WEBVTT - This file was automatically generated by VIMEO

1
00:00:02.300 --> 00:00:05.200
 Hello everyone. Welcome to this video. In this video. I'm

2
00:00:05.200 --> 00:00:08.200
 going to be showing you how to perform vulnerability scanning with

3
00:00:08.200 --> 00:00:11.700
 nmap, using the nmap vulner script that

4
00:00:11.700 --> 00:00:14.300
 comes prepackaged with nmap. Now, I'm currently

5
00:00:14.300 --> 00:00:18.100
 on the GitHub repository, just to give you more information regarding

6
00:00:17.100 --> 00:00:20.100
 the tool and how it actually does what it

7
00:00:20.100 --> 00:00:23.300
 does. So as I said, this is going to be focused on

8
00:00:23.300 --> 00:00:26.800
 vulnerability scanning. So if we take a look at the description of

9
00:00:26.800 --> 00:00:29.500
 the nmap vulner script here, you can see

10
00:00:29.800 --> 00:00:31.900
 it tells you that this script is used it.

11
00:00:32.100 --> 00:00:35.600
 Is the default nmap service version detection system to

12
00:00:35.600 --> 00:00:39.000
 get banners and then it uses those banners to perform. Scans

13
00:00:38.400 --> 00:00:41.400
 will actually scan to see if

14
00:00:41.400 --> 00:00:45.000
 any of those services are vulnerable to a particular exploit

15
00:00:44.300 --> 00:00:48.100
 and exploit that has been publicly disclosed

16
00:00:47.200 --> 00:00:50.600
 and then it does that and displays the various

17
00:00:50.600 --> 00:00:53.400
 cve codes for these vulnerabilities. So again,

18
00:00:53.400 --> 00:00:56.700
 if a service is vulnerable to a particular exploit,

19
00:00:56.700 --> 00:00:59.200
 it will list out the cve. Code CV, e

20
00:00:59.200 --> 00:01:01.800
 stands for common vulnerabilities and exposures.

21
00:01:02.200 --> 00:01:05.300
 And again, it will list out the actual code

22
00:01:05.300 --> 00:01:08.600
 here and then it will also display the severity in

23
00:01:08.600 --> 00:01:11.300
 the event that again you want to know how to

24
00:01:11.300 --> 00:01:14.500
 structure your tax and then it gives you a relevant link

25
00:01:14.500 --> 00:01:17.600
 that gives you information regarding when the vulnerability

26
00:01:17.600 --> 00:01:20.200
 was disclosed. So on and so forth. Now,

27
00:01:20.200 --> 00:01:23.400
 as I said, this script comes prepackaged with all latest versions

28
00:01:23.400 --> 00:01:26.200
 of nmap and using it is very simple. We need

29
00:01:26.200 --> 00:01:29.500
 to run the default service. Version detection, scan and

30
00:01:29.500 --> 00:01:31.700
 then run the script vulner here and then

31
00:01:32.100 --> 00:01:35.200
 The target. So we'll do that right now. So again, running it, as

32
00:01:35.200 --> 00:01:38.300
 I said, is very simple. All we need to do is type in nmap. And

33
00:01:38.300 --> 00:01:41.300
 then we say service version detection. We want to perform some

34
00:01:41.300 --> 00:01:44.600
 service version detection and we can also run a stalled scan

35
00:01:44.600 --> 00:01:47.100
 here in conjunction with this and that we

36
00:01:47.100 --> 00:01:50.200
 can then specify the port's that we want. In this case. I'm just

37
00:01:50.200 --> 00:01:53.900
 going to specify will say ports 21

38
00:01:53.800 --> 00:01:57.000
 to port 8080 or

39
00:01:56.100 --> 00:01:59.400
 we can simply just run. The default port scan,

40
00:01:59.400 --> 00:02:01.600
 which is 1000 of the most commonly used parts.

