> For the complete documentation index, see [llms.txt](https://wiki.zacheller.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.zacheller.dev/pentest/courses/beginner-network-pentesting/untitled-1.md).

# Week 5: Scanning Tools & Tactics

**Scanning Tactics** - This lesson will cover common tools in-depth that are used for port scanning including Nmap, Nessus, and Metasploit. The section will introduce readers to using a wide toolset for scanning on penetration tests and provide a deeper understanding of what is going on behind the scenes. For example, the importance of TCP vs UDP scanning, the three-way TCP handshake, stealth scanning, and various Nmap switches. It will also provide the first introduction to Metasploit and its usage, which will be built upon throughout the course.

## TCP vs UDP

* TCP
  * Connection-oriented
  * has a handshake
  * used on applications requiring high reliability
  * E.g. HTTP, FTP, Telnet
* UDP
  * Connectionless 
  * No handshake
  * used on applications requiring a fast connection
  * E.g. DNS, DHCP, SNMP

### 3-way handshake

```
SYN SYN, ACK ACK
SYN SYN ACK RST --reset packet
```

Don't get bogged down in web exploitation (password spraying, sql injection, XSS, credential stuffing) if they aren't paying for web exploitation.