WEBVTT - This file was automatically generated by VIMEO

1
00:00:01.900 --> 00:00:04.100
 Hello everyone. Welcome back in this video. We're

2
00:00:04.100 --> 00:00:07.500
 going to be taking a look at service Vision detection, operating system

3
00:00:07.500 --> 00:00:10.100
 detection and how to perform various types of

4
00:00:10.100 --> 00:00:13.800
 Port scans with nmap. All right. So now that we've established what

5
00:00:13.800 --> 00:00:16.200
 IP address, our Metasploit Bowl

6
00:00:16.200 --> 00:00:19.300
 three virtual machine is running on. We can now start trying to

7
00:00:19.300 --> 00:00:22.900
 probe it for more information so that we have a better understanding

8
00:00:22.900 --> 00:00:25.300
 of what we're dealing with. Now, as

9
00:00:25.300 --> 00:00:28.900
 I said, we already know that the device is up and

10
00:00:28.900 --> 00:00:29.900
 we can now

11
00:00:30.300 --> 00:00:33.100
 begin with our first step, which is performing Port scanning on the

12
00:00:33.100 --> 00:00:36.500
 target. So if I run a default nmap scan, which

13
00:00:36.500 --> 00:00:38.800
 is simply typing in nmap and the IP

14
00:00:40.200 --> 00:00:44.000
 So that's 10.0.0.0 six and I just hit enter what

15
00:00:43.300 --> 00:00:46.100
 this can does it. It will scan a

16
00:00:46.100 --> 00:00:49.100
 thousand of the most commonly used ports. And

17
00:00:49.100 --> 00:00:54.600
 when we talk about TCP ports, we have about 65535

18
00:00:52.600 --> 00:00:55.400
 ports in

19
00:00:55.400 --> 00:00:58.100
 total. And what this can will do is it will

20
00:00:58.100 --> 00:01:01.300
 scan for 1000 of the most commonly used Port.

21
00:01:01.300 --> 00:01:04.700
 So that's something that you need to take into consideration very,

22
00:01:04.700 --> 00:01:07.200
 very closely. Alright, so you can see that

23
00:01:07.200 --> 00:01:09.100
 will tell us right over here. The host is up.

24
00:01:09.300 --> 00:01:12.200
 So it performs some form of host Discovery based on

25
00:01:12.200 --> 00:01:15.300
 the responses. It's getting back from the port's because in

26
00:01:15.300 --> 00:01:18.900
 essence, what we're doing is we're sending a syn packet, right?

27
00:01:18.900 --> 00:01:21.500
 And if the device responds within

28
00:01:21.500 --> 00:01:24.300
 rst packet, or if or, if

29
00:01:24.300 --> 00:01:27.200
 we don't get a response again, nmap is able to tell, well, is

30
00:01:27.200 --> 00:01:30.500
 that host up or not? So you can see, we scan

31
00:01:30.700 --> 00:01:33.500
 thousand of the most common ports, and it tells us for the rest

32
00:01:33.600 --> 00:01:36.500
 there, for the rest, which is 990. These

33
00:01:36.500 --> 00:01:39.100
 are all filtered or closed. So, the results were

34
00:01:39.300 --> 00:01:42.200
 Get back are going to be very similar to the results. We got back

35
00:01:42.200 --> 00:01:45.200
 in the previous can because we have pretty much not specified the port's that

36
00:01:45.200 --> 00:01:48.300
 we want to scan. Now. Let's talk about Port

37
00:01:48.300 --> 00:01:51.600
 scanning a little bit more. If I wanted to scan 1000

38
00:01:51.900 --> 00:01:54.700
 or 100 of the most commonly used ports

39
00:01:54.700 --> 00:01:58.500
 and I can do that by typing in nmap F4

40
00:01:57.900 --> 00:02:00.600
 and the f means fast. This

41
00:02:00.600 --> 00:02:03.400
 is a fast scan in that. It reduces the

42
00:02:03.400 --> 00:02:06.400
 amount of ports, the amount of ports that you want to scan.

43
00:02:09.400 --> 00:02:12.300
 We hit enter and then we'll give that a few seconds. There.

44
00:02:12.300 --> 00:02:15.500
 We are that took much less time. And again, this can be used

45
00:02:15.600 --> 00:02:18.200
 to some extent for host Discovery. But there we are.

