Speaker: Welcome back.
Let us finally check out how we can figure out
the version of software running on an open port.
For now, we managed to discover open ports.
We also learned what different scans do
and which ones are better to use.
And we learned how we can identify an operating system
on some of the targets that we scan.
Now, let's see one of the most important parts
that will also help us in identifying vulnerabilities.
So why do we care about versions of software so much?
For example, I might somehow find out that
Methods Portable is running Apache of web server
on Port 80.
But, that doesn't narrow all the possible attacks too much.
Of course, it narrows it down to only search
for a patch of vulnerabilities,
but Nmap can even go as far as discovering
what exact version of a patch is it running.
Then after knowing the version,
we can search that version on internet and try to see
whether there are any known vulnerabilities
for that specific version.
So version discovery helps us a lot.
And let's see how we can perform it.
To perform version discovery, we use the option dash sV.
So I'll run the command and map dash sV.
and as usual, we're going to be scanning our method plate.
Now this command also requires sudo privileges
so make sure to type it at the beginning of the command.
Sudo nmap dash sV and then the IP address.
Press enter,
Enter the password.
This particular scan could take longer than other scans
because right now,
we are deeply scanning the target.
Let us check out at what percentage is it at.
So 91% it should finish in just a few seconds.
Let's wait for it.
And here it is.
We can see we got a bunch of result right here.
The new thing that we got from all the previous scans
is this 4th column.
Remember, once we scanned previously
we only got these first three columns,
which are the port number, the state of the port,
and the servers that it is running.
Right now, we also get the version of the service.
So let's go quickly through this.
We got port 21, which is ftp,
and right here we got the exact version
of what type of ftp software does it have.
For the ssh, we get the same thing.
So the version of SSH is open, SSH 4.7,
Debian 8ubuntul.
We got the telnet, the smtp,
the http we got that it is running the Apache http 2.2.8
For the smbd protocol, which is port 445 and 139.
We got that it is running Samba.
From the three point something to four point something.
In this range will be the version that it is running.
What we would do with this information
as I already mentioned,
is we would just try to search for
some known vulnerabilities for the specified versions.
For example,
if this Apache version right here has a known vulnerability
we would discover it by pasting this in Google
and typing vulnerabilities.
And whatever comes up,
we will test this on this target
and see whether it works or not.
Since some vulnerabilities could be patched.
We never know, so we want to try it out.
Down here, we also got the versions for the other ports
so we get a bunch of results right here.
What you would do with this scan,
since this is really useful,
we would type this on our report
and we would use for the future references.
For now, let me show you another option that you can use
with the version scan
and that option is intensity of scanning versions.
We can type it like this.
So if I use the same command,
let me just clear the screen so we can see it better.
If I use the same command and after dash SV,
I type dash dash, version, dash intensity.
And after the version intensity,
we need to specify how high we want the intensity to be.
And it can be set between zero and nine.
The default one, which we used in the last scan is seven.
So every time you don't specify this option,
it'll be seven by default.
If we set it all the way up to nine,
then we will have higher possibility
of identifying the correct service version.
However, in 99% of nmap scans, this option is not needed.
You can just leave it on default, which is seven.
If you set it at nine, it'll take longer time.
And since we're scanning a target that is
on our own network, it'll still do it in just a few seconds
or minutes.
But if you were to scan a real target,
nmap scans could take a lot more time to accomplish.
So you always want to consider not only performing
most accurate scan possible, but also performing on scan
that will be equally fast and accurate.
So sometimes we have to lose one thing
in order to gain the other.
That would be pretty much all for diversion scanning.
Now we're not going to be running this command
since I can tell you right now that it'll give us
the same output as the previous one.
So in this case, increase in diversion intensity
won't help us too much.
And as far as these options go, there are more options
for the version discovery
that you can check out inside of the nmap manual.
But before I end this video,
I want to show you another thing that I also use a lot
and that is the dash A option.
So let me show you right here.
If instead of all of this I specify dash A
and dash A is so-called aggressive option.
It enables some advanced features of nmap.
Those advanced features are, well, first,
it enables OS detection without specifying the dash O
that we already covered.
It also enables the version detection
without specifying the dash sV,
and it enables something called nmap script scanning.
What nmap scripts are,
are something that we will cover shortly.
For now, just remember that dash A enables
all of those things that we covered in the previous videos,
including nmap scripts.
And since dash A is one of the more aggressive
nmap options,
please do not try this on targets
that you do not have permission to scan.
However, let us test it out
on our method exploitable target,
and if you want, you can also try to scan
your home network with it.
Just keep in mind that since it is using all
of these options,
it'll take some time even if it is scanning
our home network.
So if I run this comment, this will take some time.
If I press upper arrow, it is 78% done,
and the output of this option we're going to see
in the next video as well as some other useful things
that we can do with nmap.
As soon as we check that,
we are going to get into fireball evasion using nmap.
See you there.