WEBVTT - This file was automatically generated by VIMEO 1 00:00:05.500 --> 00:00:08.600 Hello everyone. Welcome back to the windows pentesting Essentials 2 00:00:08.600 --> 00:00:11.800 course. In this video. We're going to be taking a look at Host Discovery 3 00:00:11.800 --> 00:00:14.800 with nmap. During the previous section. We 4 00:00:14.800 --> 00:00:17.600 actually took a look at how to create our virtual hacking 5 00:00:17.600 --> 00:00:20.100 lab, which is a nap Network and we 6 00:00:20.100 --> 00:00:24.100 very briefly took a look at how to actually perform host 7 00:00:23.100 --> 00:00:26.600 Discovery with a utility called net discover 8 00:00:26.600 --> 00:00:29.400 or whether we're going to be using a very very powerful tool 9 00:00:29.400 --> 00:00:32.600 called and map which allows us to perform a variety or 10 00:00:32.600 --> 00:00:35.000 a plethora of things or tasks in regards to 11 00:00:35.300 --> 00:00:38.200 Scanning on network. One of them is host Discovery. Now, in 12 00:00:38.200 --> 00:00:41.300 the following videos, we'll talk about performing service version 13 00:00:41.300 --> 00:00:44.900 detection, operating system detection scanning for vulnerabilities, 14 00:00:44.100 --> 00:00:47.500 etc. Etc. Now, the current virtual 15 00:00:47.500 --> 00:00:50.400 machine we're going to be using in this particular module is 16 00:00:50.400 --> 00:00:53.200 going to be met exploitable 3 and we're going 17 00:00:53.200 --> 00:00:56.500 to be scanning it. And I'll be showing you how to perform the very the various 18 00:00:56.500 --> 00:00:59.200 types of scans with nmap. So this video is 19 00:00:59.200 --> 00:01:02.400 going to be focused on host discovery, which is really, really simple. 20 00:01:02.400 --> 00:01:04.900 So our job now is to actually 21 00:01:05.500 --> 00:01:08.400 Discover what IP address. The Metasploit able three virtual machine is 22 00:01:08.400 --> 00:01:11.700 on. Now with nmap. You can pretty much run 23 00:01:11.700 --> 00:01:14.400 a variety of scans to test if the device is 24 00:01:14.400 --> 00:01:17.900 online, but the one I'm going to be showing you is the Ping option and 25 00:01:17.900 --> 00:01:20.400 of course, you can also run the don't being option, 26 00:01:20.400 --> 00:01:23.200 which is great. If you don't want to perform host 27 00:01:23.200 --> 00:01:26.500 Discovery, but you want to perform Discovery by 28 00:01:26.500 --> 00:01:29.400 actually performing a port scan, which I don't recommend if 29 00:01:29.400 --> 00:01:32.500 you're still in the scanning phases. So again 30 00:01:32.600 --> 00:01:34.900 to perform our scan, all we're going to do is type in 31 00:01:35.500 --> 00:01:39.000 Map and Alden say s n that is the Ping option. And 32 00:01:38.200 --> 00:01:41.700 then we provide our Network, IP address or 33 00:01:41.700 --> 00:01:44.600 subnet, and we can specify individual IP 34 00:01:44.600 --> 00:01:49.100 addresses. So for example, I can say 10 10.0.0.0 35 00:01:47.100 --> 00:01:51.000 one, which is the Gateway, 36 00:01:50.100 --> 00:01:53.300 the default gateway or the router IP 37 00:01:53.300 --> 00:01:56.200 address and we can hit enter and you can see 38 00:01:56.200 --> 00:01:59.600 it will tell us right over here, nmap scan report for the IP. The 39 00:01:59.600 --> 00:02:02.400 host is currently up. Now. You can see the very important thing 40 00:02:02.400 --> 00:02:04.800 with the ping. Only option is it does not. 41 00:02:04.900 --> 00:02:07.500 Not perform Port scanning, which is very important. 42 00:02:07.500 --> 00:02:11.000 So that means that this is going to be very, very useful and effective for 43 00:02:10.400 --> 00:02:13.800 scanning targets and discovering whether they are currently online. 44 00:02:13.200 --> 00:02:16.200 So to scan an entire network subnet. We 45 00:02:16.200 --> 00:02:17.000 simply say, 46 00:02:18.300 --> 00:02:21.000 And my s n. 47 00:02:23.800 --> 00:02:26.200 4/24 that was the subnet that we 48 00:02:26.200 --> 00:02:29.600 had created. And again, we can specify the actual 49 00:02:29.600 --> 00:02:32.300 subnet range, or you can specify the range of 50 00:02:32.300 --> 00:02:35.700 IP addresses. So I can say, 10.0.0.0 1 51 00:02:35.700 --> 00:02:38.600 to 255 and that will scan the entire range 52 00:02:38.600 --> 00:02:41.600 of 250 for IP addresses. Whereas 53 00:02:41.600 --> 00:02:44.400 also for using the forward slash 24, option 54 00:02:44.400 --> 00:02:47.600 will scan, the 254 IP addresses. This 55 00:02:47.600 --> 00:02:50.700 is going to scan our virtual hacking a lab Network. We're 56 00:02:50.700 --> 00:02:51.500 going to hit enter. 