Nmap Scans:

Types of Scans

There are a few.

TCP Connect Scans:

  • Relies on the three-way handshake (needs to finish the handshake process).
  • Usually conducted with nmap -sT command.
  • Used by non-privileged users (only option for a non-root user).
  • Usually has a windows size larger than 1024 bytes as the request expects some data due to the nature of the protocol.

The given filter shows the TCP Connect scan patterns in a capture file: tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size > 1024

SYN Scans:

  • Doesn’t rely on the three-way handshake (no need to finish the handshake process).
  • Usually conducted with nmap -sS command.
  • Used by privileged users.
  • Usually have a size less than or equal to 1024 bytes as the request is not finished and it doesn’t expect to receive data.

The given filter shows the TCP SYN scan patterns in a capture file: tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size <= 1024

UDP Scans

  • Doesn’t require a handshake process
  • No prompt for open ports
  • ICMP error message for close ports
  • Usually conducted with nmap -sU command.

The given filter shows the UDP scan patterns in a capture file: icmp.type==3 and icmp.code==3

ARP Poisoning and Man in the Middle

ARP analysis in a nutshell:

  • Works on the local network
  • Enables the communication between MAC addresses
  • Not a secure protocol
  • Not a routable protocol
  • It doesn’t have an authentication function
  • Common patterns are request & response, announcement and gratuitous packets.

Analysis

DHCP Analysis

NetBIOS (NBNS) Analysis

Kerberos

FTP

HTTP

User Agent

HTTPS

Decrypting HTTPS Traffic