thu hồi mà không cần sự cho phép trước bằng văn bản của nhà xuất bản. vật liệu trong eBook này cũng xuất hiện trong ông điều quan trọng nhất cho một quản trị mạng hoặc người dùng cuối để nhận ra về là rằng nó không được thiết kế để được một hệ thống điều | 44 Hacking Exposed Network Security Secrets and Solutions Identifying listening ports is critical to determining the type of operating system and applications in use. Active services that are listening may allow an unauthorized user to gain access to systems that are misconfigured or running a version of software known to have security vulnerabilities. Port scanning tools and techniques have evolved significantly over the past few years. We will focus on several popular port scanning tools and techniques that will provide us with a wealth of information. The port scanning techniques that follow differ from those previously mentioned when we were trying to just identify systems that were alive. For the following steps we will assume that the systems are alive and we are now trying to determine all the listening ports or potential access points on our target. There are several objectives that we would like to accomplish when port scanning the target system s . These include but are not limited to the following Identifying both the TCP and UDP services running on the target system Identifying the type of operating system of the target system Identifying specific applications or versions of a particular service Scan Types Before we jump into the requisite port scanning tools we must discuss the various port scanning techniques available. One of the pioneers of implementing various port scanning techniques is Fyodor. He has incorporated numerous scanning techniques into his nmap tool. Many of the scan types we will be discussing are the direct work of Fyodor himself. TCP connect scan This type of scan connects to the target port and completes a full three-way handshake SYN SYN ACK and ACK . It is easily detected by the target system. Figure 2-2 provides a diagram of the TCP three-way handshake. TCP SYN scan This technique is called half-open scanning because a full TCP connection is not made. Instead a SYN packet is sent to the target port. If a SYN ACK is received from
