Welcome to the unmap script overview.
Now, remember, this is going to be the most most interesting lecture throughout this, and maybe the
reason is this is where we cover the backbone, the core of the and maps it is.
And this is what we call and map.
Script engine.
Now, what is that?
It's not really some, you know, fuzzy or some some some just like a jargon or something.
It's very, very important, you know, subject when it comes to the when it comes to the end map product
in a way.
Now, what happened is and map you making use of making use of a scripting language to perform a whole
lot of automation stuff.
Let's see where exactly we make use of it.
So first thing is, you know, it is the most popular feature of a map that allow you to automate the
wide range of scanning tasks.
Let's understand one by one.
The first thing is this.
It makes you perform some sophisticated motion detection.
Oh, well, wait for a second.
We still have an option with the, you know, our basic and map scanning.
That's minus as we if you remember that correctly.
Right.
But as if you if you were if you recall my point or the minus, as we can only perform some basic version
check.
And I and I talked about some complex software as well, like Skype for business, you know, finding
out that version.
In that case, the NSC, the NSC script plays a very, very important role.
And that's where sophisticated motion detection feature really becomes helpful.
OK, so there are many other software as well where the NSC script becomes very helpful as well.
All right.
So one lability detection.
Now, this is, again, a kind of stuff that we have been looking at.
You know, if you recall the way we have been getting the version exactly the same, which was a detection
board scanning.
We used to get the vulnerability right.
We we try to get if there's any one of the vulnerable ports out there on the server side or probably
on the targets out or if there's any one less vulnerable version for any of the software.
Right.
But this is something which is, again, going on at one site because there has been many there are
many peripheral applications are independent, you know, of modules that run on every server.
That becomes very, very important when it comes to securing the entire system.
What of the script that has been developed by the NSC developers that that's called SSL Heartbleed.
And this has become very, very helpful in terms of finding out the vulnerabilities related to the SSL.
All right.
So that's where, you know, you can go and find out some more advanced vulnerability.
OK, let's there's one more very cool stuff that's called a back door detection, but thus you can even
find out backdoor for any you know, for any involvement.
Now, I hope you all of you might be aware about what exactly Bacto can perform.
If you look at the entire cyber content process.
I know the advanced persistent threat and moment back door, please.
And, you know, crucial role in terms of making sure somebody wipe off your wipe out all the data and,
you know, accelerate the return the number if you don't leave any, you know, footprint across.
So that's where Back-Door, it's even more helpful more to most of the time, you know, this kind of
a back door get detected by the map.
Regular motion detection by some at one swarms.
Detection requires the NSA scoop.
You know, so a script like, you know, there are have been many back like double pulser, NSA backdoor,
which was very focused to the SMB protocol in the Microsoft.
So that's where the NSA has been very, very popular.
And one more is the one more popular feature is called Libretti Exploitation.
Now, of course, those is a very advanced tool made for this Mandelstam.
And, you know, but the with the and map the.
It is not to have a kind of penetration testing to be performed, but it's predominantly deployed to
perform the one ability scanning, but it helps for better penetration testing when it get integrated
with your methods.
All right.
So that's where that's really a great value to the point.
All right.
So let's look at how exactly it looks like, you know, the syntax looked like so the Syntaxes and MapMyFitness
AC and the target or the so minus AC.
Remember that this is the this is the default.
When you type this, the say is OK, minus as as usual, stand for the scan, see stand capital C,
stand for the next script or you can even make use of minus minus script that also resembles to the
script.
OK, you can specify multiple scripts and the name of it, but if you don't specify it will take into
account the default, the default script, meaning that those are SSL charges and some SCDP titers.
Let me show you how exactly how exactly that works.
So if I'm on the Calli.
I'm sorry, wonderful.
Let me clear to weather here, but if I just do and math minus as captaincy and let let let me tell
you, if I, you know, scan for our own server, then go to at one point one forty one.
You will see it.
It will make use of some default script.
I have to specify a script name after minus a C, but if I don't specify it, it would take, you know,
a default script and do a.
OK.
And that's what the venue press center.
Let me show you something.
When you type any in my script and you keep we keep waiting for this.
Now what would you do if you keep on happening?
You just press enter and you get to know how much time still bending or what's the percentage you see,
we still have one second left and ninety eight percent has been done.
