All right, everyone, thank you so much for joining me for the next lecture, and the session will
be talking about watching that action.
Now, what is watching detection?
This is very, very interesting.
And this is very, very useful for penetration testing as well, because you know the application.
But if you even know the version of, let's say, deep version, Diesel's version or maybe any database
version, that's well, it gives you a very clear indication which volubility the software will be impacted.
But what I mean I mean that they're the one abilities that has been reported by the vendors like, you
know, Cisco, Juniper, Sequoia, my Oracle, Adobe, any any all the all these players.
These are specific for a specific version of a software.
Right after identifying those vulnerabilities, once it has been reported, they deliver, they share
some hotfix and we get a new release.
We update our system and we are good.
You know, everything is good now, but there are some of the system which don't get updated very often.
What are those enterprises?
They they tend to not upgrade the system very often, although we have Patch Tuesday and on the on the
other events.
But still there, they can't really do that because of difficulty in getting down, dying from multiple
stakeholders.
So we, you know, be still while doing the penetration testing, official penetration testing we might
find might find a system.
But the, you know, Washington software, what is your number which might be impacted, which might
be vulnerable for some of the, you know, attacks or something.
But if we with the the scanning that we have done so far with the port scanning and everything, we
just get to know what service are we running.
But here's the good news.
But it wasn't detection.
We also get to know what is the software version is a good.
Let me show you how it works.
All right.
So we just have to go to the and map and will execute the command.
The format of the command is, again, smallest.
That's simply to get it to scan.
What is the type of scan?
It's the version that has to be captured.
And we know once it is done, you specify your target.
So I specify my target.
Standard zero one one forty one.
That's pretty quick.
Let's presenter and we are we are supposed to get the list of all the service.
There's the corresponding version.
Number.
That's great for a while and.
See what happens.
Wonderful.
Now, in the earlier scan in the airport scanning, we were only getting this service, the diversion
detection scan, we also get to know the portion of each of those software to this domain.
We also get to know it's a by nine point four point two.
We also get to nine to Sambor three point four so we can look up for on the Exploit DB or any other
KBE information database to understand if somebody has to understand in this specific version is being
impacted.
But any, you know, attack or something, is this vulnerable?
Do we have any KBE attached to it?
If we have any you know, let's say this is the prophy, OK?
And we can log in to and we can possibly try to get to know if the PostgreSQL eight point 3.0 is having
some more liberties.
OK, if it is if it has, then we should get the one vulnerability information and that could be some
exploit available as well.
And this can be used for further penetration testing.
Now, let's get a bit more ahead.
What happened is usually while performing the scanning and while performing this version detection and
map, you make use of some six more than 6000 patterns.
That matches four of for more than 650 protocol like S&P, FTB, WPP and many more.
But there are some ports which know never include.
So in that case, we might miss those certain parameters.
So what are those photos?
Some DCB borders with ninety one hundred.
And it's because that creates some necessary and necessary trouble while accessing through the account.
That takes a lot of time.
But I mean when you don't get sufficient, sufficient information you can make use of it.
So what you should do is you just explicitly to the end map to include all the board, don't exclude
any board while performing the abortion detection.
And once you do that, possibly in our case, it won't give us more different.
But yes, 90 100 is the board, which is but by default, don't include.
So, yeah, but we don't see any.
So we are good with it.
Now there's one more thing.
If you, you know, if you run the unmap and you know you don't get the revision, no information very
easily.
There depends on the complexity of the software as well.
These are some widely adopted open source software and pretty old software as well.
So we are good to see that.
But there are some complex software as well.
I can name some of them, maybe Skype for business application, which and in those cases you it becomes
difficult to identify the watch a number of those software.
OK, so in that case you can make use of motion and density in what is expected.
Basically, it's the level of intensity that your unmap keep sending the props and the higher the number,
higher the intensity of the props by default or the seven if you don't mention it's going to make use
of seven.
But if you mentioned nine, so nine is the highest one zero, it's just starting.
But if you mention nine as the starting green, that it's going to be sending some high intensity probe,
trying to gather more and more information.
And let's say if you specify abortion intensity.
And city as maybe eight, so it will be more intense and as a as a as a downside, it's also take a
whole lot of time and then the normal case by default is seven.
But if we are making use of it, then it's definitely going to take a longer time.
But it all depends on what our vulnerabilities or what our ports that are being open.
OK, so even you can make it quick by making use of words like Blinder's allows to watch an intensity
of two.
So it's pretty light and it's going to be quick as well.
So you should be getting information pretty quick.
That could be a possibility that you might miss some of the information.
But it all depends on what kind of involvement you have to we need.
Do we need are we looking for some old application or complex application or is there a late application?
All the stuff.
So this is all about it.
This is very, very important for when it comes to the penetration testing, this is where the moment
you you know, you get the vulnerabilities, but the help of this, you get ability.
You try to find out the information on sites like Exploit Beebee and Civilities as well.
And then from there, you get to know if there's any exploit available.
And then you can get those exploit and you don't go to your mother's point and then target the machine
keeping by making use of those exploit and you get into it.
And that's how the penetration testing works.
And that's why the motion detection detection plays are very, very, very important role into it.
All right.
So I hope you'll like this video.
We'll catch you in the next one.