-: Okay, so we know what scanning is.
We also created our virtual machine that is vulnerable.
Now we are ready to see what information can we get
by scanning that machine.
But before we scan a single machine,
to discover open ports,
we must first discover what machines we got on our network.
So the first part of scanning the network is to figure
out how many hosts you have active
and what are their IP addresses.
In this case, we are going to act
as if we got a task to scan our home network.
We want to discover vulnerable machines
within our home network.
So let's start by seeing how many hosts we got active first.
There are many ways that we can go about doing this.
Since I know that all the possible hosts
for my network must go in range from
192
.168
.1.1
to 192
.168
.1
.255.
Since my IP address starts with these three first numbers
let me just type the password and here it is
192.168.1. This is the part that doesn't change.
To scan all 254 hosts inside of my network.
I can just go and ping each and every one of them
and see whether they respond to our pinging or not.
If they respond, they are online.
If not, they are offline.
But what if I had to test more than one network?
What if I had 10 more networks
besides this one that I need to test?
Am I about to try to ping every possible host
from all those networks?
Of course not.
That's why we are going to use different tools to
perform this much faster.
Let us try with the first tool called ARP.
Now, ARP is a tool in Cal Linux, but it is also a packet.
ARP packets are used in discovering hosts on the network.
But more about them later on,
once we get to demand in the middle section.
For now, just remember
that they are packets for discovering hosts.
Before we use this ARP tool
make sure your Metasploitable is started up
and in case you got some other devices that you can connect
to the internet, connect them just
just so we can get various output and try to figure
out which IP address belongs to which hosts.
Now our ARP tool
works based on those ARP packets that I mentioned.
So if I type
ARP
-: - help
and press enter
it will tell me command not found.
Now this is because
I must run the tool with Sudo privileges.
So sudo arp -- help
and here is the tool.
It doesn't have too many options.
We got -a which displays all hosts
in alternative BSD style,
-: e display all hosts in default Linux style.
And these options down here are not something
that we are interested in.
All we want to do is use this -a option.
So if I go down here
clear the screen and type
sudo
arp -a
it will tell me it only discovered my router.
But why is that?
I got my Metasploitable running.
Also got my laptop running.
So it should be discovering other hosts as well.
Sometimes we must ping a host first
before it appears right here,
since this information is being read
from our ARP tables.
See if for example I
tried to ping my Metasploitable,
it'll get responses back.
And if I run arp -a again,
now we'll see that we got an entry
for the Metasploitable inside of our ARP tables.
So this tool doesn't seem to be that good
for discovering hosts.
Sometimes it will have all the hosts available
since you already communicated with them before.
But sometimes it seems
that we must ping the host first before it shows them.
That's why a much better option is tool called Net Discover.
To run Net Discover,
we can simply type sudo netdiscover
inside of your terminal.
Press enter and this tool will find all
of the available devices on your network on its own.
You don't have to ping anything.
You don't have to communicate with anything.
You can just leave this tool to run
and it will find all the devices on your network.
So right here it managed to find five of them.
We can see up here that it is still scanning
and it is just scanning different subnets.
So it already finished mine
and you can control + C this if you already see the result.
Since this will scan all the usual subnets that occur
in a network.
Right here we see that we captured five ARP packets
and there are ARP requests and ARP replies, but once again
more about that later.
This just means that we managed to discover
five hosts using these packets.
And these are those five hosts.
Let me control + C this
since it won't really manage to find anymore hosts.
And right here we got their IP addresses,
their Mac addresses
and their Mac vendor name or host name.
So right here I know that this is my Metasploitable,
which is this one.
This 192
.168
.1.7
is my host machine
or my physical machine that I'm running my Cal Linux on.
These two down here are two laptops I believe.
And this right here is my router.
And how do I know that this is my router?
Well, usually routers start with the first number.
Either it will be something like .0 or .1 .
And just you can be sure which IP address is your router.
You can type the command
netstat
-: nr
and under this gateway column
we should see the IP address of the router.
So you can see they do match.
The next step would be to go
about scanning each and every one of them.
And for this we're going to be scanning
our Metasploitable
and you can also scan your home machines just
for even more practice.
See you in the next video.