Security Vulnerability test - vulnerability scanning

April 24, 2019

Network Scanning

Describe the test and purpose of the test?

Network scanning refers to the use of a computer network to gather information regarding computing systems. Network scanning is mainly used for security assessment, system maintenance, and also for performing attacks by hackers.

the purpose of network scanning is:

Recognize filtering systems between the user and the targeted host

Reduces the fallout from security breaches, including legal action that can steal your private information.

to prevent malicious attack

Discuss how it works?

Methods of Port Scanning

Refers to the process of sending packets to specific ports on a host and analyzing the responses to learn details about its running services or locate potential vulnerabilities.

Once available hosts on a network have been found via networking scanning, port scanning can be used to discover the services in use on specific ports. In general, port scanning attempts to classify ports into one of three classification:

· Open: the destination responds with a packet indicating it is listening on that port, which also indicates that whatever service was used for the scan (commonly TCP or UDP) is in use as well

open means that an application on the target machine is listening for connections/packets

· Closed: the destination received the request packet but responds with a reply indicating that there is no service listening at the port

· Filtered: the port might be open, but the packet has been filtered out by a firewall and dropped, so no reply is received

filtered means Allowing or blocking network packets into or out of a device or the network

When a hacker probes your system with a port scan attack, each port will react one of three ways: it will respond as “open” or “closed,” or it won’t respond at all. An open, or “listening,” port will respond to the port scan’s request, alerting the hacker that your device is on the other end. A closed port will respond as well, but it will deny the request. Unfortunately, even a denied request reveals that there’s a device behind the scanned IP address.

If a port doesn’t respond at all, it means it’s block by a firewall . However, blocked ports actually violate the TCP/IP rules of conduct, so your firewall may not block every port on your device. Instead, it will set some ports to “closed” instead, which means a scan could still detect the device.

Some firewalls, on the other hand, now use “adaptive behavior,” meaning they’ll block open and closed ports if a suspect IP address is probing them. These firewalls can also be configured to alert admins if they detect connection requests across many ports from only one host. However, even adaptive firewalls aren’t a perfect defense against port scans, as hackers can conduct scans in “strobe” or “stealth” mode. Strobe mode means that they scan a small number of ports at a time, while stealth mode means they can scan the ports over a longer period. These tactics reduce the chance that the firewall will detect the scan or trigger an alert.

discuss solution