46
00:02:18.200 --> 00:02:21.300
 We can see that it tells us the host is up and it's scanned. 100

47
00:02:21.300 --> 00:02:24.100
 of the most common ports and ninety four of them are going to

48
00:02:24.100 --> 00:02:27.300
 be filtered or closed. The rest of them are open which are actually

49
00:02:27.300 --> 00:02:30.600
 listed here. So you can see that included in

50
00:02:30.600 --> 00:02:33.000
 some of the most commonly used. Ports are going to

51
00:02:33.300 --> 00:02:36.500
 be, you know, really common services like

52
00:02:36.500 --> 00:02:38.200
 FTP SSH.

53
00:02:38.400 --> 00:02:42.000
 Server running on Port, 80 or Port? 443.

54
00:02:41.200 --> 00:02:44.300
 I also have an HTTP proxy running on

55
00:02:44.300 --> 00:02:47.800
 port 8080, so on, and so forth. So,

56
00:02:47.800 --> 00:02:50.400
 that is out about to specify a hundred of the most

57
00:02:50.400 --> 00:02:53.200
 commonly used parts. Now, if we want to specify a

58
00:02:53.200 --> 00:02:56.200
 custom range of ports, we can also do that. So if I

59
00:02:56.200 --> 00:02:59.700
 say nmap and I say something like,

60
00:02:59.100 --> 00:03:02.500
 I can use the P option. So that is minus B.

61
00:03:02.800 --> 00:03:05.500
 Again, specify a single port. So I can say, I only want

62
00:03:05.500 --> 00:03:07.100
 you to scan Port, 22.

63
00:03:10.500 --> 00:03:13.300
 And I hit enter, you can see it will tell us the host

64
00:03:13.300 --> 00:03:16.100
 is up and it only scans that particular Port. Now. I

65
00:03:16.100 --> 00:03:19.500
 can also specify a range of ips or more than one IP.

66
00:03:19.500 --> 00:03:22.700
 So I can say what 22 and Port,

67
00:03:22.700 --> 00:03:25.500
 443, right? Which again we can test for

68
00:03:25.900 --> 00:03:28.100
 and you use a comma to separate the posts that you

69
00:03:28.100 --> 00:03:31.900
 want to scan. I'm going to hit enter again. We'll give it a few seconds and

70
00:03:31.900 --> 00:03:34.600
 there we are. You can see it tells us that Port. 22 is

71
00:03:34.600 --> 00:03:37.600
 currently open. However for Port, 443

72
00:03:37.600 --> 00:03:39.700
 is currently filtered and that could.

73
00:03:39.900 --> 00:03:42.200
 By through a firewall or a

74
00:03:42.200 --> 00:03:45.500
 packet filtering system. And essentially, that

75
00:03:45.500 --> 00:03:48.400
 means that it's filtered or closed, which means we really do

76
00:03:48.400 --> 00:03:51.600
 not have direct access to it, or we can't communicate directly

77
00:03:51.600 --> 00:03:54.600
 with it. And that's the, of course, the conclusion that

78
00:03:54.600 --> 00:03:57.100
 nmap has come to so you can do that or you

79
00:03:57.100 --> 00:04:00.400
 can specify a range of board. So I can say,

80
00:04:00.600 --> 00:04:03.600
 I want to scan ports, 21 to

81
00:04:03.600 --> 00:04:06.100
 Port. Let's see. 88, right? So

82
00:04:06.100 --> 00:04:09.400
 I want to, I want to scan all ports, between Port 21.

83
00:04:09.800 --> 00:04:12.300
 And port 8080 are you can use the hyphen or

84
00:04:12.300 --> 00:04:15.600
 the minus key or the symbol here to specify that

85
00:04:15.700 --> 00:04:18.200
 and we hit enter and of course it's going to scan all of

86
00:04:18.200 --> 00:04:20.100
 those ports. So we'll give it a few seconds.

87
00:04:28.600 --> 00:04:31.300
 All right, so the scan completes and it gives us the results we

88
00:04:31.300 --> 00:04:34.200
 were looking for so you can see. We have it scanned, all the

89
00:04:34.200 --> 00:04:37.500
 ports, which is something you can see about eight thousand

90
00:04:37.500 --> 00:04:40.600
 and sixty ports between Port 21 and

91
00:04:40.600 --> 00:04:43.100
 port, 8080. And it gives us all

92
00:04:43.100 --> 00:04:46.400
 the results right away. So again, we're we're getting an idea of what's running

93
00:04:46.400 --> 00:04:49.500
 on the target. But what if we wanted to scan all

94
00:04:49.500 --> 00:04:52.600
 65535 ports?

