And Lou everybody when it comes to my advanced ethical hacking networking penetration testing goes
the syllabus will cover the part of state of kind.
In this so we are going to show you what first we are going to tell you a little bit about what is still
Iris skin and how how it works and how to fight against this.
So here we are going to use every well known tool tool which is snow.
We will use it only on carrying machine.
So here we are on a Mac.
So we are going to show just a really do stuff about it to install it on your Michael Clayton system
first thing first you have to do you have to go and copy this link.
We would amend you know to copy this command.
All right go and type this command in into your into your operating system and type this coming into
a terminal soloists Yeah I'm going to pass it here.
Everything will be provided guys.
So don't worry we don't wind though.
OK.
So let's make it bigger and well we don't need it we need quite and yeah let's make it this one.
OK here you're gonna go and post it here puts it into a terminal after testing so you know you have
to put your password your logging password of course and then now of two you're going to type this in
the comment would be this one so you copy D or B minus E and so into on its own so.
So you posted after pressing intel you can now wait and put your password and then you're going to type
this comment to install it's not and you're going to wait till it's installed after that while it is
installing.
So you have to abated by this common sudo show more or less.
And this.
So what I read after right after this and with Andrew if you want to to open your snot.
So we just take the comments not introduce what we are going to show to you or Kylie machine.
OK.
So let's go through they tell me to call first because this comment for you.
Well OK I don't need this don't OK so let's go here.
This process how it works.
The first thing for us this tale.
I can hear we love her still but I'm gonna tell you how it works.
And I'll tell you much.
And so here you have a description.
What you have to do.
You have to use the command say in my command and the IP address of your zombie machine and the IP address
if you're a victim.
Let's say here you're going to tape the in command and your type in the command.
So this is how the process will be.
It's one command then a command.
And here would be the IP address of the zombie approaches of the zombie.
So what we mean by that.
Here is the IP address behind which your IP address would be hidden.
And here it would be either visible of the victim machine.
So between this command this is so trying.
Warning on college UNIX machine.
And then you would make this can you the victim let's say ask some kind of security's properties or
securities.
System put in place that is let's say if a firewall or any idea is intrusion detection system it won't
get it your will IP because your IP is hidden behind behind the IP address of the zombie state is only.
Well so.
OK.
We will surely show how it works to you in a practical port.
After a few minutes.
So now let's let's explain to you how it is too critically.
OK.
So we can remove this comment so we don't need this fine.
We provided to you so that you can read it before starting your your particular port.
But if you already have a knowledge about it so it doesn't matter.
You have to.
You don't have to read it line by line.
OK.
So the first case is that you put these on B's IP address and recorded.
So you try to find it in an IP address which is in your environment.
So after that what are we going to do.
You're going to type in my command and hide yourself behind it.
So this is how it works.
And we quote it.
I mean you recorded that means you take note of it so that you can proceed with your will which of process
and forge a C on them.
Ford is saying us packets from the zombie and send it to the DOJ report on the target depending on the
port state the target's creation may or may not cause the zombies IPO just to be implemented.
We would show like probably zombies I.P. address again their target to fraud state is then data mined
by comparing this new IP address and so on software.
OK so two can just read it.
This is how the process is working.
You see it you put this on the IP address now where the attacker sends it synchronous acknowledged to
the zombie.
Yeah.
In the zombie net it's getting decent canoes acknowledge sends back it is to disclose its IP address.
So this step is always the same.
Okay.
Why you send your comment to the.
To the zombies and then the zombies sends the command to the target machine.
I mean to the victim.
So now being as the victim you get communication with the zombies and not with the attacker.
Okay.
You can read these readings with this and finding you're working.
Do scans on because you're going to find it.
So let's read a very good line.
The first blog for you the first step is executing an IP and your skin is to find inappropriate zombie.
It needs to assign that IP are just packets and commentary on a global word and horse it communicates
with bases.
