Hands-On AWS Penetration Testing with Kali Linux

Identifying and fingerprinting open ports and services using Nmap

Continuing from the previous section, we will now scan a host for open ports and then try to identify services running on our target. For this exercise, we will be using the Nmap SYN scan -sS flag. This is the default and most popularly-used scanning technique. Why? It's because the scan is quick and can be performed without any hampering by the firewall. The scan is also stealthy as it does not complete the TCP handshake. The scan can produce distinct and accurate results between open, closed, and filtered ports. So how does this scan work? Let's take a look.

The SYN scan uses a half-open TCP connection to determine whether the port is open or closed. The SYN scan process ...