WEBVTT

00:01.420 --> 00:02.589
Hey, everyone, glad we just went

00:02.590 --> 00:03.729
ahead and ran our Christmas scare,

00:03.730 --> 00:05.589
as well as a sin scam on

00:05.590 --> 00:06.789
our target, and we took a look at

00:06.790 --> 00:07.790
the results on that.

00:07.840 --> 00:09.099
Now, in this video, we're going to

00:09.100 --> 00:11.109
actually go turning on the Windows

00:11.110 --> 00:12.110
firewall again.

00:12.280 --> 00:13.989
We're going to do our typical thing

00:13.990 --> 00:15.369
where we did before of blocking

00:15.370 --> 00:16.238
incoming connections.

00:16.239 --> 00:17.289
And what we're going to do

00:17.290 --> 00:19.329
ultimately is run an acknowledgment

00:19.330 --> 00:21.010
scan after we do all that

00:21.250 --> 00:22.869
and take a look to see if there's

00:22.870 --> 00:24.350
any type of packet loss at all.

00:25.090 --> 00:26.199
So let's go ahead and get started

00:26.200 --> 00:27.669
here. So we want to connect back to

00:27.670 --> 00:29.238
our lab S01 machines so that top

00:29.680 --> 00:30.909
on there again, just hover your

00:30.910 --> 00:31.959
mouse over top and click on the

00:31.960 --> 00:33.819
name, and then

00:33.820 --> 00:35.139
we're going to go ahead and modify

00:35.140 --> 00:36.549
our Windows firewall settings.

00:36.550 --> 00:37.839
So you'll see here we're going to

00:37.840 --> 00:38.950
right click on the start menu.

00:39.100 --> 00:40.590
We're going to type in firewall dot

00:40.630 --> 00:42.100
kpl in the run option and then

00:42.520 --> 00:44.200
just press Enteron on our keyboard

00:44.410 --> 00:45.699
to pull up the Windows firewall

00:45.700 --> 00:47.229
screen. So just right click here,

00:47.590 --> 00:49.479
go to run and then we're going

00:49.480 --> 00:51.280
to type in firewall that

00:51.400 --> 00:53.115
kpl and then just press enter and a

00:53.200 --> 00:53.979
keyboard.

00:53.980 --> 00:55.539
It'll pull up the windows firewall

00:55.540 --> 00:56.540
for us.

00:57.130 --> 00:58.509
Our next step is on the left side

00:58.510 --> 00:59.770
here. We're going to click the turn

01:00.070 --> 01:01.899
Windows firewall on or off and I'll

01:01.990 --> 01:03.039
actually take this to the screen

01:03.040 --> 01:04.040
where we want to make some

01:04.150 --> 01:05.529
modifications to these settings

01:05.530 --> 01:06.969
here. So let's go back to our lab

01:06.970 --> 01:08.049
documents. Just double check what

01:08.050 --> 01:09.569
our setting changes are going to be.

01:10.060 --> 01:11.229
So that's going to be here under

01:11.230 --> 01:12.930
step six and step seven.

01:13.360 --> 01:15.189
So in the top option here, we're

01:15.190 --> 01:16.419
going to just check the box to the

01:16.420 --> 01:17.709
left of the block, all incoming

01:17.710 --> 01:18.549
connections.

01:18.550 --> 01:19.809
And then in the bottom box, we're

01:19.810 --> 01:21.310
going to turn on Windows firewall

01:21.520 --> 01:22.839
and then check the box next to

01:22.840 --> 01:24.459
blocking all incoming connections.

01:25.420 --> 01:26.349
So let's go ahead and do that. Now.

01:26.350 --> 01:27.369
We're just going to check this box

01:27.370 --> 01:28.987
here and then we're going to turn

01:29.260 --> 01:30.579
on Windows firewall by clicking

01:30.580 --> 01:32.169
there and then click in the box to

01:32.170 --> 01:33.579
block all incoming connections.

