{"id":6890,"date":"2018-12-29T03:01:53","date_gmt":"2018-12-29T03:01:53","guid":{"rendered":"https:\/\/www.appservgrid.com\/paw92\/?p=6890"},"modified":"2018-12-30T04:46:41","modified_gmt":"2018-12-30T04:46:41","slug":"how-to-do-a-port-scan-in-linux-linux-hint","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/12\/29\/how-to-do-a-port-scan-in-linux-linux-hint\/","title":{"rendered":"How to do a Port Scan in Linux \u2013 Linux Hint"},"content":{"rendered":"

Port scanning is a process to check open ports of a PC or a Server. Port scanners are often used by gamers and hackers to check for available ports and to fingerprint services. There are two types of ports to scan for in TCP\/IP Internet Protocol, TCP(Transmission Control Protocol) and UDP(User Datagram Protocol). Both TCP and UDP have their own way of scanning. In this article, we\u2019ll look at how to do port scan in Linux environment but first we\u2019ll take a look at how port scanning works. Note that port scanning is illegal in often countries, make sure to check for permissions before scanning your target.<\/p>\n

TCP Scanning<\/h3>\n

TCP is stateful protocol because it maintains the state of connections. TCP connection involves a three-way handshaking of Server socket and client-side socket. While a server-socket is listening, the client sends a SYN and then Server responds back with SYN-ACK. Client then, sends ACK to complete the handshake for the connection<\/p>\n

\"\"<\/p>\n

To scan for a TCP open port, a scanner sends a SYN packet to the server. If SYN-ACK is sent back, then the port is open. And if server doesn\u2019t complete the handshake and responds with an RST then the port is closed.<\/p>\n

UDP Scanning<\/h3>\n

UDP on the other hand, is a stateless protocol and doesn\u2019t maintain the state of connection. It also doesn\u2019t involve three-way handshake.<\/p>\n

To scan for a UDP port, a UDP scanner sends a UDP packet to the port. If that port is closed, an ICMP packet is generated and sent back to the origin. If this doesn\u2019t happen, that means port is open.<\/p>\n

UDP port scanning is often unreliable because ICMP packets are dropped by firewalls, generating false positives for port scanners.<\/p>\n

Port Scanners<\/h3>\n

Now that we\u2019ve looked at how port scanning works, we can move forward to different port scanners and their functionality.<\/p>\n

Nmap<\/h3>\n

Nmap is the most versatile and comprehensive port scanner available till now. It can do everything from port scanning to fingerprinting Operating systems and vulnerability scanning. Nmap has both CLI and GUI interfaces, the GUI is called Zenmap. It has a lot of varying options to do quick and effective scans. Here\u2019s how to install Nmap in Linux.<\/p>\n

sudo apt-get update
\nsudo apt-get upgrade -y
\nsudo apt-get install nmap -y<\/p>\n

\"\"<\/p>\n

Now we\u2019ll use Nmap to scan a server (hackme.org) for open ports and to list services available on those ports, its really easy. Just type nmap and the server address.<\/p>\n

\"\"<\/p>\n

To scan for UDP ports, include -sU option with sudo because it requires root privileges.<\/p>\n

\"\"<\/p>\n

There are a lot of other options available in Nmap such as:<\/p>\n

-p- : Scan for all 65535 ports
\n-sT : TCP connect scan
\n-O : Scans for operating system running
\n-v : Verbose scan
\n-A : Aggressive scan, scans for everything
\n-T[1-5] : To set the scanning speed
\n-Pn : In case the server blocks ping<\/p>\n

Zenmap<\/h3>\n

Zenmap is a GUI interface of Nmap for click-kiddies so that you won\u2019t have to remember its commands. To install it, type<\/p>\n

sudo apt-get install -y zenmap<\/p>\n

\"\"<\/p>\n

To scan a server, just type its address and select from available scan options.<\/p>\n

\"\"<\/p>\n

Netcat<\/h3>\n

Netcat is a raw TCP and UDP port writer which can also be used as a port scanner. It uses connect scan that\u2019s why it is not so fast like Network Mapper. To install it, type<\/p>\n

ubuntu@ubuntu:~$ sudo apt install netcat-traditional -y<\/p>\n

To check for an open port, write<\/p>\n

ubuntu@ubuntu:~$ nc -z -v hackme.org 80
\n…snip…
\nhackme.org [217.78.1.155] 80 (http) open<\/p>\n

To scan for a range of ports, type<\/p>\n

ubuntu@ubuntu:~$ nc -z -nv 127.0.0.1 20-80
\n(UNKNOWN) [127.0.0.1] 80 (http) open
\n(UNKNOWN) [127.0.0.1] 22 (ssh) open<\/p>\n

Unicornscan<\/h3>\n

Unicornscan is a comprehensive and fast port scanner, built for vulnerability researchers. Unlike Network Mapper, it uses its own User-land Distributed TCP\/IP stack. It has a lot of features that Nmap doesn\u2019t, some of them are given,<\/p>\n