Port scanning basics in Bash Scripting - Step-by-Step Execution

Concept Flow - Port scanning basics

Start

↓

Set target IP and ports

↓

For each port in list

↓

Try to connect to port

↓

Is port open?

No→Print closed or skip

Yes↓

Print port is open

↓

Next port

↓

All ports checked

↓

End

The script tries to connect to each port on a target IP and prints if the port is open or closed.

Execution Sample

Bash Scripting

target=127.0.0.1
ports="22 80 443"
for port in $ports; do
  timeout 1 bash -c "</dev/tcp/$target/$port" && echo "$port open" || echo "$port closed"
done

This script checks if ports 22, 80, and 443 are open on localhost by trying to connect to each.

Execution Table

Step	Port	Connection Attempt	Result	Output
1	22	Try to connect to 127.0.0.1:22	Success	22 open
2	80	Try to connect to 127.0.0.1:80	Success	80 open
3	443	Try to connect to 127.0.0.1:443	Fail (timeout)	443 closed
4	-	All ports checked	-	Script ends

💡 All ports in the list have been checked, script finishes.

Variable Tracker

Variable	Start	After 1	After 2	After 3	Final
port	unset	22	80	443	end
target	127.0.0.1	127.0.0.1	127.0.0.1	127.0.0.1	127.0.0.1

Key Moments - 3 Insights

Why does the script use 'timeout 1' before the connection attempt?

The 'timeout 1' limits the connection attempt to 1 second to avoid waiting too long on closed ports, as shown in step 3 where the connection fails and times out.

What does the '&&' and '||' mean in the connection command?

'&&' runs the echo for open port only if connection succeeds; '||' runs the echo for closed port if connection fails, as seen in the output column of the execution table.

Why do we use '</dev/tcp/$target/$port' in the script?

This special bash syntax tries to open a TCP connection to the target IP and port, which is the core of the port scanning attempt shown in the connection attempt column.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'port' during step 2?

A 22

B 80

C 443

D unset

💡 Hint

Check the 'port' variable in variable_tracker after step 2.

At which step does the connection attempt fail due to timeout?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Result' column in the execution_table for failure indication.

If we add port 21 to the ports list and it is open, what will the output be at the new step 1?

A 21 open

B 21 closed

C No output for port 21

D Error in script

💡 Hint

Refer to how open ports print ' open' in the output column.

Concept Snapshot

Port scanning basics in bash:
- Use a loop to try connecting to each port.
- Use '</dev/tcp/host/port' to test connection.
- Use 'timeout' to avoid long waits.
- '&&' and '||' handle success/failure outputs.
- Prints which ports are open or closed.

Full Transcript

This lesson shows how a simple bash script scans ports on a target IP. The script loops over a list of ports, tries to connect to each using bash's special TCP file, and prints if the port is open or closed. It uses 'timeout' to limit wait time for closed ports. The execution table traces each step: which port is tested, connection success or failure, and output printed. Variables like 'port' change each iteration. Key points include why timeout is used, how success and failure are handled with '&&' and '||', and how the TCP connection is attempted. The quiz checks understanding of variable values and connection results at each step. This visual trace helps beginners see exactly how port scanning works in bash scripting.

Practice

1. What is the main purpose of port scanning in network security?

easy

A. To install software remotely

B. To delete files on a remote server

C. To speed up internet connection

D. To find open ports on a computer

Solution

1. Step 1: Understand port scanning basics

   Port scanning is used to check which network ports on a computer are open and accepting connections.

2. Step 2: Identify the correct purpose

   Among the options, only finding open ports matches the purpose of port scanning.

3. Final Answer:

   To find open ports on a computer -> Option D

4. Quick Check:

   Port scanning = find open ports [OK]

Hint: Port scanning checks open ports, not files or speed [OK]

Common Mistakes:

• Confusing port scanning with file operations
• Thinking it improves internet speed
• Assuming it installs software

2. Which of the following bash commands correctly scans if port 80 is open on host 192.168.1.1?

easy

A. nc -zv 192.168.1.1 80

B. nc -xv 192.168.1.1 80

C. nc -z 192.168.1.1 -p 80

D. nc -v 192.168.1.1

Solution

1. Step 1: Recall correct netcat syntax for port scanning

   The option '-z' tells nc to scan without sending data, and '-v' enables verbose output. The host and port follow these flags.

