WEBVTT 00:00.900 --> 00:02.069 Hey, everyone, welcome back to the 00:02.070 --> 00:03.419 course. So in the last video, we 00:03.420 --> 00:04.619 went over operating system 00:04.620 --> 00:06.629 fingerprinting, we just ran a quick 00:06.630 --> 00:08.459 command, I guess a couple of IP 00:08.460 --> 00:10.019 addresses and we're able to see that 00:10.020 --> 00:11.609 both of them were Windows operating 00:11.610 --> 00:12.610 systems. 00:12.810 --> 00:14.459 And one of those, it was suspecting 00:14.460 --> 00:16.300 that it was possibly Windows Server. 00:16.410 --> 00:17.949 And we again, we already knew that 00:18.090 --> 00:19.854 that it was a server and was running 00:20.100 --> 00:21.929 Windows operating system on the 00:21.930 --> 00:23.789 server. And we if we have 00:23.790 --> 00:25.379 explored a little further, we would 00:25.380 --> 00:26.849 have noted that it was Windows 00:26.850 --> 00:27.850 Server 2012. 00:29.010 --> 00:30.119 So in this video, we're going to 00:30.120 --> 00:31.139 talk about banner grabbing. 00:31.140 --> 00:32.039 So we're just going to go through to 00:32.040 --> 00:33.449 a quick lab on banner grabbing. 00:33.900 --> 00:35.549 Again, Obama grabbing is this is 00:35.550 --> 00:36.579 allowing us to send a 00:37.380 --> 00:38.969 command to the target system. 00:39.090 --> 00:40.589 And then the hope is that it will 00:40.590 --> 00:42.109 kick back some kind of error or 00:42.270 --> 00:43.709 other information that will provide 00:43.710 --> 00:45.119 us with information about the 00:45.120 --> 00:47.189 operating system and the version of 00:47.190 --> 00:48.940 whatever software is in use. 00:50.220 --> 00:51.619 So let's go ahead and get started. 00:51.630 --> 00:52.529 You should be logged into the 00:52.530 --> 00:54.509 Siberry lab environment already, 00:54.510 --> 00:56.127 or at least the Siberry site that 00:56.130 --> 00:57.269 we're going to go to the search box 00:57.270 --> 00:58.740 and type in ethical hacker 01:00.330 --> 01:01.919 and it should pull up our lab 01:01.920 --> 01:03.149 environment for us, which is going 01:03.150 --> 01:04.109 to be this top one here, the 01:04.110 --> 01:06.150 certified ethical hacker or S.H. 01:06.570 --> 01:08.279 go ahead and click on that and then 01:08.280 --> 01:09.659 select this launch button here. 01:09.970 --> 01:10.829 It's going to take us to another 01:10.830 --> 01:11.939 screen here. We're going to click on 01:11.940 --> 01:13.140 the launch item option 01:13.800 --> 01:15.119 and now it should launch the lab 01:15.120 --> 01:16.159 environment for us. 01:16.620 --> 01:18.329 So once it does that, we're going to 01:18.330 --> 01:19.996 be looking for the banner grabbing 01:20.010 --> 01:21.010 lab. 01:22.200 --> 01:23.759 So we see it here, it's going to be 01:23.760 --> 01:25.139 the fifth option down on the left 01:25.140 --> 01:26.249 side here. Just go ahead and click 01:26.250 --> 01:27.059 on that. 01:27.060 --> 01:28.439 You'll see a starbound, just click 01:28.440 --> 01:29.519 on that. And that'll actually pull 01:29.520 --> 01:30.890 up our virtual machines for us. 01:31.410 --> 01:32.639 Now we're just going to turn on all 01:32.640 --> 01:33.539 these virtual machines. 01:33.540 --> 01:34.829 So the way we do that, we just hover 01:34.830 --> 01:36.398 our mouse over top of it, select 01:36.750 --> 01:38.040 the power on option. 01:39.130 --> 01:40.329 And then it should boot up those 01:40.330 --> 01:41.139 machines for us. 01:41.140 --> 01:42.039 I'm going to go ahead and pass a 01:42.040 --> 01:43.209 video because it takes about 10 or 01:43.210 --> 01:44.560 15 seconds to pull those up 01:45.100 --> 01:46.449 and I'll restart the video once all 01:46.450 --> 01:47.650 mine have launched for me. 01:50.060 --> 01:51.319 All right, so all of my virtual 01:51.320 --> 01:52.699 machines are put it up again, if 01:52.700 --> 01:53.700 yours are not go. 01:53.990 --> 01:55.099 This video, just wait for them to 01:55.100 --> 01:56.815 come back up and usually only takes 01:56.870 --> 01:58.339 about 10 or 15 seconds and they 01:58.340 --> 02:00.409 should all turn green for you, which 02:00.410 --> 02:01.519 means that they're all on. 02:02.630 --> 02:03.619 All right. So the next step in our 02:03.620 --> 02:05.510 lab is actually connecting to this 02:05.720 --> 02:07.380 lab, say zero one machine. 