01:33.730 --> 01:34.959
And then the last step here is just

01:34.960 --> 01:36.429
clicking on the OK button to save

01:36.430 --> 01:37.359
those changes.

01:37.360 --> 01:38.879
Now, as I mentioned before in a

01:38.980 --> 01:40.548
previous video, this may lock up

01:40.930 --> 01:42.039
this particular machine, and that's

01:42.040 --> 01:42.999
fine. We're not going to come back

01:43.000 --> 01:43.989
to this one. We're actually going to

01:43.990 --> 01:45.579
be done after this video in the lab

01:45.580 --> 01:46.580
series.

01:47.260 --> 01:48.429
And so not all we're going to do is

01:48.430 --> 01:49.899
go back to our Windows 10 machine.

01:49.900 --> 01:51.249
So just click back on our Windows

01:51.250 --> 01:52.149
Ten machine.

01:52.150 --> 01:53.289
We're back here at the command

01:53.290 --> 01:54.969
prompt. I'm going to type in clear

01:54.970 --> 01:56.109
again like I normally do, just to

01:56.110 --> 01:57.580
clear things up and press enter

01:58.120 --> 01:59.229
again. You don't have to do that if

01:59.230 --> 02:00.230
you don't want to.

02:00.850 --> 02:02.019
And so now we're going to go ahead

02:02.020 --> 02:03.340
and actually run our command.

02:04.240 --> 02:05.379
So in the terminal window, we're

02:05.380 --> 02:06.579
going to type this command here.

02:06.580 --> 02:08.439
So the ping three space

02:08.440 --> 02:10.299
dashkova Casey space,

02:10.300 --> 02:11.917
the number one space dash capital

02:12.400 --> 02:14.379
V space dash lower case

02:14.380 --> 02:16.330
P space, the number eighty

02:16.780 --> 02:18.520
space dash lowercase s

02:18.850 --> 02:20.889
space, the number 555.

02:20.890 --> 02:22.269
Again, we're specifying the number

02:22.270 --> 02:24.034
we want to send packets from a space

02:24.490 --> 02:26.529
dash capital A and then finally

02:26.530 --> 02:28.360
are 192 down one six eight zero

02:28.540 --> 02:29.549
one IP address.

02:29.890 --> 02:31.605
So as usual, we're going to go step

02:31.870 --> 02:32.679
by step through this.

02:32.680 --> 02:33.639
So the first part we're going to

02:33.640 --> 02:34.767
type in is paying three

02:35.590 --> 02:37.419
space lower case C,

02:38.710 --> 02:40.779
so H paying three space Deshler

02:40.780 --> 02:41.780
Kacie.

02:43.270 --> 02:44.259
All right, so the next thing we're

02:44.260 --> 02:45.926
going to type in, it's going to be

02:46.210 --> 02:47.778
a space, the number one and then

02:48.040 --> 02:49.180
a dash capital V,

02:50.140 --> 02:51.819
so space the number one

02:51.970 --> 02:54.039
dash space and then a dash capital

02:54.070 --> 02:55.070
D and Victor will

02:55.990 --> 02:57.558
put another space and then we're

02:57.850 --> 02:59.418
going to type in the port number

02:59.530 --> 03:00.770
here. So we're to type in dash

03:00.890 --> 03:02.311
lowercase P space, the number

03:02.800 --> 03:04.779
eighty, so dash lowercase

03:04.780 --> 03:07.110
P space, the number eighty specified

03:07.120 --> 03:08.319
port number eight where we want to

03:08.320 --> 03:09.320
send it to.

03:09.840 --> 03:11.229
We'll put another space here and

03:11.230 --> 03:12.549
we're going to put a dash lowercase

03:12.550 --> 03:13.550
s space and

03:14.470 --> 03:15.940
then five five five five again

03:16.030 --> 03:17.469
specifying the number that we want

03:17.470 --> 03:18.639
to send the traffic from.

