Port and vulnerability scanning

Port and vulnerability scanning is the practice of exploring a system in order to assess its security: finding out which ports are open, which services are running, and which weaknesses could be exploited.

It is the starting point of almost every assessment, on either side of the engagement, and it is also the first thing an attacker does once a target is chosen.

Port scanning: mapping what answers

Port scanning is the act of probing the ports of a machine or a network to determine which are open and what service is running behind them. Ports are the specific connection points that let devices communicate, and a scan of them reveals the shape of the network and the areas worth looking at.

Full connect scan. Completes a connection to each port to determine its state: open, closed or filtered.

Stealth scan. Gathers the same information without completing the connection, which reduces the chance of being logged as a session.

Range scan. Covers a defined range of ports rather than every one of them, which is the usual trade-off between coverage and time.

Vulnerability scanning: finding what is wrong

Vulnerability scanning actively looks for weaknesses in systems, applications or networks that could be exploited, by identifying services, software versions and configurations that are known to be susceptible. The results are what a team works from when deciding what to fix.

Nmap is the versatile open source tool for the port scanning half, and gathers detailed information about the systems it finds.

OpenVAS is an open source vulnerability scanner with a large test database and an interface for working through the results.

Nessus is a widely used commercial scanner that identifies issues and suggests mitigations.

A worked example

An administrator wants to assess a web server.

They run a port scan with Nmap to identify open ports and running services. The result shows port 80 open, which means a web service is listening.

They then run a vulnerability scan with OpenVAS. It reports that the server is running an out of date version of its web software, with a publicly documented vulnerability.

With that, the administrator can act: apply the patch, or restrict access to the service while the patch is arranged.

Scanning is not managing, and scanning ports is not scanning vulnerabilities

This entry covers two activities that are performed one after the other and answer different questions, and it holds them together because that is how they were bought when it was written.

Port scanning asks what answers: what is listening and what service it appears to be. It is active reconnaissance, the phase that precedes any test, and deducing the vendor and version from the banner it returns is fingerprinting.

Vulnerability scanning asks what is wrong with what answered, comparing versions and configuration against a database of known defects, most of which carry a CVE.

And vulnerability management is neither of the two: it is the full cycle, and scanning is one of its five stages. Inventory, assess, prioritise, remediate and verify. What actually lowers risk happens after the scanner rather than inside it, and a programme that stops at scanning produces a backlog of tens of thousands of lines that nobody works through any more.

Two limits worth saying out loud. An unauthenticated scan infers the version from the banner, so it misses local issues and reports things that are not there. And no scanner finds an authorisation flaw in your own application, because nobody has assigned that an identifier.

Where to read more

SANS Internet Storm Center, Keeping track of your attack surface for cheap: practical treatment of scanning tools and what they are worth.

Cisco, Port scan detection: how port scanning works and how it looks from the defending side.