02:07.400 --> 02:08.599 So here in step six. 02:09.199 --> 02:10.038 So let's go ahead and do that. 02:10.039 --> 02:10.909 Now we're just going to click on the 02:10.910 --> 02:12.079 name there and it'll pull up that 02:12.080 --> 02:13.080 server for us. 02:14.000 --> 02:15.139 It might take a second or so, but 02:15.140 --> 02:16.489 you'll see a server manager window 02:16.490 --> 02:17.570 opening up. Just go ahead and 02:17.590 --> 02:19.129 excited that once it opens, we don't 02:19.130 --> 02:20.179 need to worry about that for this 02:20.180 --> 02:21.180 particular lab. 02:22.380 --> 02:23.699 And then all we're going to do here 02:23.700 --> 02:24.929 is actually just start the Apache 02:24.930 --> 02:26.749 Web server so you'll see right here 02:26.750 --> 02:27.719 on step nine, that's what we're 02:27.720 --> 02:28.720 trying to do. 02:29.220 --> 02:30.229 So let's go ahead and do that now. 02:30.240 --> 02:31.319 We're going to do that by clicking 02:31.320 --> 02:32.639 on the app icon. 02:32.650 --> 02:34.414 So this orange colored icon has an X 02:34.650 --> 02:35.650 in the center of it. 02:35.760 --> 02:36.760 Going to click on that. 02:37.500 --> 02:38.579 It's going to take a second or so to 02:38.580 --> 02:39.629 launch up for us here. 02:40.080 --> 02:40.979 And then we're just going to make 02:40.980 --> 02:42.419 sure we just click start for these 02:42.420 --> 02:43.679 bottom three options just to make 02:43.680 --> 02:45.449 sure there's no errors that happen 02:45.450 --> 02:46.450 in the lab. 02:47.460 --> 02:48.629 And we're just going to go ahead and 02:48.630 --> 02:49.919 minimize that. Now, let's move on 02:49.920 --> 02:51.020 with our lab document here. 02:52.380 --> 02:53.879 So our next step here in step 10, 02:53.880 --> 02:54.869 we're just going to connect to the 02:54.870 --> 02:56.634 Windows 10 machine, which is a P lab 02:57.060 --> 02:58.129 when 10 machine. 02:58.470 --> 02:59.699 So just go ahead and click on that 02:59.700 --> 03:01.020 on the far left side here. 03:01.770 --> 03:02.789 And this one's going to take a 03:02.790 --> 03:04.169 second or so to pull up the desktop 03:04.170 --> 03:05.609 for us. You may also see a command 03:05.610 --> 03:06.870 prompt window open up. 03:07.380 --> 03:08.639 Just ignore that and let it close 03:08.640 --> 03:09.989 again. It just takes a second or so 03:09.990 --> 03:10.990 to close. 03:12.180 --> 03:13.650 Once it's fully booted up here, 03:13.680 --> 03:14.759 we're going to double click here and 03:14.760 --> 03:16.019 step 11 will double click on the 03:16.020 --> 03:17.490 Vincey viewer icon. 03:17.500 --> 03:19.169 So it's that orange colored icon 03:19.350 --> 03:20.639 on the desktop that looks like a 03:20.640 --> 03:21.669 little tiger's eye. 03:22.230 --> 03:23.320 So this one right here. 03:23.460 --> 03:24.449 So we're just going to double click 03:24.450 --> 03:26.190 on that. It's going to open up our 03:26.400 --> 03:27.750 connection box for us here. 03:27.930 --> 03:29.960 You'll see by default it puts 03:30.000 --> 03:31.979 the Kelly Linux machine IP address 03:31.980 --> 03:32.980 in there for us. 03:33.240 --> 03:34.610 So all we have to do is click the 03:34.620 --> 03:35.909 connect one to connect. 03:36.300 --> 03:37.319 Now it's going to prompt us for a 03:37.320 --> 03:38.129 password. 03:38.130 --> 03:39.599 And so the password is here in step 03:39.600 --> 03:41.021 14. It's going to be the word 03:41.490 --> 03:43.205 password with a capital P, and then 03:43.350 --> 03:44.849 that's actually a zero and not a 03:44.850 --> 03:46.026 capital. OK, so let's go 03:46.770 --> 03:47.770 ahead and type that in there. 03:48.600 --> 03:50.039 We're going to type in capital P 03:50.550 --> 03:51.550 lowercase HSW, 03:53.520 --> 03:54.629 the number zero 03:55.380 --> 03:57.389 lowercase R D and then either 03:57.390 --> 03:58.909 click the OK button to enter on 03:59.280 --> 04:00.929 your keyboard and that will connect 04:00.930 --> 04:02.319 us to the Calli Linux machine. 