h00die
60 lines
1.9 KiB
Markdown
60 lines
1.9 KiB
Markdown
## Description
|
|
|
|
This module will attempt to initiate a TCP/IP connection with ports on the victim machine. It is this done by sending a SYN packet, and if victim replies with a SYN/ACK packet
|
|
that means the port is open. Then the attacker sends a RST packet, and as a result the victim's machine assumes that there is a communication error.
|
|
The attacker now knows the state of port without a full tcp connection. Major benefit of TCP SYN scan is that most logging applications do not log the TCP/RST by default.
|
|
|
|
## Options
|
|
|
|
**PORTS**
|
|
|
|
This is the list of TCP ports to test on each host.
|
|
Formats like `1-3`, `1,2,3`, `1,2-3`, etc. are all supported. Default
|
|
options is to scan `1-10000` ports.
|
|
|
|
**TIMEOUT**
|
|
|
|
Maximum time to wait for a response. The default value is 500 milliseconds.
|
|
|
|
**VERBOSE**
|
|
|
|
Gives detailed message about the scan of all the ports. It also shows the
|
|
ports that were closed.
|
|
|
|
## Verification Steps
|
|
|
|
1. Do: `use auxiliary/scanner/portscan/syn`
|
|
2. Do: `set RHOSTS [IP]`
|
|
3. Do: `set PORTS [PORTS]`
|
|
4. Do: `run`
|
|
5. If any of the TCP ports were open they will be discovered, status will be printed indicating as such.
|
|
|
|
## Scenarios
|
|
|
|
### Metaspliotable 2
|
|
|
|
```
|
|
msf > use auxiliary/scanner/portscan/syn
|
|
msf auxiliary(syn) > set RHOSTS 192.168.45.159
|
|
RHOSTS => 192.168.45.159
|
|
msf auxiliary(syn) > set PORTS 1-10000
|
|
PORTS => 1-10000
|
|
msf auxiliary(syn) > run
|
|
[*] TCP OPEN 192.168.45.159:22
|
|
[*] TCP OPEN 192.168.45.159:23
|
|
[*] TCP OPEN 192.168.45.159:111
|
|
[*] TCP OPEN 192.168.45.159:445
|
|
[*] TCP OPEN 192.168.45.159:512
|
|
[*] TCP OPEN 192.168.45.159:513
|
|
[*] TCP OPEN 192.168.45.159:1099
|
|
[*] TCP OPEN 192.168.45.159:2121
|
|
[*] TCP OPEN 192.168.45.159:3306
|
|
[*] TCP OPEN 192.168.45.159:3632
|
|
[*] TCP OPEN 192.168.45.159:6000
|
|
[*] TCP OPEN 192.168.45.159:6697
|
|
[*] TCP OPEN 192.168.45.159:8009
|
|
[*] Scanned 1 of 1 hosts (100% complete)
|
|
[*] Auxiliary module execution completed
|
|
|
|
```
|