It should be either a hand to this simple and of course as extra use traffic will bump up its IPO address
against.
Okay.
What do you mean by that.
So let's just show you a little panel or cutting machine just for a quick view to show you how to speak
or how to choose a particular zombie IP address.
So you open up your cutting machine okay.
So we save his vision so it's going to benefit all we have done before.
So let's just open it okay here.
So we're going to open a new terminal killer see you when I try to find out which which is on the IP
address you want to find.
But before let's check IP address here.
So.
Or IP address on the host machine is to be if and then we'll type it.
So yeah.
And you go here.
So it ends with 2 7.
Be aware.
Any time you change your network so your IP address.
No.
The last number or this number might get changed or even the whole number might get changed on your
local network.
It does it mean that it won't do what you have to be aware to check it again so that you make it so
that you make it comfortable to the future books machine IP and your host machine.
For example if in your copy machine your network let's say here to your network is is on Wi-Fi.
If now after some time.
So you even you just saved this version of the cutting machine and you put a keyboard in turn it then
now you're going to try to have to fix it here you know so you're going to have to fix it and you end
automatically you would find your your new Internet adapter so you get to fix it.
Otherwise it will give you it might give you it anymore.
All right.
So so let's close this.
Let's go here and you just type net discover as we have said guys all these tapes train and map then
map need tool need to you know make us proud.
It has broad US broad Armitage we have explained everything in our first lecture.
So how to get this option.
You just try to type in the Discover and stuff and then you press minus 5 and the E to eat is.
It's all introverts.
So to check your interface you have to just say let's make it let's let's wind let's just copy it and
copy okay.
Forget your user interface will have to take config.
So it is easier here.
So to see very well you just say.
If config.
Exactly.
So this is your IP address.
This is all IP address under this interface.
So now you're going to type that in a discourse or you just for a second shift in in we posted here.
Yeah it takes this one.
Okay.
And with this you're here you're gonna find a lot of IP address.
So let's just stop it because we don't have we don't need to just show you show you too many things.
Okay.
And you just pick one of them.
This is all IP address or host IP address or Mac IP address.
So this is the IP address of.
Oh.
This is the appearance of someone is and this is the seed.
Okay let's just shut it down like that and so much in state so that we don't need to start a new stuff.
Okay.
Yeah.
So let's look at ways.
So this is how it works.
So you have to find it working.
I do a zombie zombie so that you make it work.
Okay here.
This is a very way example.
Once a suitable zombie has been flown as big pig it has been picked up by you to performing is it is
very easy as we have shown you as we have showed you earlier in in our killing machine.
So since you have your zombie it is very easy.
You see a map of port network and minus people again in the minus airs.
This is a scan and I I do it and you put your victim so your victim might be in April dressed as whereas
as an as a website domain.
So again a new justice.
Start your scan.
Okay.
This is how it works this is how it works implementation are going where decision call a all scan.
Step by step to describe a scan and the very fundamental level the map implementation is far more complex.
Key differences are part of reason for quick execution and we didn't then see to reduce first positive.
Of course it will be so many false positives.
Because sometimes if your IDE is intrusion detection system has set up in such a way that it detects
ICMP or DCP European so-and-so.
So when the attacker is aware of these things what he can do he can try to do some tweaking stuff like
like hiding behind something or you know so that you don't get it.
So while you get who you have a notification from someone who's trying to get into a system and that
one has an IP address of 0 0 1 9 2 a BLA BLA BLA 1 1 1 for example it's a but it's an innocent IP address.
It's not the attacker and address.
You know what I'm saying.
So this is what we call first positive.
So to make your stuff much more so you want to if you want to get if you want to know how deep penetration
is doing or is wanting you can just get packet trace packages is it a good command to detect how the
communication is form you as that occur to the zombie and then from the zombie to the victim from the
victim to the zombie from the zombie to the victim again from the zombie to the victim and from the
zombie to you.