57 00:02:52.200 --> 00:02:55.600 We're going to give that a few seconds and there we are. You can see immediately, 58 00:02:55.600 --> 00:02:58.300 we get our results and with the ping scan. It 59 00:02:58.300 --> 00:03:01.200 is only going to perform the scan. It's 60 00:03:01.200 --> 00:03:04.100 only going to display the the actual devices or the 61 00:03:04.100 --> 00:03:07.400 hosts that are currently up. Alright. So for example, we 62 00:03:07.400 --> 00:03:10.300 have the default gateway of the router, mean it tells us that, that is 63 00:03:10.300 --> 00:03:13.300 up. We have the DHCP server running on 64 00:03:13.300 --> 00:03:16.600 10.0.0.0, which is also up. And 65 00:03:16.600 --> 00:03:19.500 then, of course, we have 10.0.0.0 six and 66 00:03:19.500 --> 00:03:21.800 ten point zero point, zero point nine. Now, if we check 67 00:03:21.900 --> 00:03:24.200 Our current IP address at 68 00:03:24.200 --> 00:03:27.400 least in my case. You can see that the Kali virtual machine is 69 00:03:27.400 --> 00:03:30.200 currently on 10.0.0.0 nine. So 70 00:03:30.200 --> 00:03:33.400 that means that the Metasploit of old three virtual machine is 71 00:03:33.400 --> 00:03:36.400 currently active on 10.0.0.0 X. 72 00:03:36.700 --> 00:03:39.100 All right. So what we're going to do now is I'm just going to take you 73 00:03:39.100 --> 00:03:42.600 through how you can also also run the don't ping 74 00:03:42.600 --> 00:03:45.300 option, which again is very useful. If host 75 00:03:45.300 --> 00:03:48.900 Discovery is being blocked by a firewall or 76 00:03:48.900 --> 00:03:51.700 by a, by a packet filtering system. 77 00:03:52.100 --> 00:03:55.200 All right. So what I'm going to do is I'll just clear that out, and we will 78 00:03:55.200 --> 00:03:58.400 try the same now, but we, since we know the IP 79 00:03:58.400 --> 00:04:01.800 address of the Metasploit Table, Three virtual machine, all 80 00:04:01.800 --> 00:04:04.500 we do is we're going to say nmap and we use the PN 81 00:04:04.500 --> 00:04:07.300 option. So that is uppercase p and lowercase n 82 00:04:07.500 --> 00:04:10.100 and this is going to avoid any type of 83 00:04:10.100 --> 00:04:13.300 host, Discovery. Remember, it's not going to check if the host is up 84 00:04:13.300 --> 00:04:16.700 its going to start targeting ports. So I'm going to say PN. 85 00:04:20.500 --> 00:04:23.100 And we're going to specify the IP and I'm just going to enter. So 86 00:04:23.100 --> 00:04:26.200 we'll give that a few seconds. And the way this works is it's going 87 00:04:26.200 --> 00:04:29.300 to perform a simple TCP scan or 88 00:04:29.300 --> 00:04:32.700 on the ports. And you can see right over here. It performs 89 00:04:32.700 --> 00:04:35.400 the actual port, scan, and it tells us right 90 00:04:35.400 --> 00:04:38.500 over here, the bottom nmap done. One IP, address, ask 91 00:04:38.500 --> 00:04:41.200 and and one host is up. And, of course, we know that 92 00:04:41.200 --> 00:04:44.700 it's up. So it's going to scan a thousand of the most common ports that 93 00:04:44.700 --> 00:04:47.300 you typically find and immediately gives us 94 00:04:47.300 --> 00:04:49.100 the port, the state and the service. So, 95 00:04:49.300 --> 00:04:52.600 Can see we have Port 21. 22, Port, 80 running soap, 96 00:04:52.600 --> 00:04:55.300 FTP, SSH and HTTP or a web server 97 00:04:55.300 --> 00:04:58.800 running respectively. So, again, now that we've established what 98 00:04:58.800 --> 00:05:01.500 IP address, the Metasploit about three virtual 99 00:05:01.500 --> 00:05:04.300 machine is on and what IP address it is, 100 00:05:04.600 --> 00:05:07.100 is actually assigned to. We can now move on to 101 00:05:07.100 --> 00:05:10.700 the next step, which will involve performing service version detection, 102 00:05:10.700 --> 00:05:13.200 operating system detection, Etc. So that we can 103 00:05:13.200 --> 00:05:15.000 learn more about our Target.