95
00:04:52.900 --> 00:04:55.600
 Well, how would we do that? We can specify Port 1

96
00:04:55.600 --> 00:04:58.300
 to 65,535. How

97
00:04:58.500 --> 00:05:01.600
 Over what we can do is we can use the minus

98
00:05:01.600 --> 00:05:04.600
 P minus option, which means scan all

99
00:05:04.600 --> 00:05:07.200
 ports. So what we're going to do now is we're just going to

100
00:05:07.200 --> 00:05:08.900
 enter and let's see what it gives us.

101
00:05:10.900 --> 00:05:13.200
 All right, so the scan is complete and you

102
00:05:13.200 --> 00:05:17.200
 can see that it scans all 65535 ports

103
00:05:16.200 --> 00:05:19.800
 when it tells us that out of those 65

104
00:05:19.800 --> 00:05:22.500
 thousand five hundred and nineteen of them are filtered or

105
00:05:22.500 --> 00:05:25.500
 closed and it displays the rest of them to us, which

106
00:05:25.500 --> 00:05:29.700
 is again, very, very useful because now we understand entirely.

107
00:05:29.700 --> 00:05:32.300
 What we're dealing with in regards to the services that are running

108
00:05:32.300 --> 00:05:35.400
 on the target. So now that we've talked about Port scanning

109
00:05:35.400 --> 00:05:38.400
 in outer space of five Area sports, let's talk about how

110
00:05:38.400 --> 00:05:40.200
 to enumerate more.

111
00:05:40.300 --> 00:05:43.400
 From the target. So one of these pieces of information that

112
00:05:43.400 --> 00:05:46.200
 we are after is the service version that's

113
00:05:46.200 --> 00:05:49.500
 running and the service version of the service Banner gives

114
00:05:49.500 --> 00:05:52.500
 us the exact version of the piece of software that

115
00:05:52.500 --> 00:05:55.600
 is running on each of these ports. For example, if

116
00:05:55.600 --> 00:05:58.600
 we have an FTP Port running or the FTP Service

117
00:05:58.600 --> 00:06:01.400
 running, we want to know what version of FTP is

118
00:06:01.400 --> 00:06:04.200
 running. And that helps us as pentesters because we can

119
00:06:04.200 --> 00:06:07.700
 search for potential vulnerabilities or exploits that

120
00:06:07.700 --> 00:06:10.200
 exist for that particular version and that

121
00:06:10.200 --> 00:06:13.500
 that helps us understand how to Target, how to approach the

122
00:06:13.500 --> 00:06:16.300
 the actual Target and what exploits to

123
00:06:16.300 --> 00:06:19.300
 use. So on and so forth. And then another piece of

124
00:06:19.300 --> 00:06:22.500
 information that we are after is what operating system

125
00:06:22.500 --> 00:06:25.500
 is running on this Target, and nmap can do all of that.

126
00:06:25.600 --> 00:06:28.100
 So, to do this, all we need to do is type in and

127
00:06:28.100 --> 00:06:32.100
 map, and we can specify, we can combine commands

128
00:06:31.100 --> 00:06:34.200
 or options with nmap. So let's say,

129
00:06:34.200 --> 00:06:37.200
 I wanted to scan. Let's see. I

130
00:06:37.200 --> 00:06:40.200
 only wanted to scan. We want to run a default scanline.

131
00:06:40.300 --> 00:06:43.600
 That will only scan 1000 of the most common ports will say nmap

132
00:06:43.900 --> 00:06:46.200
 and to scan the service versions. We

133
00:06:46.200 --> 00:06:49.500
 use the - SV and the S is lowercase. The

134
00:06:49.500 --> 00:06:55.900
 V is uppercase and then we specify the IP address like

135
00:06:55.900 --> 00:06:58.500
 so and we hit enter. All

136
00:06:58.500 --> 00:07:01.700
 right, so we're just going to let that give us all these service versions

137
00:07:01.900 --> 00:07:04.700
 that are currently available. Now. This is going to take longer

138
00:07:04.700 --> 00:07:08.100
 than a typical port scan. Because now nmap

139
00:07:07.100 --> 00:07:10.100
 is actively trying to probe the

140
00:07:10.400 --> 00:07:13.700
 The actual device and its trying to get all the relevant banners,

141
00:07:13.100 --> 00:07:17.000
 so that it can actually again, understand or

142
00:07:16.200 --> 00:07:19.200
 it can actually deduce what versions are

143
00:07:19.200 --> 00:07:22.200
 running on those particular Port. So again, we'll just let this

144
00:07:22.200 --> 00:07:25.700
 can and I'll get back to you when this is complete. All

145
00:07:25.700 --> 00:07:29.100
 right, so the scan is complete. You can see took about 122

146
00:07:28.100 --> 00:07:31.600
 seconds. It's going to take significantly longer

147
00:07:31.800 --> 00:07:34.400
 primarily because it's going to try and

148
00:07:34.400 --> 00:07:37.100
 probe the target more as I mentioned. So if

149
00:07:37.100 --> 00:07:40.100
 we take a look at the results, and now they're going to be vastly different.