04:02.460 --> 04:03.929 Now once it does that, you'll see an 04:03.930 --> 04:04.930 error message here. 04:04.950 --> 04:06.539 We can ignore that and just either 04:06.540 --> 04:08.157 click OK or just click the X to X 04:08.340 --> 04:09.340 out of it. 04:10.380 --> 04:11.849 And then our next step overlap 04:12.300 --> 04:13.525 here in step 16 is double 04:14.130 --> 04:16.139 clicking on the root terminal icon. 04:16.260 --> 04:17.159 That's just going to launch a 04:17.160 --> 04:18.160 terminal window for us. 04:18.180 --> 04:20.069 So if you're following along 04:20.070 --> 04:21.569 in your own lab environment, you're 04:21.570 --> 04:22.469 just going to you just want to 04:22.470 --> 04:24.029 launch a terminal window and start a 04:24.030 --> 04:25.709 Kelly Linux and you'll be caught up 04:25.710 --> 04:26.710 with where we are. 04:28.880 --> 04:29.899 All right, so now we're going to 04:29.900 --> 04:31.566 type in this command here, so here 04:31.730 --> 04:33.529 in step 17, we're going to type in 04:33.530 --> 04:34.729 we're basically just going to run a 04:34.730 --> 04:36.420 sound scan against Port A-T. 04:36.740 --> 04:38.149 We're going to do aggressive mode. 04:38.180 --> 04:39.559 And the goal here is to try to 04:39.560 --> 04:40.789 figure out what kind of operating 04:40.790 --> 04:42.889 system we may have in use. 04:44.180 --> 04:45.499 And so aggressive mode is basically 04:45.500 --> 04:46.939 just telling us, like, what's the OS 04:46.940 --> 04:48.289 and use, what are some other items 04:48.290 --> 04:49.789 as well? And we're going to run it 04:49.790 --> 04:51.554 against our server IP address again, 04:51.680 --> 04:53.509 which is epilepsy zero one 04:53.510 --> 04:54.510 machine. 04:54.960 --> 04:56.009 So let's go ahead and take this 04:56.010 --> 04:57.899 incident to type and map space, 04:57.900 --> 05:00.120 dash lowercase s capital s first. 05:01.820 --> 05:03.339 So and map space dash lowercase 05:04.110 --> 05:05.959 s capital s, we'll put 05:05.960 --> 05:07.549 another space there, we're going to 05:07.550 --> 05:08.922 type in the dash lowercase P 05:09.470 --> 05:10.940 space and the number eighty to 05:11.120 --> 05:12.360 specify Port 80. 05:13.550 --> 05:15.200 So that's P space 80. 05:16.350 --> 05:17.779 We put in another space 05:18.200 --> 05:19.579 that we're going to type in the dash 05:19.580 --> 05:21.197 capital A and then finally our IP 05:21.380 --> 05:23.389 address there. So dash capital 05:23.390 --> 05:25.279 a space and 05:25.280 --> 05:27.350 then one entry to that one six eight 05:28.040 --> 05:29.608 zero dot one and then just press 05:29.930 --> 05:30.930 enter on the keyboard. 05:31.190 --> 05:32.419 Might take a moment or so to run 05:32.420 --> 05:33.420 this particular scan. 05:33.920 --> 05:35.270 You may get that prompt there about 05:35.300 --> 05:36.169 Windows firewall. 05:36.170 --> 05:37.410 You can just out of that or just 05:37.430 --> 05:38.959 ignore it. Eventually it will go 05:38.960 --> 05:39.960 away. 05:40.520 --> 05:41.769 And so our scans running there. 05:41.780 --> 05:42.709 So it might take a moment or so. 05:42.710 --> 05:43.549 I'm going to go ahead and pause the 05:43.550 --> 05:44.869 video here and then we'll pick back 05:44.870 --> 05:46.910 up when the scan is complete. 05:48.170 --> 05:49.591 All right, so we see the scan 05:49.790 --> 05:51.109 results in the background there, so 05:51.110 --> 05:52.309 a couple of questions that will want 05:52.310 --> 05:53.539 to answer is we're looking at those 05:53.540 --> 05:55.304 results. Question number one, what's 05:55.370 --> 05:56.839 the operating system of our target? 05:57.170 --> 05:58.429 And then question number two, what 05:58.430 --> 05:59.998 services are running on the open 06:00.290 --> 06:01.290 ports? 06:01.340 --> 06:02.490 So let's take a look at those. 06:02.510 --> 06:03.649 Well, let's start with the operating 06:03.650 --> 06:05.365 system question, because we see the 06:05.510 --> 06:06.349 output right here. 06:06.350 --> 06:08.029 So, again, it's estimating that 06:08.540 --> 06:09.829 we're running some kind of version 06:09.830 --> 06:10.830 of Windows. 