41
00:02:02.200 --> 00:02:05.800
 And then we say script and then we specify the vanes option

42
00:02:05.800 --> 00:02:08.700
 right over here. So that's the name of the script. We save

43
00:02:08.700 --> 00:02:12.200
 owners and then we hit 10.10 10.0.0.0

44
00:02:11.200 --> 00:02:14.600
 switch. Is the actual IP

45
00:02:14.600 --> 00:02:17.900
 address of the Metasploit aboard three virtual machine and

46
00:02:17.900 --> 00:02:20.600
 we hit enter. It's going to ask me for root privileges. I'm

47
00:02:20.600 --> 00:02:23.500
 going to provide it with root, privileges, avoid my

48
00:02:23.500 --> 00:02:26.100
 password, and there we are. So I'm just going to let

49
00:02:26.100 --> 00:02:29.100
 this scan complete and I'll get back to you when it's done.

50
00:02:29.300 --> 00:02:32.000
 Alright, the scan is complete and as you can see,

51
00:02:32.600 --> 00:02:36.500
 C4 Port 22, which is running SSH and openssh 7.1.,

52
00:02:35.800 --> 00:02:38.700
 We have various cves that

53
00:02:38.700 --> 00:02:42.400
 are listed here. And we also have their severity. So

54
00:02:42.400 --> 00:02:45.800
 you can see of this is open, estate 7.1, and

55
00:02:45.800 --> 00:02:48.700
 it gives us all the actual cve

56
00:02:48.700 --> 00:02:51.300
 codes that we can actually then copy and use for

57
00:02:51.300 --> 00:02:54.400
 our own research. So again, I can open that up in Google So

58
00:02:54.400 --> 00:02:57.100
 based on go and that will take me again to

59
00:02:57.100 --> 00:03:00.400
 the actual releases. So you can see if I open up

60
00:03:00.400 --> 00:03:01.700
 a rapid 7 here.

61
00:03:02.500 --> 00:03:05.700
 Rapid7 will give us more information regarding this

62
00:03:05.700 --> 00:03:08.500
 vulnerability and how to exploit it. So you can see

63
00:03:08.100 --> 00:03:12.300
 it tells us this is an openness Sage vulnerability. And

64
00:03:12.300 --> 00:03:15.300
 again, it gives you a description of the vulnerability and then if there is

65
00:03:15.300 --> 00:03:18.400
 a Metasploit module, it will actually list out the Metasploit module

66
00:03:18.400 --> 00:03:21.600
 that you can use to actually exploit this particular

67
00:03:21.600 --> 00:03:25.200
 service. So again, it's extremely useful in understanding what

68
00:03:24.300 --> 00:03:27.300
 actual services that are running on

69
00:03:27.300 --> 00:03:30.900
 the target. I are vulnerable to publicly known exploits

70
00:03:30.900 --> 00:03:31.900
 and again the idea

71
00:03:32.300 --> 00:03:35.600
 Vision of having the CVV code is extremely helpful and

72
00:03:35.600 --> 00:03:38.700
 you can see pretty much the only service that

73
00:03:38.700 --> 00:03:41.700
 we actually getting the vulner script

74
00:03:41.700 --> 00:03:44.600
 successfully running or giving a script is the

75
00:03:44.600 --> 00:03:47.200
 SSH port. And of course, that does not mean

76
00:03:47.200 --> 00:03:50.300
 that the other services running on the system are not

77
00:03:50.300 --> 00:03:53.300
 vulnerable to any particular exploit or are not vulnerable to

78
00:03:53.300 --> 00:03:56.500
 any particularly are not vulnerable to any openly

79
00:03:56.500 --> 00:03:59.200
 known exploit. It simply just means that the

80
00:03:59.200 --> 00:04:01.800
 Foreigner script was not able to come to that.

81
00:04:02.300 --> 00:04:05.700
 Particular conclusion, using the banners. It was able to retrieve. That

82
00:04:05.700 --> 00:04:08.300
 being said, that's pretty much all that. I wanted to cover

83
00:04:08.300 --> 00:04:11.300
 in this video. And I'll be seeing you in the next

84
00:04:11.300 --> 00:04:11.800
 video.