In this video
we're going to take a look at some ports
and protocols on a remote system.
What we're going to do is we're going to scan a remote computer,
in this case, a server, and see what things are open,
which ports are listening on what services?
So for example, if I scan it
and find that port 21 is open,
that means there's an FTP server sitting there listening
and waiting for a connection.
To do this, I'm going to use a tool known as Nmap,
which stands for the Network Mapper.
Nmap is a very popular command line tool
that's used to be able to map the network.
You can do ping sweeps and look at what is up and available.
You can look at each individual port.
You can even figure out what operating system
that remote server is running.
Now for our case, we're really focused
on those open ports for this example.
And so I'm going to show you how we can do a scan
of the network on a particular host using its IP,
and return every single port that's open on that machine.
Nmap is used by network technicians
or network administrators during troubleshooting,
as well as by security professionals,
to figure out what is open on a remote system.
So as you move into Security+, CySA+
and PenTest+, you're going to come back
and use Nmap once more.
Let's jump into the environment and take a look.
All right, so here I am at the command prompt
within my Kali Linux machine.
This is a machine that's on my local area network,
and I'm going to go and scan a web server
that happens to be sitting on my local area network.
To do that, I'm going to use the command line Nmap,
the -sS,
which tells it to do a SYN scan,
using just those SYN packets from the SYN-ACK relationship
from a three-way handshake.
I'm going to use -O, which is going to tell me
that I want to be able to figure out
what operating system it's using,
and then the IP that I'm going after,
in my case, 10.0.2.6.
And then I'm going to put this |more,
which is just going to give me one screen at a time,
because sometimes, Nmap can give you
multiple screens worth of text.
When I hit enter, it's going to go out
and start scanning that machine,
and you'll see it came back in just a couple of seconds,
and it shows me that out of the thousand ports
that it looked for, 977 of those were closed,
but there are 23 open ports on this machine.
That means an attacker has 23 opportunities
to break into this machine,
because each of these is running a different service.
Now ideally, we would want to minimize that
just down to the things that we need open.
For example, if this is a web server,
we would expect port 80 to be open, and in this case, it is.
If this was an FTP server,
we would expect port 21 to be open,
and again, here it is.
We also see some other common ones
like SSH for remote control.
This is port 22.
We can see telnet, which is port 23.
Now I'm getting a little ahead of ourselves,
but when you get into Security+
you're going to learn about telnet being very insecure.
And so you never want telnet
to actually be open and listening.
You want to disable that service.
In this case, this is one of my servers
that I use for my pen testing courses,
so I have a lot of open things here
that people can scan and attack.
Next you can see smtp,
which is our simple mail transfer protocol, port 25.
That allows this server to send mail.
I also have DNS open, because it's running a DNS server.
You can see that here, port 53, domain,
and that's domain name service.
We have a lot of other ones here as we go down,
but you get the idea.
You can see here that there are 23 different ports
that are all open and waiting for a connection.
We can see that open state here in the middle column,
and we can also see that these are tcp or udp,
and in my case, all of these are tcp.
And on the right, we see the service name.
Now again, I did use that -O,
which is going to tell me what type of operating system
this is running.
In this case, the operating system is running Linux 2.6.X,
and that's not the operating system being run
by my Kali Linux machine that you're seeing.
That's the operating system being run
by the server I just scanned.
And then I can go ahead
and we'll see that we had finished that scan.
We scanned only one host, one host was up,
and it took us 1.7 seconds.
Now, Zenmap is great and it's really powerful
and it's fairly easy to use,
once you get used to the way the command line works.
But if you want to do something even easier,
you can use a program known as Zenmap,
which is a graphical user interface for Nmap.
Now once we're in Zenmap, it's really easy to use.
You're just going to put in your target,
which again was that server, 10.0.2.6,
and then you're going to select the profile
that you want to scan with,
and it will create the command line
for Nmap that you would've used.
So here for example, is what an intense scan looks like.
If I wanted to go through here,
and maybe I just want to do a quick scan,
it'll go ahead and change that for me.
And then hit scan, and off it goes,
and it's going to scan that server.
In this case it came back in just about a fifth of a second.
And you can see again, all of those ports
and all of those protocols that are being used.
It also puts it in a nice graphical format
where I can click onto ports
and see them here in the port tab,
or I can look at the topology
and see how it looks on the network.
And in this case, I only had one host,
so it's not very interesting,
but if I looked at an entire network scope,
I could see all of the different hosts there,
and then click into them for their details.
And if I click on host details,
I'll be able to figure out
what information I know about that host.
Because I did a quick scan, I don't get the operating system
and other details,
that I would've if I had done an in-depth scan.
And so let's go back here, and we'll just change it
and do a deeper scan.
And here you'll see we'll do an intense scan.
I'll give it just about a minute here.
I'm going to fast forward so I can show you the results.
And now, if I go over here to my ports and hosts,
you'll see even more details.
Not only do I have the ports, the protocols,
the state, whether it's open or closed, and the service,
but now I know the version of the application
that's even running there.
So before we were able to find out
that FTP was running on port 21,
but now I can find out
that they're actually running the application called vsftp,
at version 2.3.4.
Now, as a network technician,
this probably isn't very helpful to me,
but as you go into security later on,
this is really important information.
Because it helps you to identify
what version is running on your different servers.
And that version can then be tied
to different vulnerabilities or attack methods.
So again, as you get into Security+ and CYSA+
and PenTest+,
these type of details
are going to become really important to you.
Next, if I go over here and go to host details,
we should see the operating system,
and in this case we do.
It's Linux version 2.6.9 through 2.6.33,
somewhere in that range is what this server is running.
And so that's the idea here as you're using Zenmap,
Zenmap just puts it into a nice graphical format
for you to see it.
You can do all of the same things using Nmap.
I hope you've enjoyed this introduction to Nmap and Zenmap.
They are both very powerful tools
that you use both in your technician days
and administrator days, as well as in your security days
as you progress through your career.
Now, what I would recommend is downloading Zenmap.
Go to Google and type in "Zenmap,"
and you'll find it and be able to download it quickly.
It runs on all platforms including Windows, Linux, and Mac,
and you can run it on your network,
you can run it against your friends,
you can even run it against scanme.org,
which is a server setup by Nmap,
for you specifically to scan
and learn how to use these tools.
Play around with them and get comfortable with it.
It's not something you need to know specifically in depth
for the Network+ exam,
but it is a great tool to have in your toolbox
as you go forth and start working in the real world,
because you're going to see it come up time and time again,
and it gives you lots of great information that you can use.