Port scanning basics in Bash Scripting - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this simple port scan script?

Consider this bash script that scans ports 80 and 443 on localhost. What output will it produce?

Bash Scripting

for port in 80 443; do
  timeout 1 bash -c "</dev/tcp/127.0.0.1/$port" && echo "Port $port is open" || echo "Port $port is closed"
done

A Port 80 is closed\nPort 443 is open

B Port 80 is closed\nPort 443 is closed

C Port 80 is open\nPort 443 is closed

D Port 80 is open\nPort 443 is open

💡 Hint

Think about which common services usually listen on ports 80 and 443 on localhost.

Ports 80 (HTTP) and 443 (HTTPS) are commonly open on localhost if a web server is running. The script tries to open a TCP connection to each port and prints if it is open or closed.

📝 Syntax

intermediate

Identify the syntax error in this port scanning snippet

Which option contains the correct syntax to scan port 22 on 192.168.1.1 using bash's /dev/tcp?

Bash Scripting

timeout 1 bash -c "</dev/tcp/192.168.1.1/22" && echo "Open" || echo "Closed"

A timeout 1 bash -c "</dev/tcp/192.168.1.1/22" && echo "Open" || echo "Closed"

B timeout 1 bash -c "</dev/tcp/192.168.1.1:22" && echo "Open" || echo "Closed"

C timeout 1 bash -c "</dev/tcp/192.168.1.1" 22 && echo "Open" || echo "Closed"

D timeout 1 bash -c "</dev/tcp/192.168.1.1-22" && echo "Open" || echo "Closed"

💡 Hint

Check the correct format for /dev/tcp host and port separation.

The correct syntax for bash's /dev/tcp is /dev/tcp/host/port without any colon or dash. Options A, B, and C use invalid separators or misplaced arguments causing syntax errors.

🔧 Debug

advanced

Why does this port scan script always report ports as closed?

This script tries to scan ports 20 to 22 on 10.0.0.1 but always prints 'Port X is closed'. What is the likely cause?

Bash Scripting

for port in {20..22}; do
  if timeout 1 bash -c "</dev/tcp/10.0.0.1/$port"; then
    echo "Port $port is open"
  else
    echo "Port $port is closed"
  fi
done

A The target host 10.0.0.1 is unreachable or blocking connections

B The timeout command is not installed, so the script fails silently

C The bash shell does not support /dev/tcp on this system

D The for loop syntax {20..22} is invalid in bash

💡 Hint

Check network connectivity and firewall rules on the target host.

If the target host is unreachable or firewall blocks connections, all attempts fail, so ports appear closed. The other options would cause errors or different failures.

🚀 Application

advanced

How to scan multiple ports efficiently in bash?

You want to scan ports 22, 80, 443, and 8080 on host 192.168.0.10 using bash. Which script snippet scans all ports and prints only open ones?

A for p in 22 80 443 8080; do timeout 1 bash -c "</dev/tcp/192.168.0.10/$p" && echo "Port $p open"; done

B for p in 22 80 443 8080; do timeout 1 bash -c "</dev/tcp/192.168.0.10/$p" || echo "Port $p open"; done

C for p in 22 80 443 8080; do if timeout 1 bash -c "</dev/tcp/192.168.0.10/$p"; then echo "Port $p open"; fi; done

D for p in 22 80 443 8080; do if ! timeout 1 bash -c "</dev/tcp/192.168.0.10/$p"; then echo "Port $p open"; fi; done

💡 Hint

Only print when the connection succeeds, not when it fails.

Option C correctly tests if the connection succeeds and prints 'Port X open'. Option C prints on success but also continues silently on failure. Options C and D invert logic causing wrong output.

🧠 Conceptual

expert

What is a limitation of using bash /dev/tcp for port scanning?

Which of the following is a true limitation when using bash's /dev/tcp feature for port scanning?

A It provides detailed service banners for each open port

B It cannot scan UDP ports because /dev/tcp only supports TCP connections

C It automatically scans all ports from 1 to 65535 without specifying ports

D It requires root privileges to open /dev/tcp sockets

💡 Hint

Think about the protocol support of /dev/tcp.

/dev/tcp in bash supports only TCP connections, so it cannot scan UDP ports. It does not require root privileges, does not scan all ports automatically, and does not provide service banners.