So only one communication is is getting you as the attacker is the zombie the victim never which is
you the victim only.
Which is the attacker aside we are we are going to explain to you guys fight against steel ideal skin.
So.
Okay now let's try to show you how the attack is working.
Now let's go back to Kelly machine so we can just minimize it before going to the Security Board because
fate again is still a big screen is the security.
But what you have to do you know so again before going to this we are going to show you how the attack
or how the penetration can be made.
So we call you again get restarted.
Good
or good so we can minimize it.
Or just close it.
All right.
So now what we are going to do week as we have said is we have already find some I.P. address.
I mean some target so we can try to see if they host it up or down.
So to do that let's let's just waste this first came with a map and scan Network SCAN network in what
we are going to do.
We are going to tape the range of IP address so before that let's check it again so that we show it
to you or IP.
This was a copy machine was this was 1 5 9 0 key note the net mass is 255 255 255.
That means so we can assume that the range is 24 slash 24.
So when we type in LA minus n so we take the IP range and the IP range at 1 6 8 and one dot one you
see one dot one and then here we type 24.
And then so we can put it into.
Now we are waiting.
Okay.
It seems to us how many computers are up so let's say let's check it close it up.
So okay I can tell you is a super computer so we have seen it before in all Hear hear.
So we have seen it.
This was computer so much skin.
This is one to me again.
Oh no I knew MAC address.
I'll kill your kid on high.
OK.
Chose my book.
Of course this is awesome.
This is almost machine.
I mean this Mac machine.
All right.
So he sees the MAC address of it.
So we have one good omen.
We have 1 2 2 2 3 4 5 6 6 machines that forget that this is a all or candy machine.
Okay.
All right.
Now since we have a lot of computers which are or let's say we have a lot of devices which are up so
we are to be we are going to be careful.
We will just make a pediatrician to all computers.
So these computers as you said earlier this is my candy machine.
This machine like this.
I don't know it.
So let's go again.
This I know it would.
I don't have a wide access to it.
OK.
This is my MacBook IP address.
Okay.
We can use it.
And this one is my own to address
we have to note because many people do you think that using insiders can and they can just do it quickly
with any kind of computing system with any kind of operating system that they are using.
But we are far away from this kind of deal because it's not to some.
So one might be lucky enough if if they use and not version of Windows operating system and then now
this can.
So let's say in.
Wait a.
Let me check it.
You like the foot and mouth scan a door and then you put it would this these numbers here.
So this is the IP address of.
Let me check it.
Let me put our up.
OK.
So this is the IP IP address of your victim.
And this is the IP address of your zombie.
But many people just say that.
Okay.
It's enough to just put a port behind it.
This kind of port because sometimes usually it's like that but it it's working.
But on some old version of Windows OK let's say Windows 98.
Yeah.
So it might work.
But nowadays it won't work anymore because some systems they have already put it kind of ISP is inside
of it so that they see this.
I do scan will not intercept or or will not cross the border so that they don't reach the victim let
us just give you a short overview of how it works.
Okay.
Let's go to.
All right.
OK.
Fight against so we have to evolve.
All right.
So now this step before going into this step is is that fighting a zombie IP address.
Is not that easy.
As as you might think you just try to discover and then you pick a number you use it as I do or always
on B and then use an order one as victim No no no no.
It's a day that you have to find a way.
This only means that that IP is vulnerable.
So since that IP is vulnerable sometimes it might happen that if we use it so we can cross the border
then we can try to make discarding of.
So let's say and map in much scripting engine provides provide this quite IPD IP sequence to detect
new book Zombie devices in the following is input to make it so.
But first thing first.
Who noble host are classified as incremental or a later engine.
Just for a quick overview if we go up up up up up.
So we have doing it.
OK.
So this is an incremental.
So we will show you it in use against guys.
So don't worry.
Yeah.
So it did the vulnerable host.
It's classified as being incremental sometimes if you find it.