06:11.120 --> 06:12.589 And when it gives us some details 06:12.590 --> 06:13.962 here on the OS, it's saying, 06:14.420 --> 06:15.499 hey, it might be Windows Server 06:15.500 --> 06:17.629 2012, may also be Windows seven, 06:17.630 --> 06:19.002 could be Windows eight point 06:19.700 --> 06:20.599 one. 06:20.600 --> 06:22.309 But in some capacity, it's a Windows 06:22.310 --> 06:23.569 device, or at least it's assuming 06:23.570 --> 06:24.570 it's a Windows device. 06:24.980 --> 06:26.695 Now, we know that the device we ran 06:26.870 --> 06:28.579 the scan against this, a pilot say 06:28.580 --> 06:30.499 zero one, which is a server, which 06:30.500 --> 06:32.264 is actually Windows Server 2012 that 06:32.540 --> 06:33.949 is running there. So we know that 06:33.950 --> 06:35.270 that's the correct answer there. 06:35.390 --> 06:36.819 But if we were a criminal attacker, 06:36.830 --> 06:37.969 we probably wouldn't have all that 06:37.970 --> 06:39.529 information, but we could see that 06:39.530 --> 06:40.639 it's a Windows machine. 06:40.790 --> 06:41.809 And so we could start looking at 06:41.810 --> 06:44.119 vulnerabilities for Windows machines 06:44.120 --> 06:45.469 and figure out what we can use to 06:45.470 --> 06:46.850 attack this particular device. 06:47.810 --> 06:48.979 All right. So the next thing we want 06:48.980 --> 06:50.569 to take a look at and see is what 06:50.570 --> 06:52.099 kind of services are running on the 06:52.100 --> 06:52.969 ports. 06:52.970 --> 06:54.529 So if we got any response from ports 06:54.530 --> 06:56.419 at all, we want to see the services 06:56.420 --> 06:57.739 running on those ports if we scroll 06:57.740 --> 06:58.740 back up here. 06:59.860 --> 07:01.239 We will see what kind of services 07:01.240 --> 07:02.857 are running, so we see that since 07:03.130 --> 07:04.747 we ran it against Port 80 as part 07:05.110 --> 07:07.149 of our scan command, we only 07:07.150 --> 07:08.375 see port areas or output. 07:08.560 --> 07:10.149 But again, we know that. 07:10.420 --> 07:11.559 And if we didn't know that, we could 07:11.560 --> 07:12.609 look at the output, but we know 07:12.610 --> 07:14.079 that's going to be HTP. 07:15.190 --> 07:16.659 You'll also notice that it tells us 07:16.660 --> 07:17.930 the Apache version here. 07:18.400 --> 07:19.599 So we see that it's version two 07:19.600 --> 07:21.217 point four point two three, which 07:21.490 --> 07:22.839 could allow us to find 07:22.840 --> 07:24.069 vulnerabilities for that particular 07:24.070 --> 07:25.269 version, if that's an outdated 07:25.270 --> 07:26.889 version of that particular 07:27.730 --> 07:29.350 that particular piece of software. 07:30.400 --> 07:31.449 So we see we get some good 07:31.450 --> 07:33.639 information back on this particular 07:33.640 --> 07:34.640 lab. 07:35.160 --> 07:36.269 In the next video, we're going to 07:36.270 --> 07:37.589 move into so in this video, we 07:37.590 --> 07:39.179 covered banner grabbing, we just ran 07:39.180 --> 07:40.709 a couple we ran that command there 07:40.890 --> 07:42.209 to see what kind of output we got 07:42.210 --> 07:43.709 back. We want specifically wanted to 07:43.710 --> 07:45.180 find out what operating system 07:45.540 --> 07:47.130 was in use, as well as 07:47.370 --> 07:48.987 what services were running on the 07:49.050 --> 07:50.716 port. Again, we specified Port 80, 07:50.730 --> 07:52.499 so that's why we got back just Port 07:52.500 --> 07:53.500 80 in our results. 07:53.880 --> 07:55.109 But we were able to see that it's 07:55.110 --> 07:56.850 running a patsy for the 07:57.120 --> 07:58.559 DP, for the Web services, 07:59.070 --> 07:59.999 and we were able to see the 08:00.000 --> 08:01.379 versioning of Apache as well. 08:02.210 --> 08:03.769 So in the next module, we're going 08:03.770 --> 08:05.389 to go over a numeration, so we'll 08:05.390 --> 08:06.799 take a little closer look at things 08:06.800 --> 08:08.689 like dig as well as running Zend 08:08.690 --> 08:10.111 map to see if we can get more 08:10.220 --> 08:11.540 information about our target.