Port scanning basics in Bash Scripting - Step-by-Step Execution

Concept Flow - Port scanning basics

Start

↓

Set target IP and ports

↓

For each port in list

↓

Try to connect to port

↓

Is port open?

No→Print closed or skip

Yes↓

Print port is open

↓

Next port

↓

All ports checked

↓

End

The script tries to connect to each port on a target IP and prints if the port is open or closed.

Execution Sample

Bash Scripting

target=127.0.0.1
ports="22 80 443"
for port in $ports; do
  timeout 1 bash -c "</dev/tcp/$target/$port" && echo "$port open" || echo "$port closed"
done

This script checks if ports 22, 80, and 443 are open on localhost by trying to connect to each.

Execution Table

Step	Port	Connection Attempt	Result	Output
1	22	Try to connect to 127.0.0.1:22	Success	22 open
2	80	Try to connect to 127.0.0.1:80	Success	80 open
3	443	Try to connect to 127.0.0.1:443	Fail (timeout)	443 closed
4	-	All ports checked	-	Script ends

💡 All ports in the list have been checked, script finishes.

Variable Tracker

Variable	Start	After 1	After 2	After 3	Final
port	unset	22	80	443	end
target	127.0.0.1	127.0.0.1	127.0.0.1	127.0.0.1	127.0.0.1

Key Moments - 3 Insights

Why does the script use 'timeout 1' before the connection attempt?

The 'timeout 1' limits the connection attempt to 1 second to avoid waiting too long on closed ports, as shown in step 3 where the connection fails and times out.

What does the '&&' and '||' mean in the connection command?

'&&' runs the echo for open port only if connection succeeds; '||' runs the echo for closed port if connection fails, as seen in the output column of the execution table.

Why do we use '</dev/tcp/$target/$port' in the script?

This special bash syntax tries to open a TCP connection to the target IP and port, which is the core of the port scanning attempt shown in the connection attempt column.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'port' during step 2?

A 22

B 80

C 443

D unset

💡 Hint

Check the 'port' variable in variable_tracker after step 2.

At which step does the connection attempt fail due to timeout?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Result' column in the execution_table for failure indication.

If we add port 21 to the ports list and it is open, what will the output be at the new step 1?

A 21 open

B 21 closed

C No output for port 21

D Error in script

💡 Hint

Refer to how open ports print ' open' in the output column.

Concept Snapshot

Port scanning basics in bash:
- Use a loop to try connecting to each port.
- Use '</dev/tcp/host/port' to test connection.
- Use 'timeout' to avoid long waits.
- '&&' and '||' handle success/failure outputs.
- Prints which ports are open or closed.

Full Transcript

This lesson shows how a simple bash script scans ports on a target IP. The script loops over a list of ports, tries to connect to each using bash's special TCP file, and prints if the port is open or closed. It uses 'timeout' to limit wait time for closed ports. The execution table traces each step: which port is tested, connection success or failure, and output printed. Variables like 'port' change each iteration. Key points include why timeout is used, how success and failure are handled with '&&' and '||', and how the TCP connection is attempted. The quiz checks understanding of variable values and connection results at each step. This visual trace helps beginners see exactly how port scanning works in bash scripting.