Instructor: Welcome back.
Here we are ready to start our scanning phase.
We have covered the information gathering
which was first phase
of penetration testing and now we'll proceed
with the second stage by scanning our target
in trying to get even more information about it.
Now, the difference between information gathering
and scanning is that scanning is performed
on a much deeper level.
And also while in the first phase we gathered all kinds
of information such as emails, phone numbers,
and bunch of other things.
In the scanning, we are mainly focused on technology side,
so we want to find out as much as we can
about our target's Technical aspect.
We're going to talk about in just a second
as to what exactly are we looking
for in this stage and what are all the goals of this stage.
But first you could be wondering what are we going to scan.
Since remember that scanning is something
that we are not allowed to do
on any target that we want.
Don't worry, for this stage
and any future stage from now on
we're going to be using vulnerable virtual machines.
There are lots of paid vulnerable virtual machines
that you can buy and test on,
but for this course I will be showing the free ones so all
of us can download them, install them
and then try to hack them.
All of these virtual machines are going to
be running some outdated vulnerable software
that we will be able to exploit in the third stage
and they will also require very little hardware power.
So all of us will be able to run them
while also running Cal Linux.
And keep in mind
that penetration testing process will look exactly
like it will look in real world
if you were to test some website or some network.
The only difference is that right now.
we know that these machines are vulnerable
since I just told you and in real world
you wouldn't essentially know that before testing them.
However, just knowing they're vulnerable doesn't really
help us as we need to figure out in what way are
they vulnerable and how can we take advantage of that.
Scanning will help us with this.
We'll be using our Cal Linux machine to scan these machines
and by scanning these machines, what they really
mean is we're going to directly exchange packets
with our target and once that target sends packets back
to us, hopefully it'll discover something about the target
machine that we will find useful.
And what we will be sending
to the target are TCP and UDP packets.
TCP and UDP are just protocols that are used
for sending bits of data, also known as packets
and we will discuss them in a little more detail
in the next video.
For now, just think of them as different protocols
that will allow us to get information from our target.
I keep talking about information and scanning and all
of that without actually explaining what do I mean
by scanning and getting information?
What are the goals of this?
What are we looking for exactly?
Well, we are looking for open ports
and I don't mean USB ports or some physical ports.
I mean we're looking
for virtual open ports that every machine has
and it uses them to host their software
and communicate with other machines over internet.
For example, you watching this
over internet on a website means that the machine
that's hosting this website has port 80 open.
Why port 80?
Well port 80 is used to host a web server
it is used for HTP and it's also known as HTP port.
So every time you visit a website
you are essentially making a connection
to that machine hosting that website on port 80
or on port 443.
Since port 80 is used for htp and Port 443
is used for HTPs and HTPs is just a secure version of http.
These are the two most usual ports that target
that you're scanning externally will have open.
And by externally scanning, I mean that you are scanning it
while not being in the same network as the target.
An example would be you scanning some website
from your home and a port that could sometimes
be open if you're scanning internally
which means either scanning machines on your network
or you're performing network penetration testing
inside of some company.
You could, for example, find port 21 to be open.
This is an FTP port and it's used for file transferring.
FTP stands for file transfer protocol.
These is just two of the ports and there are a lot of them.
You could, for example, have port 22 open
which is SSH port or secure shell port.
It is used to log
into the target machine and execute commands on it remotely.
We could also have, for example, port 53 open
which is DNS port
or we could have port 25 open, which is SMTP port.
So there are are a lot of ports.
Matter of fact, every machine has 65,535 ports
for both DCP and udp, and if there is just one open port
with one vulnerable software running on that open port
then that target is vulnerable and it could be exploited.
Now the highest secured machines are the ones
that have all ports closed.
These are usually your home devices such
as laptops or computers that you use just
for browsing online or playing video games or something.
They don't need to be hosting any software
since they're not a server that someone will connect
to for a certain service.
They're just home devices that you use.
But websites, for example, must have port 80
or port 443 open since they're hosting a webpage there.
Also in companies, their machines could have some port open.
Maybe they use that port on all their machines
within that company to internally transfer files
between different machines.
It could be anything basically.
Now the problem occurs if that software they use
on their open ports is outdated and has a vulnerability
then our job as a hacker is to scan that machine
for open ports and exploit that machine
through that vulnerable software running on that open port.
But the goal for now
in the scanning section is only to scan the target
for the open ports.
Then we want to discover what software are they running
on those open ports.
And we want to go as deep as discovering what version
of software is on that open port.
Are you ready?
We're going to be covering a lot in this section.
And in this section we will cover one
of the most important tools that a hacker must master.
That tool is called and enmap.
Let's dive into scanning.