- A+
Cyber security audit and ethical hacking training professionals normally use scanner to scans the networks. Scanning every IP address on the internet isn’t an easy job, and if you don’t have the resources of a botnet, a single scan can take months. If you want to take snapshots of the internet it will be very difficult, because doing a network scan of the whole thing has typically taken weeks or months to complete. However this is now possible explains cyber security services expert with the help of new tools like ZMap Masscan and other tools. In this article we will be covering different advance port scanning tools.
ZMap
ZMap is designed to execute widespread scans of the IPv4 address space or large portions of it. It is a very powerful tool for cyber security services researchers, and you can scan the entire IPv4 address space by using its high rate of 1.4 million packets per second. ZMap can’t replace general-purpose mappers like Nmap, which is excellent for scanning sub-networks in depth. ZMap is intended to do a shallow scan – typically of a single port or service – of the entire internet, or at least the IPv4 internet, from a single, dedicated computer, in under an hour. Ame Wilson, cyber security audit services consultant mentions that ZMap is proficient of scanning the IPv4 public address space over 1300 times faster than the Nmap.
ZMap is able to work so fast because it uses cyclic multiplicative groups. ZMap has been designed to achieve parallelism and performance. First, ZMap is completely stateless, which means that it does not maintain status per connection. In place of maintaining a big list of probes it’s sent, and the time they’ve been out there, and how much longer it should wait for each one, and thoroughly updating the list with every acknowledged response, ZMap just use cyclic multiplicative group to avoid all this explains Ame Wilson, cyber security audit services consultant.
Second, ZMap sends in parallel as many probes as the network bandwidth permits, in order to attain the maximum rate possible. Normally all the probes are sent in a pseudo-random order, so that’s if lot of people do scan together there is no DDOS attack, this way the probability to overload a single network is greatly reduced. Although each successive probe follows a strict algorithmic sequence, the IP numbers randomly bounce around the IPv4 address space. Thus, we don’t get thousands of probes delivered in on a single subnet at the same time.
Because of these reasons with ZMap we can scan about 3.7 billion addresses available for use in IPv4 addresses, in an hour thus ZMap really can crawl across the entire internet.
By default, ZMap will execute a TCP SYN scan on the particular port at the maximum rate possible. A more different configuration will be to scan 10,000 random addresses on port 80 at a maximum 10 Mbps and can be run as follows:
$ ZMap –bandwidth=10M –target-port=80 –max-targets=10000 –output-file=results.csv
You can also use ZMap to scan specific subnets or CIDR blocks. For instance, to scan only 10.0.0.0/8 and 192.168.0.0/16 on port 80, run:
ZMap -p 80 -o results.csv 10.0.0.0/8 192.168.0.0/16
As per cyber security services expert, normally when we use ZMap, it will deliver a list of distinct IP addresses that answered successfully (e.g. with a SYN ACK packet). Also it is recommended to use a blacklist file, with which you can exclude both reserved/unallocated IP space (e.g. multicast, RFC1918), as well as companies or military networks that should be excluded from your scans. By default, ZMap will employ a simple blacklist file having reserved and unallocated addresses and this file can be found in /etc/ZMap/blacklist.conf.
MASSCAN: Mass IP port scanner
Masscan is one of the fastest Internet port scanner as it can scan the all the IP’s of the Internet in less than 6 minutes, while transmitting 10 million packets per second mentions ethical hacking training professor. It produces output similar to Nmap and employs asynchronous transmission. The only big difference is that Masscan is faster than these other scanners. Also, it’s more flexible, allowing arbitrary address ranges and port ranges. Masscan uses a its own custom TCP/IP stack which means anything other than simple port scans will cause inconsistency with the local TCP/IP stack. This means we should either use the -S option to use a separate IP address, or configure your operating system to firewall the ports that Masscan uses.