2. Step 2: Check each option

   Only nc -zv 192.168.1.1 80 uses the correct flags '-z' for scanning and '-v' for verbose, followed by host and port. Other options either lack necessary flags, use incorrect flags like -xv or misuse -p for source port, or omit the port specification.

3. Final Answer:

   nc -zv 192.168.1.1 80 -> Option A

4. Quick Check:

   Correct nc flags = -zv [OK]

Hint: Use nc -zv host port to scan a port [OK]

Common Mistakes:

• Using wrong flags like -xv
• Misplacing port with -p flag
• Omitting port number

3. What will be the output of this bash snippet scanning ports 22 and 80 on localhost?

for port in 22 80; do
  nc -zv localhost $port
 done

medium

A. It will produce a syntax error

B. It will show if ports 22 and 80 are open or closed on localhost

C. It will scan ports 22 and 80 on a remote host

D. It will scan all ports from 22 to 80

Solution

1. Step 1: Analyze the for loop and command

   The loop iterates over ports 22 and 80, running 'nc -zv localhost $port' for each port.

2. Step 2: Understand the command effect

   Netcat checks if each specified port on localhost is open, printing the result.

3. Final Answer:

   It will show if ports 22 and 80 are open or closed on localhost -> Option B

4. Quick Check:

   Loop scans specified ports on localhost [OK]

Hint: Loop scans listed ports on localhost, not a range [OK]

Common Mistakes:

• Thinking it scans a range of ports
• Assuming remote host scanning
• Expecting syntax errors

4. Identify the error in this bash script intended to scan ports 20 to 25 on 127.0.0.1:

for port in {20..25} do
  nc -zv 127.0.0.1 $port
 done

medium

A. The loop syntax is incorrect; it should use parentheses

B. The loop variable $port is not referenced correctly

C. The script is missing a semicolon after the for statement

D. The loop block is missing a 'do' keyword

Solution

1. Step 1: Check for correct bash for-loop syntax

   Bash requires a semicolon or newline after the for statement before 'do'. Here, 'for port in {20..25}' is not followed by a semicolon or newline before 'do'.

2. Step 2: Verify other syntax elements

   The loop variable and block are correct, and 'do' is present. The missing semicolon causes a syntax error.

3. Final Answer:

   The script is missing a semicolon after the for statement -> Option C

4. Quick Check:

   Missing semicolon after for statement causes error [OK]

Hint: Add semicolon or newline after for statement before do [OK]

Common Mistakes:

• Omitting semicolon after for line
• Misplacing 'do' keyword
• Incorrect variable usage

5. You want to scan all ports from 80 to 85 on host 10.0.0.5 and save only open ports to a file named open_ports.txt. Which bash script snippet achieves this?

hard

A. for port in {80..85}; do nc -zv 10.0.0.5 $port 2>&1 | grep 'succeeded' >> open_ports.txt; done

B. for port in 80 81 82 83 84 85; do nc -zv 10.0.0.5 $port > open_ports.txt; done

C. nc -zv 10.0.0.5 80-85 > open_ports.txt

D. for port in {80..85}; do nc -zv 10.0.0.5 $port | grep 'failed' >> open_ports.txt; done

Solution

1. Step 1: Understand the scanning and filtering requirements

   The script must scan ports 80 to 85, detect open ports, and save only those results to a file.

2. Step 2: Analyze each option

   for port in {80..85}; do nc -zv 10.0.0.5 $port 2>&1 | grep 'succeeded' >> open_ports.txt; done loops over ports 80 to 85, runs nc with verbose and zero-I/O flags, redirects stderr to stdout, filters lines containing 'succeeded' (indicating open ports), and appends to open_ports.txt. for port in 80 81 82 83 84 85; do nc -zv 10.0.0.5 $port > open_ports.txt; done overwrites the file each time and does not filter open ports. nc -zv 10.0.0.5 80-85 > open_ports.txt uses invalid port range syntax. for port in {80..85}; do nc -zv 10.0.0.5 $port | grep 'failed' >> open_ports.txt; done filters 'failed' ports, opposite of requirement.

3. Final Answer:

   for port in {80..85}; do nc -zv 10.0.0.5 $port 2>&1 | grep 'succeeded' >> open_ports.txt; done -> Option A

4. Quick Check:

   Loop + grep 'succeeded' + append to file = correct [OK]

Hint: Filter 'succeeded' lines and append output to file [OK]

Common Mistakes:

• Overwriting output file inside loop
• Using invalid port range syntax
• Filtering 'failed' instead of 'succeeded'