00:02:31,620
‫But for the ease of use, the default ports are used in general.

33
00:02:31,920 --> 00:02:37,320
‫So if you're performing a test, you should probably look at the well-known ports first, but you should

34
00:02:37,320 --> 00:02:39,270
‫never just scan the default ports.

35
00:02:40,670 --> 00:02:42,890
‫There are different ways to scan ports within map.

36
00:02:43,810 --> 00:02:45,340
‫Let's see how we can scan ports.

37
00:02:46,430 --> 00:02:52,430
‫Let's prepare a second scan for him, Métis portable device, the IP address of my meds voidable is

38
00:02:52,430 --> 00:02:56,120
‫one seven two one six eight nine nine two zero six.

39
00:02:57,240 --> 00:03:04,050
‫If you do not use any one of the port scanning parameters, top 1000 ports are scanned, top ports are

40
00:03:04,050 --> 00:03:05,940
‫the most used ports in general.

41
00:03:07,270 --> 00:03:11,140
‫The first way of choosing the ports to scan is using parameter.

42
00:03:12,160 --> 00:03:14,530
‫After entering the scanned type and target IP.

43
00:03:19,280 --> 00:03:21,560
‫Enter the port numbers with parameter.

44
00:03:22,550 --> 00:03:30,020
‫You can at reports one by one, separated by a comma, or you can give a range of ports by putting a

45
00:03:30,020 --> 00:03:31,870
‫dash between the port numbers.

46
00:03:32,870 --> 00:03:39,980
‫In this example, the ports, 20 to 80 and the ports between 100 and 200 are scanned.

47
00:03:41,670 --> 00:03:46,620
‫If you perform both TCP scan and UDP scan in a single and map query.

48
00:03:47,670 --> 00:03:53,040
‫You can choose both the EDP boards and the TCP boards using parameter.

49
00:03:53,940 --> 00:03:59,940
‫Where they send maps, scan will use both since scan and UDP scan at the same time, we haven't seen

50
00:03:59,940 --> 00:04:04,890
‫it yet, but the UDP scan is performed using s capital you parameter.

51
00:04:05,160 --> 00:04:08,430
‫And as you know, the cities scan is a type of TCP scan.

52
00:04:08,910 --> 00:04:12,210
‫After entering the target IP put Desh P.

53
00:04:13,440 --> 00:04:22,190
‫One or TCP words put uppercase T with a colon just after the parameter P and the T seaports to scan.

54
00:04:23,170 --> 00:04:29,050
‫Sam is giving port numbers directly with parameter, you can enter ports one by one, separated by a

55
00:04:29,050 --> 00:04:33,700
‫comma, or you can give a range of ports by putting a dash between the port numbers.

56
00:04:34,850 --> 00:04:41,870
‫To specify the UDP reports put you as another case, you with a colon and the ports with the same format.

57
00:04:42,930 --> 00:04:51,090
‫For this example, let's scan the TCP ports to an 80 and the UDP ports 53 and the ports between 139

58
00:04:51,090 --> 00:04:51,870
‫and 150.

59
00:04:53,010 --> 00:04:56,760
‫So here are the results, TCP ports first and then UDP ports.

60
00:04:58,320 --> 00:05:04,500
‫Now, the way to specify the ports is using top ports parameter, using this with the number of ports

61
00:05:04,500 --> 00:05:08,810
‫that will be scanned, you can scan the top ports within this parameter.

62
00:05:09,300 --> 00:05:12,120
‫So let's scan top 20 ports for this example.

63
00:05:12,970 --> 00:05:16,330
‫So here are the top results of the most used 20 ports.

64
00:05:17,630 --> 00:05:23,840
‫If you use uppercase F, which means fast scan top 100 ports or scan.

65
00:05:24,790 --> 00:05:29,080
‫So let's perform an end map since scan with a parameter here.

66
00:05:34,030 --> 00:05:40,060
‫And open another terminal screen and perform another and map scan using top ports 100 parameter.

67
00:05:48,040 --> 00:05:52,390
‫As you see, we get the same result because these are the same queries.

68
00:05:54,650 --> 00:05:57,050
‫If you'd like to scan all the parts of the system.

69
00:05:58,250 --> 00:06:03,440
‫Well, you should scan all the ports of the systems and append test, you have to use the parameter

70
00:06:03,440 --> 00:06:06,950
‫with the interval from one to 65, 535.

71
00:06:07,910 --> 00:06:09,980
‫This is a range of possible port numbers.

72
00:06:11,240 --> 00:06:19,370
‫Prepare the maps and scan Creary with the destination IP address now put P one dash six five five three

73
00:06:19,370 --> 00:06:19,790
‫five.

74
00:06:23,590 --> 00:06:24,370
‫And hit enter.

75
00:06:26,620 --> 00:06:28,870
‫Here are all the open ports of medicine voidable.

76
00:06:30,890 --> 00:06:37,130
‫By default and MAP does host Discovery and then performs a port scan against each host it determines

77
00:06:37,130 --> 00:06:37,820
‫is online.

78
00:06:39,050 --> 00:06:46,280
‫If you use P N in the N McCreery, you skip host Discovery and Port, Skåne, all target hosts.

79
00:06:47,200 --> 00:06:53,140
‫Disabling host discovery with poison causes and map to attempt the requested scanning functions against

80
00:06:53,140 --> 00:06:55,200
‫every target IP address specified.

81
00:06:55,840 --> 00:07:03,490
‫So if Class C target address space, that means 24 is specified on the command line, all 255 IP addresses

82
00:07:03,490 --> 00:07:03,970
‫are scanned.

83
00:07:04,960 --> 00:07:06,130
‫Why would we want to do this?

84
00:07:06,370 --> 00:07:13,720
‫As you know, if you were a privileged user and MAP sends four types of packets to discover hosts ICMP

85
00:07:13,720 --> 00:07:17,710
‫Echo Request Send Packet to TCP 443 Port.

86
00:07:18,640 --> 00:07:23,950
‫Backpacked packett to TCP Port and ICMP timestamp request.

87
00:07:25,870 --> 00:07:33,820
‫If a system is configured not to answer to ICMP request and if the ports 80 and 443 are filtered, then

88
00:07:33,820 --> 00:07:37,410
‫that map thinks that the host is down even if it's up.

89
00:07:37,420 --> 00:07:44,320
‫If you find a system which is not found by pings, can always use porn for further port scans otherwise.

90
00:07:44,320 --> 00:07:49,040
‫And MAP doesn't perform the ports scan because it assumes that the host is not up.

91
00:07:49,510 --> 00:07:56,350
‫So if your network is not big or if you don't have enough time to scan, you should skip the ping scan

92
00:07:56,350 --> 00:07:59,290
‫and run the port scans for every possible IP address.

93
00:08:00,280 --> 00:08:06,400
‫Use a sports fan instead of ping scan, if you were scanning a server block, because those systems

94
00:08:06,400 --> 00:08:09,320
‫are configured to be more secure than usual.

95
00:08:10,000 --> 00:08:13,030
‫Then you can find more computers than the ping scans do.

96
00:08:14,100 --> 00:08:14,970
‫You're halfway there.