Instructor: Welcome back.
Let's continue with our WhatWeb tool.
So in the previous video,
we only saw how we can perform
the basic stealthy scan on a certain website.
Another thing that we can do with WhatWeb
besides testing a website
is to test a range of IP addresses all at once.
So if I open up my terminal,
and I type, "whatweb --help",
once again to list out
all of the available options,
and scroll all the way up.
Here under the targets,
we can see that we can specify URLs,
host names, IP addresses,
but we can also specify IP ranges.
We can specify them like this or like this.
Now to test this out,
I'm going to scan my entire home network,
and to know what range of IP addresses
should I scan for my home network,
I could type down here
command, "ifconfig",
or, "sudo ifconfig", since, remember?
This requires root privileges.
Press enter.
Enter our password.
And we can see that my IP address is 192.168.1.4
And what's more important than the IP address
in this case is the netmask,
and my net mask is 255.255.250.0.
The subnet mask right here means
that only the last octet of my IP address
is changeable, which is this last number.
So these first three octets
or these first three numbers never change
in my home network.
This also means
that the range of IP addresses that belong
to my network are going to be from 0 to 255.
So basically the range of the IP addresses,
that my network can have is this one:
192.168.1.0 to 192.168.1.255
This is the range of my home network.
So let me scan it.
Now for you it might be different based on what type
of network you got, but in most home networks
the subnet mask is going to be this one
therefore just the last octet will be changeable for you.
Now before I actually run the scan
I don't have any websites hosted in my home network
but I do got some devices running something on port 80.
And Port 80 is an HTTP port that websites use to
host their pages.
So we should still get some result from scanning my network.
Let us go delete this and type whatweb.
And then the range of my home network.
Let us go with 1 to 192.168.1.255
So this is the range of IP addresses that they want to scan
and all of them belong to my home network.
And the good thing right here is
that I can use whichever aggression level I want
since it is my own network.
Let's test out aggression level three.
To do that we can specify dash dash aggression
and then three after it we can also specify the
dash V option to better output all of this.
And let's press enter.
You will notice we are getting some of the results
but there is a lot of this error happening on the screen.
Now what this error right here is, let me just control C
since we're not going to wait for this to finish.
And what this error is, is all
of the hosts that it tried to scan but couldn't manage to.
And the reason why it couldn't manage to scan these hosts is
because they do not exist.
I currently only have around two
or three devices on my home network
and all of these other IP addresses are out of use.
So let me go up here to see what it found.
It found the result for the IP address 192.168.1.1.
And this is my router down here we can see all
of the plugins that it managed to detect for my router.
We can see an interesting plugin which is password field.
This is something that we would write down
since any password field that we find we can use later on
in something
like a brute force attack to try to guess the password
and try to brute force the login credentials.
But nonetheless, this is just a router.
So we are not really interested in it at the moment.
This is just an example of a test of how it would look like.
And since I don't have any website on my home network
it didn't really give much result.
We can see right here, here is another IP address
that is active.
It is 192.168.1.10 and this is an IP address
of my laptop, which is currently up and running, it
detected this HTTP server on it, but it got this status code
of 403 Forbidden.
So it is not allowed to visit that page.
Therefore this is as much information
as it's managed to get.
And all the other ones down here are simply
just offline.
Now if you don't want this outputted, this red text
you can use the same command and at the end add
dash dash no-errors.
What this no-errors option does is it simply just
doesn't print these offline IP addresses.
Let's test it out.
If I run the same command just with no-errors
you will see we are not going to get any red text anymore.
It will only scan these two live IP addresses, which is
my home router and the laptop.
And that is basically it.
That is everything, that it will output.
Okay, so it took just a few seconds to finish.
And keep in mind that
since we are running level three of aggression scan
it will take a little bit more time to scan something
than with level one since it is performing a deeper scan
than just the level one stealthy scan.
Okay, so we ran this command
and we used the aggression level three.
We used dash V to output all the detected plug-ins
as well as their description.
And we used no errors to not print
out these offline IP addresses.
But what if we for example
wanted to save this output that we got
in a file for some future references?
Well, if I type the command: "whatweb --help",
and I go through this help menu once again,
I will get to this part which is "LOGGING".
And down here we can see that there are a bunch
of options that we can use to log our file
or to save our file.
So let's just go with the first one
or we can even use the second one
which is to log verbose output.
To do that we use this option right here and then equals
and then the file name that we wanted to save to.
So if I go down here and another useful command
once you have a bunch of things happening
in your terminal and by bunch
of things I mean just bunch of texts printed out
what we can do to get rid of this is run the command clear.
This will clear our terminal so we get much cleaner look.
Now if I press upper arrow to find the command
that we ran previously and
at the end I add log and then dash verbose equals.
And here I can call the file, "results", for example.
If I press here, enter.
Now you will notice that besides of this outputting it
to the terminal, it will also save it inside of a file.
Let's wait for this to finish to check out the file
that we got.
Okay, so it finished.
Let us clear the screen once again
and if I type "ls" right here, we'll see our results file.
Let's lower the terminal and open this file to
see what it got saved.
And if I enlarge it, we will see that we got our results
saved for both IP addresses, for my laptop IP address, and
for my router IP address.
Now for your scan, if you scan your home network
you will probably have more devices or less devices
or you might not get any result in case none
of your devices is having an open port 80 or in case none
of your devices is running an HTTP server.
So don't worry if you didn't get any device.
This is just an example to see
that we can even run the ranges of IP addresses and to test
out this aggression level three scan since we can only do it
on the websites that we own or have permission to scan.
Okay great so,
look at all of the commands that we crafted
with all of these options right here.
And this is just a part of this WhatWeb tool.
You don't need to be learning all of these commands.
You can always just run the help command and read
through its help manual to discover what you want to run.
We won't be going through all of these options
in WhatWeb tool since there is too much of them
but I encourage you to play with it a little bit
and see if it has any other interesting options.
Great. In the next video we're going to see how
we can harvest or gather as much emails
as possible from just knowing a domain.
See you there.