# T1046 - Network Service Scanning
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1046)
<blockquote>Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system. 

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Port Scan](#atomic-test-1---port-scan)

- [Atomic Test #2 - Port Scan Nmap](#atomic-test-2---port-scan-nmap)

- [Atomic Test #3 - Port Scan NMap for Windows](#atomic-test-3---port-scan-nmap-for-windows)

- [Atomic Test #4 - Port Scan using python](#atomic-test-4---port-scan-using-python)


<br/>

## Atomic Test #1 - Port Scan
Scan ports to check for listening ports.

Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** 68e907da-2539-48f6-9fc9-257a78c05540






#### Attack Commands: Run with `sh`! 


```sh
for port in {1..65535};
do
  echo >/dev/tcp/192.168.1.1/$port && echo "port $port is open" || echo "port $port is closed" : ;
done
```






<br/>
<br/>

## Atomic Test #2 - Port Scan Nmap
Scan ports to check for listening ports with Nmap.

Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of adresseses on port 80 to determine if listening. Results will be via stdout.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** 515942b0-a09f-4163-a7bb-22fefb6f185f





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| host | Host to scan. | String | 192.168.1.1|
| port | Ports to scan. | String | 80|
| network_range | Network Range to Scan. | String | 192.168.1.0/24|


#### Attack Commands: Run with `sh`! 


```sh
nmap -sS #{network_range} -p #{port}
telnet #{host} #{port}
nc -nv #{host} #{port}
```




#### Dependencies:  Run with `sh`!
##### Description: Check if nmap command exists on the machine
##### Check Prereq Commands:
```sh
if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```sh
(which yum && yum -y epel-release nmap)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)
```




<br/>
<br/>

## Atomic Test #3 - Port Scan NMap for Windows
Scan ports to check for listening ports for the local host 127.0.0.1

**Supported Platforms:** Windows


**auto_generated_guid:** d696a3cb-d7a8-4976-8eb5-5af4abf2e3df





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| nmap_url | NMap installer download URL | Url | https://nmap.org/dist/nmap-7.80-setup.exe|
| host_to_scan | The host to scan with NMap | String | 127.0.0.1|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
nmap #{host_to_scan}
```




#### Dependencies:  Run with `powershell`!
##### Description: NMap must be installed
##### Check Prereq Commands:
```powershell
if (cmd /c "nmap 2>nul") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest -OutFile $env:temp\nmap-7.80-setup.exe #{nmap_url}
Start-Process $env:temp\nmap-7.80-setup.exe /S
```




<br/>
<br/>

## Atomic Test #4 - Port Scan using python
Scan ports to check for listening ports with python

**Supported Platforms:** Windows


**auto_generated_guid:** 6ca45b04-9f15-4424-b9d3-84a217285a5c





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| host_ip | Host to scan. | String | 127.0.0.1|
| filename | Location of the project file | Path | PathToAtomicsFolder&#92;T1046&#92;src&#92;T1046.py|


#### Attack Commands: Run with `powershell`! 


```powershell
python #{filename} -i #{host_ip}
```




#### Dependencies:  Run with `powershell`!
##### Description: Check if python exists on the machine
##### Check Prereq Commands:
```powershell
if (python --version) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
echo "Python 3 must be installed manually"
```




<br/>
