Hey, everyone, welcome back to the
course. So in the last video, we
went ahead and ran a command
with our tool Zend map, which again
is just a goofy version of any map.
We went ahead and checked the to
see if we could find out the
operating system of our target,
which in this case, our target
system was the server or the
Playbook zero one server,
which is a Windows Server 2012.
And we also checked to see if any
ports were open, which again, we
were able to see that, yes, they
were.
So in this video, we're going to
talk about DEG as well as finger, a
couple of commands and we can run to
potentially gain information.
So Digg is a tool or
a tool command that
we can use to potentially
do DNS zone transfer.
So in our lab today,
we're not going to actually be
successful at it. And I'll show you
or I'll talk about why that is
in this particular environment.
But you could potentially use it to
do a Dinesen transfer.
But that being said, most
companies are secured against that.
But you may if you're targeting like
a smaller organization as part of a
penetration test, you may find that
their their
web server may be vulnerable to this
type of attack.
And then we'll use a finger command
where we'll just take a look and see
if there's other user accounts on
the particular system.
So I've left up from
the previous lab.
I've left that up because most
people are just going to be continuing
through. So all you want to do here
with Zend map is just minimize it.
So this little dash on the top right
here, just go ahead and click on
that. Might take a second or so, but
it will minimize it. And all we want
to get to is our command window or
our terminal prompt that we've had
open before.
What you want to do here is you can
either close it out or you
can hit the enemy a couple of times
and get back to the
the prompt there.
So you'll come back there and I'm
just going to type clear and then
enter just to clear out that
previous command.
All right. So all we're going to do
now is we're already
past all these other steps.
So if you continue on with the from
the previous lab, then you're past
all these initial steps here of
logging into the Windows 10 machine
opening, the viewer typing in the
password, connecting to the Calli
machine, opening the terminal.
We're actually past all those steps.
So steps one through six.
If you continued on from the
previous lab, you're good to go.
If you have it, then go ahead and
pause this video and just follow
the steps to go through and launch
the terminal window that you see in
the background right there.
All right. So if you've
passed the video and come back after
you've done those steps, or if you
just continue on from the previous
lab and you followed along with the
steps that I just did, then we
should all be a step number seven
right here.
So we're just going to go ahead and
type in this particular command.
And again, our attempt
at least is to try to transfer the
zone.
As I mentioned already, it should be
unsuccessful in this attempt based
on the security settings of this
lab. But I just want you to
understand what we're kind of doing
here.
So let's go ahead and type this
command in here. So we're going to
do this, dig a SFR
practice.
Our IP address at the end here, so
let's go ahead and do that now, so
let's type in dig.
So just like we normally do, we'll
do a kind of step by step.
We'll type in, dig all lowercase,
we'll put a space,
and then we're going to type in a
SFR Oliver case,
a F.R.
We'll put another space
that we're going to type in
practice.
So we'll practice with an S
Dash Labs dot com.
So again, all lowercase here.
So practice with
an S Dash
Labs dot com and
then finally we'll put a space in
them. We're going to put our IP
address here. So the 192 dot
one six eight zero one.
So one nine two
one six eight zero.
Not one.
All right, so once you've talked
that and just go ahead and get the
key and her keyboard is going to go
ahead and run the command, and
you'll see almost immediately it
actually felt right.
And that's because we this
particular set up is secured against
us. So we should get that immediate
failure.
What you normally would see if this
was successful, as we would actually
get some output regarding the DNS
transfer, that we were successful.
So a couple of simple questions.
You know, question number two, we
actually just answered.
So do you see any of the zone
information? Were we able to
actually transfer the zone?
You'll see in this case that we were
not successful in that.
And so we do see some information
regarding what we were trying to do
with practice labs,
dotcom and then the IP address here.
But we were not successful in our
attempt.
And then the first question here,
what is Digg stand for?
So I did not mention this.
So if you want to post a video
on Google it real quick or if you
actually know that information, just
go ahead and think through what that
might stand for.
All right, so Dig stands for domain
information, Gropper, the
name is kind of creepy with the web
of the last part of it there, but
basically domain information gropers
is what Digg stands for.
And again, it's basically used
in one capacity or at least in the
capacity. We would want to use it as
a penetration tester for our DNS
on transfer or at least attempting
to do a DNS zone transfer
or at least move on to the next part
of our lab here. Again, we're going
to be using the finger command and
this will wrap up this particular
lab.
So here at a terminal window, this
go ahead and type clear if you want
to and hit enter or you can just
move on with the lab.
It's kind of up to you.
I always like to just clear it out
and move on to the next command that
I'm going to be doing.
So in this situation, we're just
going to be typing in finger space,
lowercase s space root,
so it's going to touch that and also
finger space
dash lowercase s
space root all
lowercase.
All right, so go ahead and run that
command by pressing turn keyboard
there.
What we're specifically looking for
is to find out if we find any other
users logged
in besides route, because obviously
we specified route and that's
our route user there.
So you see in the background there
the answer to question number one
here. Do we see any other users
logged in if he has read the
username there?
So we do see that there is a user
log in which in this case is
actually route, which again, we
specified.
So we can jot that down if we wanted
to. But we see that there's no other
users, at least on my end, and you
should not have a different result.
You should have the exact same
result here. You should just see
route.
And so that's our user.
Now thinking, too, that along the
context of doing a penetration test,
this is a one command that we could
potentially use to see if there's
other users on the system.
So, for example, if we typed in just
finger dash s,
we could potentially see if there's
other users on the system besides
our route user.
And you see in this case that, hey,
nobody's logged on.
All right, so this video was
discovered a couple of simple
commands, the dig tool or did
command, as well as the finger
command. And the next video, we're
going to jump in to our
vulnerability scanning.