150
00:07:40.300 --> 00:07:44.300
 The results we got earlier where we only have the port. We

151
00:07:43.300 --> 00:07:46.100
 we only at the Port, the state and the

152
00:07:46.100 --> 00:07:49.400
 service. Now, we have the port State service

153
00:07:49.400 --> 00:07:52.500
 and the version. So that's the additional column that's added here.

154
00:07:52.800 --> 00:07:55.200
 Now, given that we only scanned 1000 Bots. It's only

155
00:07:55.200 --> 00:07:59.200
 going to display those results. So you can see for example on

156
00:07:58.200 --> 00:08:01.500
 the FTP Port, we have Microsoft FTP

157
00:08:01.500 --> 00:08:04.300
 D. Alright, so now we understand. Firstly, that we

158
00:08:04.300 --> 00:08:07.600
 are running a Windows box directly from that

159
00:08:07.900 --> 00:08:10.100
 and it's running FTP Dee really did.

160
00:08:10.200 --> 00:08:13.100
 Not get much information out of that. But for example, on the

161
00:08:13.100 --> 00:08:17.100
 SSH Port, we can see we have openssh 7.1 so

162
00:08:17.100 --> 00:08:20.400
 that can be used again for vulnerability scanning. And

163
00:08:20.400 --> 00:08:23.500
 we can then potentially find exploits. If they exist for

164
00:08:23.500 --> 00:08:26.400
 this version of openssh, you then have the

165
00:08:26.400 --> 00:08:29.900
 web server, which is running, Microsoft IIs, httpd

166
00:08:29.900 --> 00:08:32.400
 7.5, and then we have custom

167
00:08:32.400 --> 00:08:35.200
 services like, the HTTP proxy that are, that is

168
00:08:35.200 --> 00:08:38.300
 running sunglass fish and this is the open source

169
00:08:38.300 --> 00:08:40.100
 Edition this version for. So you can see

170
00:08:40.300 --> 00:08:43.400
 It's very, very useful information because we can actually

171
00:08:43.400 --> 00:08:46.500
 numerate actual versions of software that are running. And

172
00:08:46.500 --> 00:08:49.200
 then, before we actually start targeting the device or

173
00:08:49.200 --> 00:08:52.500
 performing exploit, we can again structure our

174
00:08:52.500 --> 00:08:55.400
 attack based on low-hanging fruit. So

175
00:08:55.400 --> 00:08:58.200
 again, these are the actual results returned to us.

176
00:08:58.200 --> 00:09:01.400
 Now, you can see, for example, here, it

177
00:09:01.400 --> 00:09:05.300
 tells us that one service is what was unrecognized, despite

178
00:09:04.300 --> 00:09:07.600
 returning the data and it actually gives

179
00:09:07.600 --> 00:09:10.100
 us the fingerprint here. So again, this fingerprint can then

180
00:09:10.200 --> 00:09:13.800
 Be used for future analysis to try and US understand what

181
00:09:13.800 --> 00:09:16.400
 what actually actual service was was

182
00:09:16.400 --> 00:09:19.300
 running here because nmap was not able to do to come

183
00:09:19.300 --> 00:09:22.600
 to a conclusion as to what was running. Alright, so that is service

184
00:09:22.600 --> 00:09:25.200
 version detection. And again, you can run this it is

185
00:09:25.200 --> 00:09:28.300
 recommended that you run this scan on all ports so that

186
00:09:28.300 --> 00:09:31.300
 it is as comprehensive as possible. So again, we

187
00:09:31.300 --> 00:09:34.500
 can then use the - be my the

188
00:09:34.500 --> 00:09:37.300
 - b - option. Now, let's talk about

189
00:09:37.300 --> 00:09:40.100
 operating system detection. All right, so the operating

190
00:09:40.200 --> 00:09:43.100
 Addiction is very simple. All we need to do is

191
00:09:43.100 --> 00:09:47.700
 specify 0 so that is a uppercase also - uppercase

192
00:09:47.700 --> 00:09:50.700
 o and will also include it with service version

193
00:09:50.700 --> 00:09:53.100
 detection and we are going to then perform the

194
00:09:53.100 --> 00:09:56.100
 scan on all the ports and we are just going to

195
00:09:56.100 --> 00:09:59.100
 hit enter. So again, it's going to tell me that right over here. So

196
00:09:59.100 --> 00:10:03.100
 TCP IP fingerprinting for the operating system, scan requires,

197
00:10:02.100 --> 00:10:05.500
 root privileges. So if your non-root user,

198
00:10:05.600 --> 00:10:08.400
 you want to make sure you use the sudo command, so

199
00:10:08.400 --> 00:10:10.000
 I'm just going to hit enter and it's going to

200
00:10:10.200 --> 00:10:11.400
 ask me for my password.

