> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/network-pentesting/port-scanning.md).

# Port scanning

Nmap is a network port scanner, it's my favorite tools when it comes to port scanning.

Nmap can also be used to detect and exploit vulnerabilities thanks to the huge number of build-in scripts. In this section we will focus on the post popular switches for port scanning. 

* Scan all TCP ports of specific host with the nmap default scripts. the `-p-` lets you scan All 65,535 TCP ports while `-p` scans lets you scan a specific port. If you don't specify `-p-`, nmap will only scan the most common ports but will not scan all TPC ports. The `-d` switch shows the debug information's. 

```
nmap –sC 192.168.1.120 -d -p-
```

* Scan a specific UDP port.

```
nmap -p U:53 192.168.1.120
```

* Scan all TCP and UDP ports.

<pre><code><strong>nmap -p- -sA -sU -sV 192.168.1.120
</strong></code></pre>

* Perform an Agressive scan on all ports, this options makes a lot of noises on the network and is not my favorite one. The `-A` switch  enables additional advanced and aggressive options. Presently this enables OS detection (`-O`), version scanning (`-sV`), script scanning (`-sC`) and traceroute (`--traceroute`).  The `-oA scan --webxml` allows you to export the scan results to all formats including the webxml.

```
nmap -p- -A 192.168.1.120 -oA <outputFileName> --webxml
```

* Nmap does not offer the possibility to output the results directly to an HTML page, but it's possible to use `XSLT` to convert an Nmap XML file to an HTML file.

```
xsltproc -o <OutputFileName.html> /usr/share/nmap/nmap.xsl <nmapScan.xml>
```

### Scan ports locally using Living Of The lands tools (Powershell) in Windows

```bash
# Check if TCP ports 1 to 1024 are open on srvfs01
foreach ($port in 1..1024) {
    If (($a=Test-NetConnection srvfs01 -Port $port -WarningAction SilentlyContinue).tcpTestSucceeded -eq $true) {
        "TCP port $port is open!"
    }
}

# Get local TCP connections on port 5000 along with the process name
Get-NetTCPConnection | where Localport -eq 5000 | Select-Object Localport,@{'Name' = 'ProcessName';'Expression'={(Get-Process -Id $_.OwningProcess).Name}}
```

#### ICMP and Network Scanning

```bash
# Send an ICMP request with type 8
l send {ip(daddr=192.168.0.7)+icmp(type=8,code=0)}

# Start capturing all traffic from the eth0 NIC using tcpdump
sudo tcpdump -i eth0

# Send ICMP packets with TTL values incremented from 5 to 10 using hping
foreach i [list 5 6 7 8 9 10] {
    hping send "ip(daddr=192.168.0.7,ttl=$i)+icmp(type=8,code=0)"
}

# Capture and display ICMP packets with verbose output using tcpdump
tcpdump -i eth0 -x -vv | grep ICMP

# Send content of attack.sig file from port 500 to 139 using hping3
sudo hping3 -2 -p 500 192.168.0.7 -d 139 -E attack.sig

# Display tcpdump output of the previous hping3 command with -nX option
sudo tcpdump --i eth0 --nX

# Scan the target for open services and ports using hping3
sudo hping3 --scan known 192.168.0.7 -S

# Scan a range of ports (0-3000) on the target IP address
sudo hping3 --scan '0-3000' 192.168.0.7 -S
```

#### ICMP File Transfer

```bash
# Listen for incoming ICMP packets on localhost
sudo hping3 127.0.0.1 --listen signature --safe --icmp

# Send the contents of /etc/passwd to localhost using ICMP
sudo hping3 127.0.0.1 --icmp -d 100 --sign signature --file /etc/passwd
```

#### OS/Banner Version Fingerprinting

```bash
# Use P0f to passively detect the OS of the target
P0f -i any -p -o /tmp/sniff.log

# Nmap command to perform active OS fingerprinting on a target
nmap -sV --script=banner 192.28.52. 

# Dmitry command to show banner grab of a server and scan for open ports
dmitry -pb 192.168.0.22
```

#### Python Script for Banner Grabbing

```bash
#/usr/bin/python
import socket
import sys
import os

def grab_banner(ip_address, port):
    try:
        s = socket.socket()
        s.connect((ip_address, port))
        banner = s.recv(1024)
        print(ip_address + ':' + banner.decode('utf-8'))
    except:
        return

def checkVulns(banner):
    if len(sys.argv) >= 2:
        filename = sys.argv[1]
        for line in filename.readlines():
            line = line.strip('\n')
            if banner in line:
                print("%s is vulnerable" % banner)
            else:
                print("%s is not vulnerable" % banner)

def main():
    portList = [21, 22, 25, 80, 110]
    for x in range(0, 255):
        for port in portList:
            ip_address = '192.168.0.' + str(x)  # change the IP address to the one you want here
            grab_banner(ip_address, port)

if __name__ == '__main__':
    main()


```

<br>