# Week 5: Scanning Tools & Tactics

**Scanning Tactics** - This lesson will cover common tools in-depth that are used for port scanning including Nmap, Nessus, and Metasploit. The section will introduce readers to using a wide toolset for scanning on penetration tests and provide a deeper understanding of what is going on behind the scenes. For example, the importance of TCP vs UDP scanning, the three-way TCP handshake, stealth scanning, and various Nmap switches. It will also provide the first introduction to Metasploit and its usage, which will be built upon throughout the course.

## TCP vs UDP

* TCP
  * Connection-oriented
  * has a handshake
  * used on applications requiring high reliability
  * E.g. HTTP, FTP, Telnet
* UDP
  * Connectionless 
  * No handshake
  * used on applications requiring a fast connection
  * E.g. DNS, DHCP, SNMP

### 3-way handshake

```
SYN SYN, ACK ACK
SYN SYN ACK RST --reset packet
```

Don't get bogged down in web exploitation (password spraying, sql injection, XSS, credential stuffing) if they aren't paying for web exploitation.