It is time we discuss different types that we can do with a map now and MAP is a huge tool and it offers
many different types of scans that we can perform and we'll be covering just some since there are a
lot of them.
However, at the end of this video, I will give you a really good tip as to how you can really master
the map to talking about different scans doesn't necessarily mean that we will get different results.
Matter of fact, many of these different scans will give us the same result.
And in this video, I'm going to explain exactly what the differences are between certain scans.
To fully understand this, you will need a background knowledge on TCP and UDP.
So in case you didn't watch the short video I made on TCP and UDP, make sure to watch it before covering
this.
Let's start with the first type of scan, and that scan is called DCB since Ken let me open the terminal.
The comment that we must run is a mad dash S.
S, and then we are going to be scanning matters political in this video, since that is the machine
that we are attacking.
So the IP address of at this point is when I do that one eight, that one that six, and this dash,
as is DCP since can since Ken is probably the most popular scan in Unmap, it can be performed quickly,
scanning thousands of ports per second on networks that aren't protected by a firewall.
And the reason why it is called a scan is because it never really opens up for the connection.
You only perform the first step of a three way handshake, which is sending sin.
And the way it works is if the target sends Sinak back for a certain port that indicates that that port
is listening or it is open.
Target can also send something called Oreste, which stands for Reset, which would indicate that the
port is closed in case it doesn't give any response back.
After several tries, ports will be marked as filtered and filtered is just another state of ports that
happens once, and Map cannot determine whether a certain port is open or closed.
The filter state could happen if port is, for example, protected by some filtering or a firewall.
And now that we know exactly how this works, let's test it out on our anticipatable.
There is one thing with this command.
If we try to run it, it will not work.
It will tell me you requested the scan type, which requires route privileges.
And the reason this requires route privileges is because we're only sending one part of three way handshake
and telling our machine that we do not want to respond to a signal puts it in case it is sent back from
the target that requires route privileges.
So we must run this with pseudo, pseudo and map tests and then let us type in our password.
And we will notice it gives us the results of ports that are open very fast and it is also very important
and satisfying once we know how certain skin type works.
Once again, it sends only the scene and waits for a Sinak or Oreste, and it never establishes a faulty
connection.
Let us check out the result, so we got these ports open and we also got what service is running on
those open ports.
Now, here is the time that it took and we're going to compare this with different scans.
And the reason it finished this fast is once again, it doesn't establish a connection.
Compared to this, since can that we just performed, we also got something called DCPI Connect Skin
or also labeled as Dash STI.
So in order to run this, we can just change this comment from South to dash Estie and you will see
all of these options if you run the help menu of EMAP.
What's interesting about this is that it does not require pseudo privileges, and the reason it does
not require is because it performs unnormal Tsipi three way handshake connection.
So the only difference between this and previous scan is that this connection establishes a connection.
The important part here that you should remember is that this scan will leave much more trace that you
performed an MRI scan on the target machine and it is easily detected.
That's why once you can run and my best route, usually since scan will be a better option than the
typical CT scan.
Nonetheless, let's test this one out so we can remove pseudo as it does not require road privileges.
And you will see it also finishes relatively fast.
The output will be exactly the same as with this since can, but sometimes it could take a little bit
longer than the scans since it is performing a full Tsipi connection.
And even though we got the exact same result, which are just the open ports and the services that they
run, now, we know how both of these can work.
And now you know that, for example, this can is much more detectable than the thin skin.
Or you can say that it just makes more noise on target machine the less skin that we're going to cover.
And keep in mind, these are just some of the scans.
And I will show you where you can find the rest of them and possibly test them out if you want to.
But the next scan that I'm going to cover is pretty and popular.
And that is the dash as you scan or also known as UDP scan.
The reason why it's unpopular is because many services on the Internet run over TCP IP protocol, as
we already know, since EUTERPE scanning is much slower than TCP scanning and more difficult sometimes
when people are developing security for their ports, they ignore the UDP ports.
And this results in a mistake as there are a lot of exploitable UDP services and we should never ignore
this again just because it takes time.
Let us test it out.
This also will require Suda privileges so that this type Suda and Map Besch as you for the other piece
can and specify the IP address on exploitable.
You will notice this scan will take time.
You can check it how much percentage is currently at by pressing the upper arrow key, so if I press
up down here, it will tell me it is currently at three percent and I'm just going to leave this running
while I show you the cool tape for the.
So remember this, the key to learning and map in great details is not in reading its health menu,
but in reading its manual.
And to open the manual, you can open your terminal and type manual and map.
And let me do this in a second terminal, so I'll open it up type man, and then I met this man right
here is shortened for manual press enter.
In this file, it explains every option in great detail, let us find different skin types that also
exist since we didn't really cover every one of them.
Let's scroll all the way down to different and map skins.
And as we're scrolling, you will see that we are passing the actual health menu, that we get outputted
once we're on the dash, this help and below this health menu, it explains every option in great details.
And some scrolling I came to this part which says, port scanning basics, and here are the six port
states recognized by Unmap and this is good to read.
So we got the open Port St. the closed Port St..
We got filtered Port St. unfiltered Port St. open and filtered and closed and filtered.
So if you want to read through this, it is really useful knowing once you get, for example, filtered
ports to know exactly what that means.
And if I go a little bit more down here, they are here with the different types that map has.
So here is the TCP skin that we performed, which is that as here is the dash, which is full DCP connections
can.
And down here you will notice after the UDP scan that we got different options as to how we can perform
our scan.
And you can read about each and every one of them and see when are they useful and how you can specify
them.
Here is the Tsipi scan.
Here's the TCP windows can and you will see there are a lot of them.
There are also different options such as this can flex, which is custom skin.
But this is an advance option and we might take a look at this later on.
Here is Idle's can, Ekos can.
Let's see all the way down, IP Protocol Schenn.
ATP relay host FPP Bouncin.
And that would pretty much be it for the Websense.
So depending on your target and what you exactly want to get from the scan, you would pick one of them.
So, for example, if you wanted to discover open ports, you would use the DP scan.
Now, the X scan, I believe, which is the dash assay, which we saw a few seconds ago, is useful,
I believe, to mapping out the fireball just through them.
If you have time and you will discover how they work and when are they useful.
So let's see how much percentage of your scan is it?
So it is finished about a third of the scan.
And we know that this will take at least 10 to 15 more minutes.
So we are not going to wait this.
And by the way, about the end manual, you need to read that entire file, just it is good to know
that it exists.
So sometimes when you forget something or you want to check out the fan map has some other option that
you need.
You can just open that manual and feed until you find what you need.
Nobody expects you to know everything inside of that file, but after some time, you will start picking
some of the comments up and memorizing them.
Cool.
We covered a lot in this video.
The next two videos will be even more important.
We're going to check how we can discover operating systems that our target machines run and what versions
of services are they running on an open port, which is, remember, one of the most important things
that we want to find.