Let him see.
It's not that white for you because you don't need it as a latency window indeed as increment or not
I.
So now what we are going to do the first step when you want to make a scan you have to find is zombie
the zombie ages is renewable.
Listen you have to be aware of or so you can get a lot of false positive or false negatives of the result.
Yeah.
All right.
So he you you it might have happened if you use this this IP.
OK.
And this is always on me.
This is all on the end and this is a victim.
If you use it sometimes or all or once on Windows so all windows.
So it might work but sometimes it might not work either.
It did.
It depends.
For example Windows 2000 to it might not work but it will be enough just to put the deposit number of
that vulnerable host.
So I mean the zombie to get it.
You have to and map it.
You can.
We are.
We were trying to to map this IP address so that we can find deposit numbers which are opening.
So if we do we did find a road we would find a D.
We find 4 4 3 0 4 SSL and then we find 6 to 1 for DCP and 9 1 1 9 1 he was a war stuff like that but
it's not the case because how would we know that it is a zombie we can't know that we can't just say
that this IP address we can use it as I door or as a zombie because we don't know if it is you know
we.
No of course not probably.
So yeah we have to find a way to do that.
So what we are going to do we don't put the port number anymore because as we have tried it doesn't
work.
Just just for the sake of this video because we wanted to show you guys maybe many people did just use
it on YouTube or know Jimmy awesome on YouTube but they don't tell you the reason behind same because
if that IP address is a new one to IP address or a few windows 10 or Windows 8 lets say something like
that it won't work because the ISP is already installed there or they might have some kind of firewalls
installed there and then you can't cross the border to get to the victim IP or to get to it to get to
the victim own computer devices.
So let's say or what we can do.
So first thing first we have to find a way to get some IP address see some IP addresses which are which
can act as a zombie to do so.
We just pressed this script wind this clip and map and P D 1 80 and would press it by pressing it you
will you will find error or download a load of a lot of information about it and you might just have
to just look for the ones that say incremental and then just now you press enter after pressing enter.
So everything will be alright.
OK so let's proceed to just show what we are not going to let it scan because it does take time maybe
five minutes or 10 years or probably even more probably for four minutes as well not to be exaggerated.
Yeah but so if you just have to press enter and then wait for the map to just show you the auctions.
OK.
So we just press control seek to control it and then we are going up in order to show you always old.
OK.
So this is always all but let's go to the very beginning.
You see guys it's a lot it's a lot it's a lot it's a lot but so many first positives result as well
so on.
OK now wait a moment.
Let's go up to see where we have begun
Let's Google at Google Earth.
Probably we are next to this.
So we don't know but obviously it shouldn't be that that.
OK so this is what we have type guys so this comment so you type it and then you will get a lot of information.
Now we aren't seeing in maps can we port for blah blah blah.
And that IP address you have to look for here if it is set in sea or if it is incremental or we don't
need that and so we need to see increment or so let's go down to go down one to search for incremental.
So nothing nothing.
Let's go let's go let's go.
So we have OK.
This is when domains.
OK.
So let's go let's go down to see if we will find more incremental service they would want to give.
This one is one of them.
OK let's go.
We should find some not so.
OK so this IP address and Skynet.
And then we have detected that the whole script was old AI IP I.D. sake is incremental.
This is what we need to do.
By the way you're going to try to use this IP address to see if it's really a zombie IP address.
We don't know to which it belongs.
It's just say that here board.
It's not in or network environment at all.
So it is risky but for the sake of view.
So we do we know that it's it's not going to do a black scanning or an illegal scan.
So we are going just to try to use it as a zombie and then to find it to put it to to see if we can
get to a victim IP.
So so we copy it and copy it like that and then we can open up and in a lift but it just does it to
here.
Come on we will pass it here.
And then if we want to copy all this stuff we can just try to do like that and so that we get all the
information because it's a lot of guys so controlling it so impressive.
