Scanning

The scanning phase starts after the reconnaissance of the target is completed. Attackers begin to scan the targets to find openings or vulnerabilities in their systems and networks that can be exploited. In this phase, you focus on getting more details about the target by using different techniques to scan ports, networks, Wi-Fi, and the cloud. Many tools are available to scan for vulnerabilities in a system and we will cover a few important ones in this chapter.

As we’ll focus on scanning, in this chapter, we will cover the following main topics:

• Scanning techniques
• Port scanning
• Vulnerability scanning
• Wi-Fi and cloud scanning
• Scanning exercises and best practices

Technical requirements

To follow along with this chapter, you will need the following:

• Kali Linux 2022.1 or later.
• Nmap – network analysis tool.
• Metasploitable 2 (a vulnerable virtual machine that allows you to test ethical hacking). It can be downloaded from https://information.rapid7.com/download-metasploitable-2017.html.
• OpenVAS – Open Vulnerability Scanner.
• inSSIDer.
• Aircrack-ng.
• Kismet.
• cloud-enum.

Scanning techniques

If you look up the definition of scanning, you will note that it has to do with looking at all parts of a particular subject carefully to detect something. Within ethical hacking, scanning is an integral part of your methodology.

During the reconnaissance phase of your ethical hack, you would have gathered information about your target. For you to obtain a more in-depth view of your target, you would need to perform various scanning activities.

Consider web scanners. These can help you gain insight into the vulnerabilities of the web server or its components. Network scanners can help identify hosts that are online, open ports, running services, and more. Vulnerability scanners focus purely on gaining insight into vulnerabilities that exist in your target. Most modern vulnerability scanners can scan diverse targets that range from web servers to mobile platforms.

In this chapter, we will focus on a few scanning techniques. In the next section, we will begin...

Port scanning

Port scanning involves determining what ports are open and accessible on your target. You can liken this activity to knocking on a door to see if anyone is home. Similarly, when you perform a port scan, you are essentially checking if a port is open and listening. Apart from determining that a port is open, a port scan can help fingerprint your target.

For example, as you perform a port scan, you may find that port 80 is open and listening. Your port scanner would be able to determine which web service is running on port 80 – for example, it would return IIS or Apache, along with its respective versions.

The range of ports that are available today ranges from 0 to 65535. Ports 0 to 1023 are known as well-known ports that have been assigned by the Internet Assigned Numbers Authority (IANA). You can view the list on IANA’s website by navigating to https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.

Note

...

Vulnerability scanning

Vulnerability scanning is a crucial phase in an ethical hacking engagement. This phase aims to discover vulnerabilities that could be exploited for you to obtain initial access, elevate your privileges, perform remote code execution, and much more.

Vulnerability scanning tools are useful because of how they can automate all possible security checks, especially across a large number of systems and networks. On the other hand, it is important to understand their limitations:

• These tools only look for known vulnerabilities
• These tools are flat – no intelligence is usually used by threat hackers to understand what is happening in the network thoroughly

There are several vulnerability scanners on the market today, many of which are costly and targeted at enterprises. In this section, we will focus on open source vulnerability scanners that you can run within Kali Linux.

As we have worked with Nmap in the previous section and stated...

Wi-Fi and cloud scanning

Wi-Fi or wireless and cloud scanning are two additional crucial phases within any ethical hacking engagement, especially if they are part of the environment. In this section, these two phases will be discussed in detail. We will look at wireless scanning first.

Wireless scanning

Most of the time, many wireless access points or routers are configured with minimum or no security by default. In addition, many wireless access points are configured with weak security protocols such as Wired Equivalent Privacy (WEP) and Lightweight Extensible Authentication Protocol (LEAP), which have security flaws or weaknesses.

Wireless access points broadcast beacon packets with their SSIDs. SSID is the service set identifier and acts as the name of the wireless access point. A few tools that are used for wireless scanning are NetStumbler, inSSIDER, Wellenreiter, Aircrack-ng, and Kismet. We will cover these in the following sub-sections.

To successfully use wireless...

Scanning exercises

As you work with scanning, please keep in mind that the scanning phase is where you begin scans to find openings in the target environment based on the results of your reconnaissance phase. During this phase, you can discover the possible ways or vulnerabilities that will allow you access to the environment.

The following list of activities aims to give you a feel for using the tools. Please remember to stay ethical and don’t conduct scanning activities on any organization that would be deemed illegal.

Port scanning:

• Try to use zenmap to do a network mapping for an environment
• Try to perform a TCP connect scan against a specific IP to find open ports
• Try to perform version detection using nmap -sV on a specific IP to find information about products and their versions
• Try to perform aggressive scan detection by using -T4 on a specific IP to increase the scan speed

Vulnerability scanning:

• Try to use OpenVAS to scan an...

Summary

In this chapter, we covered a few scanning options. We started by explaining scanning techniques and network mapping. We then worked through the various tools that provided different techniques to scan ports, Wi-Fi, and the cloud, which helped us know how to start using such tools for the ethical hacking exercises. Going through what was covered in this chapter not only gave you the skills required to perform scanning but also made you familiar with the best practices to protect your network against scanning techniques and tools.

In the next chapter, we will take our reconnaissance activity to the next level by starting to use the vulnerability or weakness we’ve discovered to gain access.