So, whenever you hear of the mean little hackers who hack websites you hear of "port scanning". I understand what it is (looking for all open ports / services on a remote machine), however that begs the question:
Why would an attacker want to know what ports are open?
The only reason I see for this is looking for services that may or may not have the default username and password OR a vulnerability or something.
But seeing as the odds for this are quite low, why do hackers perform port scans? Is it purely for the reason above?


To run an exploit, an attacker needs a vulnerability.
To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs).
To fingerprint a service, the attacker needs to know that there is one running on a publicly accessible port.
To find out which publicly accessible ports run services, the attacker needs to run a port scan.


As you see, a port scan is the first reconnaissance step an attacker performs before attacking a system.
