Discovering UDP services

UDP services are often ignored during penetration tests, but good penetration testers know that they frequently reveal important host information and can even be vulnerable and used to compromise a host.

This recipe shows how to use Nmap to list all open UDP ports on a host.

How to do it...

Open your terminal and type:

#nmap -sU -p- <target>

The output follows Nmap's standard format:

# nmap -sU -F scanme.nmap.org

Nmap scan report for scanme.nmap.org (74.207.244.221)
Host is up (0.100s latency).
Not shown: 98 closed ports
PORT    STATE         SERVICE
68/udp  open|filtered dhcpc
123/udp open          ntp

How it works...

The argument -sU tells Nmap to launch a UDP scan against the target host. Nmap sends UDP probes to the selected ports and analyzes the response to determine the port's state. Nmap's UDP scanning technique works in the following way:

1. A UDP packet is sent to the target with an empty UDP payload unless one is specified in the file nmap-payloads.

2. If the...