201
00:10:12.500 --> 00:10:15.200
 I'll just paste that in and the scan is going to complete now. It's going

202
00:10:15.200 --> 00:10:18.200
 to it's going to start now, and I'm just going to wait for this to

203
00:10:18.200 --> 00:10:18.900
 complete.

204
00:10:20.500 --> 00:10:23.400
 All right. So as you can see, the scan is complete and

205
00:10:23.400 --> 00:10:26.600
 we get the same fingerprint book from before. However, now

206
00:10:26.900 --> 00:10:29.500
 you can see, the results will remain the same regarding service

207
00:10:29.500 --> 00:10:32.400
 version detection. We take a look at the bottom here.

208
00:10:32.900 --> 00:10:35.300
 We have a new section or a new piece

209
00:10:35.300 --> 00:10:38.700
 of data that's added in. That is operating system details.

210
00:10:38.200 --> 00:10:41.200
 Now, the way in map will do, this is based on

211
00:10:41.200 --> 00:10:44.200
 the responses. It's getting from the target. It will

212
00:10:44.200 --> 00:10:47.900
 come to a conclusion as to what operating system detection, what

213
00:10:47.900 --> 00:10:50.200
 operating system is running and of

214
00:10:50.400 --> 00:10:53.700
 It's going to do this through prediction based on the signatures

215
00:10:53.700 --> 00:10:56.700
 that it currently has stored within its own database

216
00:10:56.300 --> 00:10:59.300
 or signature file. So, you can

217
00:10:59.300 --> 00:11:02.400
 see that from the operating system details. It

218
00:11:02.400 --> 00:11:06.200
 tells us that we are running, Microsoft Windows Server, 2008, or

219
00:11:06.200 --> 00:11:09.200
 2008 beta 3, it also gives us

220
00:11:09.200 --> 00:11:12.800
 other guesses like Microsoft Windows Server, 2008 R2,

221
00:11:12.800 --> 00:11:15.200
 which we know is actually correct or

222
00:11:15.200 --> 00:11:18.500
 Windows 8.1. So, typically, this is very is

223
00:11:18.500 --> 00:11:20.200
 usually going to be very active in.

224
00:11:20.300 --> 00:11:23.800
 In regards to giving you the correct operating system. And

225
00:11:23.800 --> 00:11:26.300
 again, it gives you a warning, right? If you're telling me that the

226
00:11:26.300 --> 00:11:29.600
 OS, scan results, may be unreliable, and

227
00:11:29.600 --> 00:11:32.300
 that is because we could not

228
00:11:32.300 --> 00:11:35.500
 find at least one open board and one closed Port. So,

229
00:11:35.500 --> 00:11:38.200
 again, it gives you an update of an idea as to how nmap comes

230
00:11:38.200 --> 00:11:42.100
 to these conclusions. Now, as I said, the most important thing,

231
00:11:41.100 --> 00:11:44.500
 he to take a look at all the first two

232
00:11:44.500 --> 00:11:47.700
 or three predictions because they are going to be, they're

233
00:11:47.700 --> 00:11:50.200
 going to be the most correct or the ones.

234
00:11:50.300 --> 00:11:53.700
 The highest probability of being the actual operating

235
00:11:53.700 --> 00:11:56.600
 system running. So in this case, we have a pretty good

236
00:11:56.600 --> 00:11:59.600
 idea that is running Windows Server 2008. And

237
00:11:59.600 --> 00:12:02.600
 of course given that we know Metasploit Table, Three, we

238
00:12:02.600 --> 00:12:06.300
 know that it's currently running Windows Server, 2008 R2.

