Unit 3: Port Scanning 3.3 Activity and Discussion Activity: Connect Scan

ACTIVITY: CONNECT SCAN

This activity is ungraded.

Remember: Watch this Demo video. Seeing me complete the activity first will help you understand each of the steps.

Connect Scan Demo

System: During this activity, you’ll use the Kali VM and Wireshark as you did in the packet sniffing exercises in Unit 1.

Instructions for installing and launching the Kali VM and Wireshark.

Time: This activity should take you 5 to 10 minutes to complete.

Goal

To execute a Connect scan and interpret the results

Instructions

Note: During this activity, replace these references, italicized in the instructions, with your local IP addresses:

Kali VM: 192.168.1.104Windows IP: 192.168.1.101

Note: You will get different results depending on whether your Windows Firewall is on or off.

Note: Hit Enter after each command.

Start VMware, and launch your Kali VM.Start a new Wireshark capture on the Windows host machine with a display filter of ip.addr==192.168.1.104 and tcp. This filter will limit the displayed packets to TCP traffic from your Kali box (remember to substitute the IP address of your Kali box).Now we’ll see traffic generated by the Connect scan. The nmap help screen shows the syntax: nmap –s. The S specifies a SYN scan, which is the default scan if no scan is specified.We’re going to use nmap –sT, the Connect Scan.If you look at the port specifications, -p can limit the scan to a port, or multiple ports that can be adjacent or non-adjacent.We’ll do –p 80 followed by the ip address of the Windows machine: nmap –sT –p 445 192.168.1.101. Remember to substitute the IP address of your Windows host machine.Lo and behold, with the port 445 open on the Windows machine, nmap identifies port 80 as open.Compared to the SYN scan, though, we can see that the TCP Three Way Handshake actually completes: SYN, SYN/ACK, and ACK. After that, nmap on the Kali box sends an RST, but the destination application has a log entry of the completed connection now.The Connect scan, which is the only scan that doesn’t require root privileges, should be avoided at all costs, since it is very noisy.Enter nmap –sT –p 22 192.168.1.101. A closed port, once again, will respond with an RST.In Wireshark, change the filter to tcp.port==22, and notice this expected sequence of TCP flags.

After you've finished, answer the Check Your Work questions.

转载于:https://www.cnblogs.com/sec875/articles/10028424.html

相关资源：JAVA上百实例源码以及开源项目