While Linux is the primary platform on which Masscan works, the code runs well on many other operating systems like:
- Windows w/ Visual Studio
- Windows w/ MingGW
- Windows w/ cygwin
- Mac OS X /w XCode
- Mac OS X /w cmdline
- FreeBSD
To reach beyond two million packets per second, we need an Intel 10-gbps Ethernet adapter and a special driver called as “PF_RING DNA”. Masscan doesn’t need to be rebuilt in order to use PF_RING. To use PF_RING, you need to build the following components:
- libpfring.so (installed in /usr/lib/libpfring.so)
- pf_ring.ko (their kernel driver)
- ixgbe.ko (their version of the Intel 10-gbps Ethernet driver)
Masscan can be used to for different purposes than just detect whether ports are open as per cyber security services experts. It can also be used to complete the TCP connection and interaction with the application at that port in order to grab simple “banner” information. The trouble with this is that Masscan contains its own custom TCP/IP stack separate from the operating system you run it on. When the local system accepts a SYN-ACK from the probed target machines, it replys with a RST packet that kills the connection before Masscan can grab the banner. The easiest way to stop this is to allocate Masscan a separate IP address.
How to scan the entire Internet
The software is designed really with the entire Internet, while it is also very useful for smaller, internal networks. When you run it for the internet, it might look something like this:
# masscan 0.0.0.0/0 -p0-65535
It is very bad to scan the entire Internet. For one thing, some organizations of the Internet react badly to being scanned. For another thing, some websites track scans and can add you to a blacklist, which will get you, firewalled from useful websites of the Internet. Therefore, it sis suggested to exclude a lot of IP ranges. To exclude IP ranges, you want to use the following syntax:
# masscan 0.0.0.0/0 -p0-65535 –excludefile exclude.txt
Scanrand
Scanrand is a high speed port scanner, route-tracer and very efficient in scanning explains ethical hacking training professor of international institute o cyber security. It is a fast network scanner that can scan single hosts to very large networks easily. Scanrand supports what is called stateless TCP scanning, which sets it apart from the other network scanners. Scanrand takes a different approach than the typical network scanner and implements more of a, ‘fire and forget’ ideology using little math.
Scanrand divides itself up into two processes. One process is accountable for doing nothing but sending out SYN packets using libnet. The other process is accountable for getting the responses from the remote computers using libpcap. One significant thing to note here is that these processes work separately. There is no consulting with the other process. Scanrand stores a list of IP addresses it is expecting a response from and the sending process does not wait for a response at all. It fires off a SYN, and then moves on to the next target leaving the receiving process to sort out the inundation of responses.
Unicornscan
Unicornscan is an open source (GPL) tool and intended to assist with information gathering and security auditing. As we all know that Nmap sets the standard for port scanning on both windows and UNIX systems. Nevertheless full range UDP and TCP port scans (65k ports) take a long time to finish. Unicornscan resolves this problem and excels at speed. Unicornscan is an asynchronous stateless port scanner that implements its own TCP/IP stack. Unicornscan passes the ports that are found to Nmap and/or Amap for further analysis.
Scanning Best Practices
Cyber security audit services experts offer these advices for researchers performing Internet-wide scans as guidelines for good Internet citizenship.
- Organize closely with local network administrators to diminish the risks and handle inquiries.
- Authenticate that scans will not overload the local network or upstream provider.
- Indicate the nature of the scans in web pages and DNS entries of the source addresses.
- Plainly explain the reason and scope of the scans in all interactions.
- Provide a simple form of opting out and honor requests promptly.
- Perform scans no larger or more frequent than is necessary for research objectives.
- Distribute scan traffic over time or source addresses when feasible
It should go without saying that scan researchers should abstain from exploiting vulnerabilities or accessing protected resources, and should comply with any special legal requirements in their jurisdictions.
Security concerns and ethical problems
As usual, the capacity to almost instantly find out computers and networks that have un-patched security vulnerabilities can be a good thing for researchers, but it can be used for evil gain by the hackers out there. These are for sure great tools and will doubtless be accepted by many researchers. However, such potent Internet scanners can be used by hackers for malicious behavior such as vulnerability detection and exploitation. The only thing a hacker needs is a potent machine and a network with a high upload speed. Nowadays, these requirements can be easily fulfilled by a cloud virtual machine. The presence of these tools proves also that the time window between the presence of detection of vulnerability and its detection by hackers is getting shorter day by day. For this reason, it is important to properly secure your own infrastructure and protect personal/business data.
Ethical hacking training professor advices that these tools should be tools should be used cautiously without invading someone else’s privacy as anybody can use them.
Source: http://www.iicybersecurity.com/internet-port-scanner.html
