# Host and Port Scanning

After we have found out that our target is alive, we want to get a more accurate picture of the system. The information we need includes:

* Open ports and its services
* Service versions
* Information that the services provided
* Operating system

<details>

<summary>States of a Port Scan</summary>

</details>

<details>

<summary>Scanning Top 10 TCP Ports</summary>

```bash
sudo nmap 10.129.2.28 --top-ports=10 
```

</details>

<details>

<summary>Trace nmap port scan</summary>

{% code overflow="wrap" %}

```bash
z3tssu@htb[/htb]$ sudo nmap 10.129.2.28 -p 21 --packet-trace -Pn -n --disable-arp-ping

# --packet-trace = shows all packets sent and received
# -n = Disables DNS resolution
# --disable-arp-ping = Disables ARP Ping

```

{% endcode %}

</details>

<details>

<summary>TCP Connect Scan on Port 443 (-sT)</summary>

This command connects and scans TCP port 443 using a TCP connect scan (`-sT`), including packet tracing and additional output details.

```bash
sudo nmap 10.129.2.28 -p 443 --packet-trace --disable-arp-ping -Pn -n --reason -sT
```

</details>

<details>

<summary>UDP Port Scan (-sU)</summary>

This command performs a UDP port scan. The `-F` flag is used to check the 100 most common ports.

```bash
sudo nmap 10.129.2.28 -F -sU
```

**Note:** The `-F` option checks the top 100 ports.

</details>

<details>

<summary>Service Version Scan (-sV) on Port 445</summary>

This command conducts a version scan on TCP port 445 with packet tracing and additional output details.

```bash
sudo nmap 10.129.2.28 -sV -Pn -n --disable-arp-ping --packet-trace -p 445 --reason
```

</details>