239
00:12:05.400 --> 00:12:08.200
 All right, so that's something that you want

240
00:12:08.200 --> 00:12:11.400
 to take into consideration, but you can see where

241
00:12:11.400 --> 00:12:14.300
 we have immediately performing just to scans. We've

242
00:12:14.300 --> 00:12:17.700
 been able to get a ton of information from our Target. And

243
00:12:17.700 --> 00:12:20.200
 now that we performed a comprehensive port,

244
00:12:20.300 --> 00:12:23.100
 Can or that we scanned, all the ports. We now have a

245
00:12:23.100 --> 00:12:26.600
 pretty good idea of what's running on the actual Target

246
00:12:26.600 --> 00:12:29.500
 in regards to service versions and the current

247
00:12:29.500 --> 00:12:32.600
 open ports. And we also know the operating system that's running

248
00:12:32.800 --> 00:12:35.300
 which means we can. Then start performing or looking

249
00:12:35.300 --> 00:12:38.800
 for exploits that are targeted or designed for

250
00:12:38.800 --> 00:12:41.600
 this for these particular versions of

251
00:12:41.700 --> 00:12:44.400
 Windows server. And of course we can. Then Target

252
00:12:44.400 --> 00:12:47.600
 the surfaces will be looking at all of this in later modules of

253
00:12:47.600 --> 00:12:50.200
 the course. Now, before

254
00:12:50.300 --> 00:12:53.100
 Actually close off this video or I end of this video. I

255
00:12:53.100 --> 00:12:56.900
 just want to take you through some very, very useful tidbits

256
00:12:56.900 --> 00:12:59.100
 or tips that you can use with nmap and

257
00:12:59.100 --> 00:13:02.100
 one of them. And that's going to be extremely useful is the

258
00:13:02.100 --> 00:13:05.400
 ability to Output your results into a file. So,

259
00:13:05.400 --> 00:13:09.000
 for example, I'll just head over to my desktop here. And

260
00:13:08.100 --> 00:13:11.600
 if I open up the Man pages for nmap,

261
00:13:11.600 --> 00:13:14.400
 and that can be done by simply typing in, man, and

262
00:13:14.400 --> 00:13:17.500
 map. And I scroll to the bottom here. You can see

263
00:13:17.600 --> 00:13:20.100
 that if we go right at the bottom,

264
00:13:20.200 --> 00:13:23.200
 Mm to the output here, you can see that we can output our

265
00:13:23.200 --> 00:13:26.100
 scans two different types of files and we have a

266
00:13:26.100 --> 00:13:30.000
 normal output which is going to be displayed exactly

267
00:13:29.200 --> 00:13:32.200
 how it displays it on to the terminal. We

268
00:13:32.200 --> 00:13:35.600
 have XML format and we have the script kiddie format

269
00:13:35.600 --> 00:13:38.500
 and the groupable format. The three, most important formats.

270
00:13:38.500 --> 00:13:41.300
 You're going to be using going to be normal XML and

271
00:13:41.300 --> 00:13:45.200
 the grip herbal format, which can then be used with a command-line utility

272
00:13:44.400 --> 00:13:47.200
 like grip and you have all

273
00:13:47.200 --> 00:13:50.100
 the options here. So for example, if I

274
00:13:50.300 --> 00:13:53.300
 To Output the foil into a normal file

275
00:13:53.300 --> 00:13:56.200
 out. Use the 0n option. If I wanted to Output into an

276
00:13:56.200 --> 00:13:59.500
 XML file. I can use 0x and XML, files

277
00:13:59.500 --> 00:14:02.400
 are useful. If you want to parse the information into a

278
00:14:02.400 --> 00:14:05.300
 web page or into a report, and then, of course,

279
00:14:05.300 --> 00:14:08.400
 you have the OG, the OG option, which will output

280
00:14:08.400 --> 00:14:11.500
 into a grip herbal format. So for example, if

281
00:14:11.500 --> 00:14:14.200
 I wanted to Output a simple scan Soul,

282
00:14:14.200 --> 00:14:17.300
 say nmap, F only want to scan a hundred of the most

283
00:14:17.300 --> 00:14:20.100
 common ports and I want to perform some service version detection.

284
00:14:20.200 --> 00:14:24.400
 So you can see how I'm combining scans here. It really is fantastic that

285
00:14:24.400 --> 00:14:27.400
 you can do this with any web and then I provide the

286
00:14:27.400 --> 00:14:30.200
 IP here and then I say o n. So that

287
00:14:30.200 --> 00:14:33.300
 is a - lowercase o and an uppercase n

288
00:14:33.300 --> 00:14:36.100
 and then I specified the actual file name so I can

289
00:14:36.100 --> 00:14:39.900
 say nmap dot txt right.

290
00:14:39.100 --> 00:14:42.200
 If I wanted to Output into all formats. I

291
00:14:42.200 --> 00:14:45.300
 can then simply type in 0 a and that will output it into

292
00:14:45.300 --> 00:14:48.200
 all file format so I can also do that as well. And

293
00:14:48.200 --> 00:14:50.100
 then I get rid of the extension here and I just give

294
00:14:50.200 --> 00:14:53.400
 They file names. I just call it nmap scan and I

295
00:14:53.400 --> 00:14:56.200
 just hit enter and that is going to perform the scan and is

296
00:14:56.200 --> 00:14:59.500
 then going to Output this scan into these three formats or

297
00:14:59.500 --> 00:15:02.400
 three or four formats that that we

298
00:15:02.400 --> 00:15:05.400
 can actually use for, you know, generating reports.