Hey sit down.
All right.
So now we're going to proceed to them to their command which will allow us to make the ideal scan.
So.
All right.
So now let's type and map and map and minus S minus minus as I said before we can type minus IP network
port number and okay.
So we will use this as port so we copy each control C Okay.
Jose and so we proceed here and then now we are going to use the IP address of Windows 7 mushing that
windows 7 machine.
We have used we have used it in the previous videos of 0 0 of the networks cunning so we can just check
it to see it.
But of course we are in a different environment sort of so the API just might get changed as well.
So but the IP address we have at it for it.
It was let me minimize it.
It was something like let's say the name is John.
So let's it's it's the weeknight that moment who key the name in it is to use easy my book.
No this is to use easy who you want to use is to use z.
Okay.
This one so that we're going to use it.
Let's say this we copy copy it and then we persevere there.
So now so you can present it.
And we going to see how would we look like so it will probably take a little more time.
We're going to post the video deceived.
Exactly what we mean.
Because all of them all of the port all of the IP address let me her phone.
Even if they are like incremental what they're all supposed to do.
So what I mean by that to the first positive it's a must is the most critical problem the issue that
we can face when we want to make do a test and I do scan sort of here.
Let's go here.
When I show you as you can see so most of them are first quality the most difficult step when carrying
out in a scan is to find you vulnerable as on board.
We have found no IP address.
We choose your imaging between 1 2 1 6 8 1 and something like that.
We just find many things like one day one you know and much more like it's a one off one five four.
And so and so and so.
So it's a different code to many reasons and different stories and that many ISP broke and this type
of kind of skin and muscle of operating system Windows 8 Windows 7 Windows XP or 2.
So they assign an API you want only there for the file was in honeypot may return as the first positive
so that's why it doesn't work.
So we're going to try to look out with these tools showdown and Festivus Congressman that we can proceed
to day scan.
All right after some time I will come back and then we presenter.
Now here we are after two hours and 37 minutes.
You see now we are on 33 percent if we get these messages this message.
So yeah we still have to wait because we are not even in a half of it.
So let's just wait a moment.
Well it's nice to be a boss you wait you know till we get the results.
So yeah.
Or if you want I would advise you don't put it up to 255 but you can just put it up to one hundred Oh.
From whom.
20 or from 80.
Okay let's see from 80 and to 150 all to fifty five.
Yeah.
All right.
So we can slow the process because it it it takes us too long time.
See.
We have consulted at eight hours and twenty eight minutes.
So for four forty eight minute Prop. 8 percent only.
That means so when you all were wounded 16 hours as we have already said to you guys.
So you know the best thing first is is trying to use the updated version of a new operating system for
example.
You can stop using Windows XP or Windows 98 or 95 because inside these operating systems the ISP dot
Burton doesn't blocks this type of scan.
So that's why it is it is able to make that kind of scan so.
But in Windows 7 or Windows 10 or Windows Vista on Ubuntu they don't allow this kind of scan but for
the sake of this video we are going to showing you how to how it's working in the windows nineteen ninety
five.
But before that.
So as we have said many ISP Brooke these type of scans or what is ISP ISP is the internet services providers.
So nowadays the new operating systems let's say or Ubuntu or Linux.
They block this kind of scan and then even door to find a zombie IP address.
It's very very very difficult.
So while while you're warning your Windows XP or your windows or your Windows 95 so you can train to
find this zombie API IP address there when you trade and it's working.
So now you can it to this kind so that's all you need.
First thing first you need the ideal scan which means that you you have to find a zombie IP address
so that you can hide yourself behind it.
All right.
And mobile phone operating systems assign a p a d o n dumbly.
So that's why we have showed you earlier in video so that in all color UNIX machine there are some there
are some IP addresses which are challenging like or randomize it on increments all the ones that we
need to proceed to the ideas con is the incremental ones because if it is set as IP Ada when normally
it's very very very difficult next to impossible to use that IP address as a zombie IP address configured
firewalls and honey put me return first positive version as well to many server.
