Tuesday, 10 April 2012

Step 4: Enumerating Target (Understanding UDP and TCP Port)

Enumerating target is a process used to find and collect information on ports and services available on the target environment. This process is usually done after we have discovered the target environment by scanning it to obtain the list of live hosts.

Port scanning
Port scanning is to find out which services are offered by a host.
Open port means that there is a network service listening on the port.
TCP characteristic:
• It is a connection-oriented protocol. Before exchanging data, the client and the server must
establish a connection using a three-way handshake:
o The client initiates the connection by sending a SYN packet to the server.
o The server replies with the SYN-ACK packet.
o The client sends an ACK to the server. At this point, the client and the server can
exchange data.
• It is a reliable protocol. TCP uses a sequence number to identify packet data. If the packets
arrived out of order, TCP would reorder it before submitting it to the application.

UDP is a connectionless protocol. It will do its best to send a packet to the destination, but if a packet is lost, UDP will not automatically resend it. It is up to the application to retransmit the packet.

Tcp Segment:


UDP Segment:

Port is open, however the service listening is looking for a specific UDP payload which is why it is less reliable than TCP scanning.

It is important to understand this most basic port that will be appear often later in our target. The next blog will be discussing about tools that we are going to use to enumerate target.

No comments:

Post a Comment