299
00:15:05.400 --> 00:15:08.300
 We can use it for reference or to

300
00:15:08.300 --> 00:15:11.600
 access later, so that we don't have to keep on running our,

301
00:15:11.600 --> 00:15:14.500
 our scans to actually analyze the results time

302
00:15:14.500 --> 00:15:17.400
 and time again. All right. So again, we'll just let this

303
00:15:17.400 --> 00:15:20.100
 run. Alright? The scan is

304
00:15:20.100 --> 00:15:20.200
 complete.

305
00:15:20.200 --> 00:15:23.600
 Complete and again, it will display the information to us on the terminal

306
00:15:23.600 --> 00:15:26.200
 but if we list out the files in our, in our current

307
00:15:26.200 --> 00:15:29.100
 directory, you can see that it outputs into the gray

308
00:15:29.100 --> 00:15:32.500
 purple format, which is G and map and then outputs into

309
00:15:32.500 --> 00:15:35.400
 the normal n map into the normal n

310
00:15:35.400 --> 00:15:38.200
 map output format. And then we have

311
00:15:38.200 --> 00:15:41.800
 the XML file. So, if I kept the contents of nmap scan,

312
00:15:41.800 --> 00:15:44.300
 the nmap, you can see it

313
00:15:44.300 --> 00:15:47.300
 actually displays exactly what we got on the terminal. So this is

314
00:15:47.500 --> 00:15:50.100
 again, just human readable information.

315
00:15:50.300 --> 00:15:53.400
 Then of course have the XML output so I can just say

316
00:15:53.600 --> 00:15:56.100
 nmap scan dot XML and you can

317
00:15:56.100 --> 00:15:59.200
 see that that is indeed in XML format. Which again is you

318
00:15:59.200 --> 00:16:02.500
 very useful for generating reports or for parsing

319
00:16:02.500 --> 00:16:05.200
 it into the web or into a web page. All

320
00:16:05.200 --> 00:16:08.400
 right, so that is how to actually specify your output options. And

321
00:16:08.400 --> 00:16:11.700
 again, I'll just take you through some other really, really cool features

322
00:16:11.700 --> 00:16:14.100
 that you can use with nmap. All right. So what I'm

323
00:16:14.100 --> 00:16:18.100
 going to do now is we'll just run the same scan that we run before and

324
00:16:17.100 --> 00:16:20.100
 let's talk about verbosity.

325
00:16:20.200 --> 00:16:23.700
 In terms of what is outputted to you on the screen. So

326
00:16:23.900 --> 00:16:26.100
 when we talk about what is output to us on

327
00:16:26.100 --> 00:16:29.800
 the screen, you can see that when we hit enter without specifying

328
00:16:29.800 --> 00:16:32.200
 the amount of verbosity and map,

329
00:16:32.200 --> 00:16:35.600
 does not display anything to us. Any diagnostic information

330
00:16:35.600 --> 00:16:38.200
 to us as the user, if we wanted map to

331
00:16:38.200 --> 00:16:41.200
 actually display and to actually State what's going on in

332
00:16:41.200 --> 00:16:44.400
 the background before, it actually delivers the results, we

333
00:16:44.400 --> 00:16:47.700
 can use the minus V option and that is lowercase V.

334
00:16:47.700 --> 00:16:50.100
 So that is level one of the Bow City.

335
00:16:50.300 --> 00:16:53.100
 We can also use level 2 and level 3 to

336
00:16:53.100 --> 00:16:56.600
 give us more information. So again, if we can

337
00:16:56.600 --> 00:16:59.500
 we can we can run that command the way it is. However, if

338
00:16:59.500 --> 00:17:02.500
 I just open up the Man pages and I grab and

339
00:17:02.500 --> 00:17:05.400
 I say, I'm looking for, let's see,

340
00:17:05.700 --> 00:17:09.100
 just use the Expression option and I'm looking for the

341
00:17:08.200 --> 00:17:11.200
 Bose, right? So you can see it were both hit

342
00:17:11.200 --> 00:17:14.600
 enter. You can see that if we take a look at the Man pages.

343
00:17:14.600 --> 00:17:17.700
 We use the normal output in verbose, we use the V option

344
00:17:17.700 --> 00:17:18.100
 here.