Now they have a firewall which is tip between so that when attackers are trying to penetrate to the
system.
So you have to first penetrate to the firewall by the sound of it as good as you set your firewall.
It's the more chance you have to protect yourself.
You know you give some restrictions from your power.
For example you would define some specific MAC address and some specific IP address orange which should
be code by your firewall.
They are for any external IP address which is which is and that belong to your whinge.
They can't penetrate your firewall because your firewall was very well set up by you before.
OK.
So you have to know that.
So let's go into the practice but we will use all Windows 95 and Windows XP so that we can try to find
a zombie if we if we will have chins and to proceed to the demonstration.
All right
OK.
Hold.
OK.
Now we can try to make some configurations into or machine.
So let's try to put it on net operating system.
We don't want to use which add up to now.
So let's make it so that we can set up Windows or Windows machines as well.
OK.
We'll put it on.
Not network.
All right.
Not on the net.
And so we proceed.
And then so it can start cleaning this machine.
So we have had it as a saved version already so we're going to try to just modified a coil and try to
close it.
Yeah.
Because you know so you have to find this way to find the machines which are up.
All right.
So before starting so let's try to reconfigure.
So do this term we know because we don't want it to appear like 1 9 2 because we have change IP address
to be on net network not on which network.
So let's make it here.
So we go to added fiber frenzies.
Carlo let's check white on black white on black clothes.
OK so now we can close this thing know so once they do it doesn't matter what for the sake of this video
is all we are going to.
Just to to restart or carry machine.
OK
now we will use or we not.
We are going to try to find home team members that are on network so we can type if we want and discovery
we can or we can use any map as well.
It means that scum network and then we put this in would slash 24.
That's because or sudden it is 255 255 255.
And so if you look at it you will have to try to type if country.
Oh it's you who's come in for us.
So we was willing to use again and map it into space.
My name is P means put an end network
in then good smart small s big incompetent.
Heidi sky.
Either in here or after you good it is the IP address.
I mean the IP address behind which you can hide yourself and you've been the victim.
And then white I can present or if you want your page to go to a range port.
But for now you can put it days and just wait.
What do we use.
We use when go in motion so that we can of the zombie IP address and try to make it bigger.
KAREN So guy using data.
I don't.
Not.
One hundred and seventeen is 1 1 OK.
Hillary said it must be incremental class.
How.
We have found one or two to number one share in the victim.
OK.
Why not.
We don't care because even if the victim so kind of 40s or ideas detection file we never know that the
attack was from us.
I mean from the prom or machine cause we we hide said it is only
now we can try to do just this.
Our ob gyn put it could put a specific number so it's in the range.
No you'll find on in report which are between 20 and 100 so let's check it out this week.
This is the language that we find here.
And this indicated might be all right.
So now we can present a
let's say it will not show any number like 4 6 4 4 4 5 3 8 9.
You see everything in Xinjiang between 20 and 200.
If you want we can find.
It is how the process is working.
By sending packet in which three kids can try out in the type pocket traits which really show us and
tell me not to process.
Okay so so as you say so this is how the process went in.
That is really important.
It puts the packet which we're sending a team from the US only to see that there is no communication
between the distorted print.
I mean if the attacker and different communication communications we show their attacker is only his
own attacker in the zombie victim victim his own.
You can never find a victim to the attacker.
Never.
That's how can you lose these fabulous can to hide themselves between now the IP address
is on me to attacker only to victim.
And again it would define attacker to zombie.
So that's how it's working guys.
So we just wanted to show it to you because for the sake of this video but not nowadays.
So this kind of scan that's so powerful because so many new operating systems so they have a really
was set of ISP so something like that and firewall is only make use violence in that.
So that gun can be eliminated totally.
OK.
Thank you.
See you in the next video.