2017-09-08 06:57:46 +00:00
## Description
2017-09-10 14:02:07 +00:00
This module will attempt to initiate a TCP/IP connection with ports on the victim machine. It is this done by sending a SYN packet, and if victim replies with a SYN/ACK packet
that means the port is open. Then the attacker sends a RST packet, and as a result the victim's machine assumes that there is a communication error.
The attacker now knows the state of port without a full tcp connection. Major benefit of TCP SYN scan is that most logging applications do not log the TCP/RST by default.
2017-09-08 06:57:46 +00:00
## Options
**PORTS**
2017-09-08 07:53:30 +00:00
2017-09-09 07:58:18 +00:00
This is the list of TCP ports to test on each host.
Formats like `1-3` , `1,2,3` , `1,2-3` , etc. are all supported. Default
2017-09-08 06:57:46 +00:00
options is to scan `1-10000` ports.
**TIMEOUT**
2017-09-08 07:53:30 +00:00
2017-09-09 07:58:18 +00:00
Maximum time to wait for a response. The default value is 500 milliseconds.
2017-09-08 07:53:30 +00:00
2017-09-08 06:57:46 +00:00
**VERBOSE**
2017-09-08 07:53:30 +00:00
2017-09-08 06:57:46 +00:00
Gives detailed message about the scan of all the ports. It also shows the
ports that were closed.
## Verification Steps
2017-09-09 07:58:18 +00:00
1. Do: `use auxiliary/scanner/portscan/syn`
2017-09-08 06:57:46 +00:00
2. Do: `set RHOSTS [IP]`
2017-09-09 14:45:13 +00:00
3. Do: `set PORTS [PORTS]`
2017-09-08 06:57:46 +00:00
4. Do: `run`
2017-09-09 07:58:18 +00:00
5. If any of the TCP ports were open they will be discovered, status will be printed indicating as such.
2017-09-08 06:57:46 +00:00
## Scenarios
### Metaspliotable 2
```
msf > use auxiliary/scanner/portscan/syn
msf auxiliary(syn) > set RHOSTS 192.168.45.159
RHOSTS => 192.168.45.159
msf auxiliary(syn) > set PORTS 1-10000
PORTS => 1-10000
msf auxiliary(syn) > run
[*] TCP OPEN 192.168.45.159:22
[*] TCP OPEN 192.168.45.159:23
[*] TCP OPEN 192.168.45.159:111
[*] TCP OPEN 192.168.45.159:445
[*] TCP OPEN 192.168.45.159:512
[*] TCP OPEN 192.168.45.159:513
[*] TCP OPEN 192.168.45.159:1099
[*] TCP OPEN 192.168.45.159:2121
[*] TCP OPEN 192.168.45.159:3306
[*] TCP OPEN 192.168.45.159:3632
[*] TCP OPEN 192.168.45.159:6000
[*] TCP OPEN 192.168.45.159:6697
[*] TCP OPEN 192.168.45.159:8009
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
