In this video we have Nmap,
the Network Mapper.
Nmap is used to discover hosts and services
on a computer network by sending packets
and analyzing the responses it receives.
Now Nmap provides a number of features
for probing computer networks, including host discovery
and service and operating system detection.
Nmap is a great tool to use when you're conducting
both port scanning or IP scanning.
Now, in addition to this, Nmap can be configured
to conduct fingerprinting of the services running
on those ports, which allows it to identify the versions
of the software being used.
This is really helpful in detecting vulnerabilities
in specific versions of services
that are operating on your network.
Also, Nmap is very useful when trying to create
network maps, documenting your network,
or identification of rogue network devices.
I want to show you hands-on how we use Nmap
by combining some commands into a real scan
and real information gathering techniques.
Now for this demonstration, I've put together this lab.
On the left side, this is where I'm going to be attacking from,
which is going to be simulating the internet.
I'm coming in from outside the network
and the router has certain things in place
to try to keep me out.
I'm going to attack from my Kalilinux command line environment,
which you can see highlighted
with the red dash lines, going to come in through the router,
which is separating the internet, the outside versus
the target network, which is the inside.
And so with our scans, we're going to try to discover
those three servers on the right,
the LAMP-Server, the Metasploitable2,
and the damn vulnerable web app or DVWA.
Now those all reside inside the 10.10.10.0/24 network.
So now that we are in the command line environment,
what are we going to do? Well, we first are going to want to find
out which things on the 10.10.10.0/24 network
are up and which ones are down.
So we want to use that ping scan.
Now, do you remember what the command is for a ping scan?
That's right. It's nmap -sn, and then the IP address.
So for us that's 10.10.10.0/24 .
It's going to go through and scan all 254 possible IPs
and find which ones are up and which ones are down.
Now it came back with four hosts.
What are those four hosts?
Well, the dot one is the router itself,
it's the internal interface of the router.
There is the dot 10, which is one of our servers,
the dot 11 and the dot 12, which is the other two servers.
So the dot 10 is going to represent the LAMP-Server.
The dot 11 is our meta Metasploitable2 server
and the dot 12 is going to be our DVWA
or damn vulnerable web app.
Now all we have at this point is knowing
that those three servers are up and responding to pings.
We have no other information.
So we're going to want to take it a step further.
Let's go ahead and do a SYN scan, which if you remember
the command is nmap -sS,
and then the IP address that we want to look at.
But I'm going to combine that with port 80.
So I want to figure out what web servers
are being run out of this network.
And then we're going to use the 10.10.10.0/24.
Now as I scan away, I'm going to check
all of the 254 IPs again.
And in this case we found there are four
web servers responding.
There's port 80 responding up as closed on the router.
It is open on the LAMP-Server, the dot 10,
it is open on the dot 11, which is Metasploitable2,
and it is open on dot 12,
which is the damn vulnerable web app.
So all three of my servers are running at least port 80.
Now let's dig in deeper on one of those servers
as we go further in our information gathering,
let's go ahead and do a SYN scan against the LAMP-Server,
which is the dot 10.
So we're going to do nmap -sS
and then 10.10.10 and we'll go ahead and search that.
And you can see now that there are more than just
the web server running, right?
There are three services running on this server.
There's an SSH server on port 22.
There's the web server on port 80
and the web proxy on port 8080.
Now that we found those, what about the versions?
What if I wanted to figure out what version
of a web server it was running on Port 80?
Well, how will we do that?
Well, we're going to use nmap -sV
and then the 10.10.10.10
And now if we run it, you're going to see a little bit
of a difference here.
So you're going to see it takes a little bit longer
to run this, but instead of half a second,
it's taking almost seven seconds.
The difference here is that I get the versioning associated
with each of those services.
So the same three services are up,
but I found out that it's running some form of Linux
and it's running Apache 2.4.18, which tells me
that I could start associating vulnerabilities associated
with that and attack this machine.
Now it tells me it's Ubuntu Linux,
but it doesn't tell me what version.
What if I wanted to go deeper and figure out the version
of this operating system, how would I do that?
Well, it's not SV because that's the version
for the service, instead, it's dash O
because it's for the operating system.
So it's nmap -O and then 10.10.10.10
and then we'll go ahead and hit enter and away it goes.
And it comes back in less than two seconds
and tells me that it is Linux somewhere between version 3.2
and 4.6.
So let's go ahead and take it a step further.
Let's combine some commands.
Let's go ahead and do an Nmap scan for dash ss.
We're also going to do dash SV for the versioning,
and we're going to go ahead
and add the dash O to get the operating system.
I'm going to do that against 10.10.10.10
through 10.10.10.12, those three machines
and see what comes back.
Now, you may have noticed that it keeps saying it's unable
to determine any DNS servers.
That's an error because I don't have this lab environment
connected to the internet.
So there's no DNS being resolved.
It's not an issue because we're using IP addresses,
but if I tried to do something like scanning google.com
right now, it wouldn't be able to give me that answer back
because it doesn't know what the IP address is for Google.
Now this scan is going to take a little bit longer,
so I'm going to fast forward
to when the scan comes back with the results.
Now the results have come back.
It took 140 seconds, so it took almost three minutes.
So this has come back with a ton of information.
So much so that actually scrolled off my screen.
So we're going to scroll back up to where I put in the command.
So there we go, there's the command we put in,
nmap -sS a SYN scan, -sV versioning
for the services, dash capital O
for operating system versioning.
And then 10.10.10.10 through 10.10.10.12
Now the first one it comes back with is the results
for 10.10.10.10,
which shows that there are 997 closed ports
'cause by default Nmap is going to scan the top 1000
commonly open ports.
You'll notice here there was those same three ports
that we found earlier, port 22, port 80, and port 8080.
And you'll notice it tells us what version of SSH
and what version of Apache is being run.
And again, the versioning of Linux was somewhere between 3.2
and 4.6, not very accurate.
Now if we look at the bottom of the screen,
I'm going to scroll it up to the top here.
This is the scan report for 10.10.10.11.
Notice this one has a ton of open stuff.
It only has 979 closed ports,
which means that there are 21 open ports
and you'll see them all shown on the screen there.
Things like FTP and SSH and Telnet and HTTP
and RPC bind and Port 139 and 445 for NetBIOS SSN,
which is samba for Windows file sharing
between a Linux machine and a Windows machine.
All of these different things
with all of these different versions.
Now, this is a great machine that we can target
because we have a lot of vulnerable apps on it.
Things like Apache 2.2.8,
there's exploits that exist for that.
There's vsftpd 2.3.4 for the FTP service.
That's a vulnerable version we can attack.
There's pro vsftpd 1.3.1,
there's MySQL version 5.0.51, right?
Lots of different pieces of information that we can use
to then later exploit it.
Now it does say that one service was unrecognized
even though it gave back data
and they weren't really sure what it was
because there wasn't a valid fingerprint
and you can submit it to Nmap
for them to try to figure it out better.
If you know what the service is, you could tell it
and then they can add that to the next version of Nmap.
Now, as we scroll down a little bit further,
we'll go through that signature that they gave us.
And you can see that the version
of Linux here was again version 3.2 to version 4.6.
So that, again, wasn't real helpful.
And the reason why we're getting that wide range
of operating systems is because this is all actually
being run in a Docker environment.
So they're all sharing the same operating system.
This is a container-based virtualization.
Now as I scroll on down, we're going to see the results
for 10.10.10.12,
and this one only has one port that's open
and it's running Apache version 2.4.10,
so again, we can go and look for something
that would be able to be exploited
and go after that server using that.
So that's the idea here as we start scanning
and figuring out all this information.