345
00:17:18.800 --> 00:17:20.800
 And then if I look for verbosity.

346
00:17:22.300 --> 00:17:26.000
 Just hit enter. You can see that we can increase the verbosity level

347
00:17:25.200 --> 00:17:28.900
 by using more Visas, so we can specify

348
00:17:28.500 --> 00:17:31.200
 more V. So again, you can also do

349
00:17:31.200 --> 00:17:34.900
 this by specifying V1, V2, V3, Etc.

350
00:17:34.100 --> 00:17:37.500
 In my case. I would I really like

351
00:17:37.500 --> 00:17:40.600
 using just one or two v's. It just gives me just enough

352
00:17:40.100 --> 00:17:43.300
 diagnostic information that I need. So

353
00:17:43.300 --> 00:17:46.200
 again, I can just hit enter and now you can see that

354
00:17:46.200 --> 00:17:49.200
 it's actually displaying what's going on in the background and

355
00:17:49.200 --> 00:17:51.200
 now nmap is coming to its.

356
00:17:51.800 --> 00:17:54.800
 And the results are being delivered to us life. And

357
00:17:54.800 --> 00:17:57.400
 then, once the scan is done, it will give us the information that

358
00:17:57.400 --> 00:18:00.200
 it actually was able to get so you can see right

359
00:18:00.200 --> 00:18:03.200
 away. It starts the DNS resolution and then

360
00:18:03.200 --> 00:18:06.800
 completes parallel DNS resolution and then it initiates the

361
00:18:06.800 --> 00:18:09.900
 connects can the TCP connect scan and

362
00:18:09.900 --> 00:18:13.000
 you can see it discovers an open port on port. 8080.

363
00:18:12.100 --> 00:18:15.400
 It discovers an open port on Port, 80 Port,

364
00:18:15.400 --> 00:18:18.200
 22, put 21. So on and so forth. And

365
00:18:18.200 --> 00:18:20.800
 then it's going to move on to the next stage, which is

366
00:18:21.300 --> 00:18:25.400
 Service version detection. So it actually runs the scan chronologically or

367
00:18:24.400 --> 00:18:27.100
 in order. So you can see first of all

368
00:18:27.100 --> 00:18:30.600
 it actually performs some host Discovery. So it initiates

369
00:18:30.600 --> 00:18:33.600
 a ping scan it then performs a your parallel

370
00:18:33.600 --> 00:18:36.400
 DNS resolution it then goes on to scanning for

371
00:18:36.400 --> 00:18:39.700
 ports, which is we specify the F option. So

372
00:18:39.700 --> 00:18:42.100
 only 100 of the most common ports. We then move on to

373
00:18:42.100 --> 00:18:45.700
 service version detection. So it's going to scan six services and

374
00:18:45.700 --> 00:18:48.400
 then it's going to essentially going to Output the

375
00:18:48.400 --> 00:18:51.000
 results to us and immediately, it did that for.

376
00:18:51.400 --> 00:18:55.000
 Write a vso. Now. We have an additional column

377
00:18:54.200 --> 00:18:57.400
 that is called the reason column which actually

378
00:18:57.400 --> 00:19:00.300
 tells us. The reason it was actually able to

379
00:19:00.300 --> 00:19:03.300
 come to these conclusions. In this case. We got a cynic in

380
00:19:03.300 --> 00:19:07.200
 return, this particular scan utilizes,

381
00:19:06.200 --> 00:19:10.100
 a TCP connect scan, which with

382
00:19:09.300 --> 00:19:12.600
 which again will typically utilize

383
00:19:12.600 --> 00:19:15.300
 the TCP 3-way handshake, where you

384
00:19:15.600 --> 00:19:18.800
 nmap will send a TCP syn packet. And

385
00:19:18.800 --> 00:19:21.100
 then based on the response, if it gets a sin.

386
00:19:21.300 --> 00:19:24.100
 Tack. It means that particular port is open. If the

387
00:19:24.100 --> 00:19:27.500
 port is closed, it will get an RS t or a reset packet

388
00:19:27.500 --> 00:19:30.400
 telling nmap that is closed. So, again, that's just a

389
00:19:30.400 --> 00:19:33.400
 few tips that you can use in the event. You want to learn more

390
00:19:33.400 --> 00:19:36.300
 about and map or you're trying to understand what's

391
00:19:36.300 --> 00:19:39.600
 happening behind the scans or in the back end.

392
00:19:39.700 --> 00:19:42.200
 That being said, that's going to be it for this video and I'll be

393
00:19:42.200 --> 00:19:43.600
 seeing you in the next video.