03:19.880 --> 03:21.149
We'll put another space here

03:21.910 --> 03:23.169
and then finally we're going to put

03:23.170 --> 03:24.297
in a dash capital A and

03:25.060 --> 03:26.249
then our IP address.

03:26.500 --> 03:27.789
So we're going to type in dash

03:27.790 --> 03:28.790
capital, a space and

03:29.710 --> 03:30.819
then our IP address. And we've been

03:30.820 --> 03:32.620
using the 192 dot one six eight

03:33.100 --> 03:34.668
zero dot one and then just press

03:34.840 --> 03:35.949
enter a new keyboard there to go

03:35.950 --> 03:36.949
ahead and run the scan.

03:36.950 --> 03:38.019
Shouldn't take too long to run.

03:38.020 --> 03:39.039
You see, it just happened there

03:39.040 --> 03:40.040
pretty quickly.

03:40.150 --> 03:41.139
But now let's take a look at our

03:41.140 --> 03:42.140
questions here.

03:42.250 --> 03:43.916
So question number one, what's the

03:44.050 --> 03:45.580
percentage of packet loss and

03:45.730 --> 03:47.319
question to how did that differ from

03:47.320 --> 03:48.829
when we ran that initial technology?

03:48.830 --> 03:50.560
We scan a couple of videos ago,

03:51.220 --> 03:52.359
so let's take a look here and see

03:52.360 --> 03:53.469
what kind of results we get back.

03:53.470 --> 03:54.999
So what percentage of the packet

03:55.000 --> 03:56.000
loss is there?

03:57.740 --> 03:59.150
So we see that it's 100 percent

03:59.390 --> 04:01.639
loss, right? And the difference is

04:01.640 --> 04:03.404
between the previous scam we ran and

04:03.590 --> 04:05.011
this one is we noticed in the

04:05.210 --> 04:06.949
previous scam that we sent a packet,

04:07.100 --> 04:08.689
we got a packet back, and so we had

04:08.690 --> 04:10.539
a zero percent packet loss.

04:10.940 --> 04:12.430
So this makes perfect sense, right?

04:12.460 --> 04:14.224
We do see that there's a firewall in

04:14.240 --> 04:15.469
place or in use.

04:16.140 --> 04:17.509
So this could be a helpful thing as

04:17.510 --> 04:19.127
we're scanning particular systems

04:19.610 --> 04:21.109
to find out, is there a firewall in

04:21.110 --> 04:22.825
the way you know? Is there is there

04:22.880 --> 04:24.949
packet loss or is it related to

04:24.950 --> 04:25.950
possibly a firewall?

04:26.720 --> 04:27.919
And that might tell us, like, OK,

04:27.920 --> 04:29.269
well, this thing's secured.

04:29.270 --> 04:30.439
So No. One, there might be something

04:30.440 --> 04:32.204
valuable on this system that we want

04:32.300 --> 04:33.868
to get to. And number two, maybe

04:34.370 --> 04:35.689
we need to be a little more stealthy

04:35.690 --> 04:37.850
about our approach since there are

04:38.150 --> 04:39.619
security appliances in use.

04:41.150 --> 04:43.540
Also in this entire lab series,

04:43.750 --> 04:45.514
all these videos here, we went ahead

04:45.730 --> 04:46.809
and just kind of broke down some

04:46.810 --> 04:48.099
different and in each paying three

04:48.100 --> 04:49.599
commands. We also went ahead and

04:49.600 --> 04:51.129
turned on one, the Windows firewall

04:51.130 --> 04:52.551
and a couple of instances and

04:52.600 --> 04:53.859
noticed the difference between

04:54.370 --> 04:55.899
running a command with it on and

04:55.900 --> 04:56.900
with it off.

04:57.310 --> 04:58.719
And the next module, we're going to

04:58.720 --> 05:00.009
talk about things like banner

05:00.010 --> 05:02.019
grabbing as well as things like open

05:02.020 --> 05:02.440
ports.