:star: Network Sweep (identify live hosts)
:star: Port Scan (determine listening TCP and UDP ports)
:black_medium_small_square: Network Layer
:black_small_square: IPv4 (Time To Live :arrow_right: 8 bits, Source IP Address :arrow_right: 32 bits, Destination IP Address :arrow_right: 32 bits)
:black_small_square: IPv6 (Hop Limit, Source IP Address :arrow_right: 128 bits, Destination IP Address :arrow_right: 128 bits)
:black_medium_small_square: Transport Layer
:black_small_square: TCP (Control flags :red_flag: SYN, ACK, RST, FIN, PSH, URG, CWR, ECE), (Source Port :arrow_right: 16 bits, Destination Port :arrow_right: 16 bits)
:arrow_right: Syn: SeqN=ISN(a) AckN=0
:arrow_left: Syn-Ack: SeqN=ISN(b) AckN=ISN(a)+1
:arrow_right: Ack: SeqN=ISN(a)+1 AckN=ISN(b)+1
:left_right_arrow: Connection
:red_cross: If SSH to web server, the handshake still happens but error at the application layer
:!: When send SYN to open port, the kernel send SYN-ACK, then the program is unaware until the data is sent
:black_small_square: UDP (Source Port :arrow_right:16 bits, Destination Port :arrow_right:16 bits)
:star: OS Fingerprint (determine target operating system)
:star: Version Scan (determine version of service and protocols)
:star: Vulnerability Scan (determine list of potential vulnerability)
:black_medium_small_square: Scanner Types
:black_small_square: General purpose
:black_small_square:Web Application Scanners
:black_small_square: Application specific
:black_medium_small_square: Scan Types
:black_small_square: Unauthenticated (Most Common)
:black_small_square: Authenticated (Less Common)
:black_small_square: Agent-based (Rare)