You press again ninety eight point one five.
It seems like it's about to be finished.
But, you know, the moment you keep pressing up, it will keep telling your kids it's almost in the
process, but it is taking some time.
It's because the we are trying to target to the floatable.
You'd all be already infected machine and that could be multiple, you know, one available.
That's why it is taking a bit more time than expected.
All right.
So I can also show you if let's say for the study purpose and you really want to, you know.
Oh, OK.
Let me first cover this up.
So you see, we got the output and in the output you will.
You will see there are many.
Sorry, this is our scanning status, and in the output status, you will see some of the port has been
covered and when we have just put minus C test, it has taken this script into account FPP, minus A.
And it makes sure that the anonymous FPP logins are allowed or not on the system and we get to know
the status of it.
And it's also look at some more script.
So as I told you, as I said, minus the host key, that is again a default script to look at.
If there's any, you know, assorted sausage related volubility available for hostages, then also related
to the DNS buying.
And we get to know some more as well.
So it will give you more idea about, you know, what are the version available, my school script and
everything.
What is the capability?
There was a number of the my school, everything.
So you don't really have to struggle in terms of finding out, you know, if there is any, you know,
specific features or application being found vulnerable or not, it will make use of some default script
to give you details about my school, SDP and everything.
OK, so let's say for study purposes, you want to target to something.
And you know very well that legally it is most of the country don't allow the scanning of their application
or server the way you want to.
So there and do a very crazy stuff or here you can basically scan their own server.
So they have made a specific server just for this.
So the name of this is getting me dot the map the world when the name is so clear that, you know,
it makes sense as well.
So the moment you type in my business as C and scan me and map dot org, it will give you a very clear
idea about it.
Normally you can reduce the timestamp by minus four.
You can make use of that as well to get the faster response as well.
So that's a one way.
Let let's go to our other engine stats and get to know what else we can do with it.
So there's one more thing called a.e debug script debug.
Now what is that?
The moment you make use of these NIST scripts, you can also get to know what all happening behind the
scenes.
Look, let me tell you what happens the moment you make use of any script.
Let's say, you know, you just with any scanning board scanning of scanning wasn't detection.
You just try to get to know if the borders open or not or the wording is what, the version of the software.
But if you want to be very specific about if the what's the entity beheader or of the SRT behavior,
what are the you know, what are the ETP methods are available and all the stuff you can make use of
this.
And that's where it becomes very, very helpful.
Let me show you making use of some Anissa's script while you perform the script.
OK, and meanwhile, we were when we were talking, we also got the response came in from the scan,
me and my brother watching.
Right.
So let me just clear this and let me tell you what exactly I'm talking about.
So let's say you want to, you know, make use of a script, OK, and map script.
And we'll talk about the list of any script that are available.
For now, let's make use of a script.
So as I told you earlier, we can either make use of a C minus A, C or B can also make use of minus
minus script, hyphen IFN script.
OK, and then name off our script the name of for instance, script over here.
Now if you just want the if you just want to execute this script, you can simply put the IP address
or the target IP address over here like then dorjee one dot one forty one.
But if you also wanted to know what's really happening behind the scene while one this command what
the script is getting executed, you can also make use of a command budget minus minus or hyphen hyphen
script.
Minus address.
OK.
The moment you do that for any any script I'm talking about, you also get to know what's really happening
behind the scenes.
You got to see this.
I have make use of made use of this command.
And in spite of just having this is just the output of the script, I get to know this is the NSC script,
SCDP header, and this is the out of output.
Often I get to know about headers of SCDP.
The header usually talk about the server, details about you to point to point eight.
It's on the server.
What's the what's the server framework.
It's to be connection is closed content type text and all this stuff.
What are the ports has been open and everything.
OK, but at the at the top you also get to know the press, you know, you executed this script and
you get to know that the connection was initiated from the local port to the destination port on board
18, and it was found to be close.
But then a lot of other stuff has also been executed based on the raw socket and other stuff.
OK, but this is what I mean when I talk about, you know, the this script in a way, the debugging
option of it.
All right.
So let's go ahead.
What are different types of scripts?
This is really, really important.
If you really want to be very, you know, expand your knowledge and be a penetration tester.
So the first interesting script type is art.
And I'll show you in detail and I'll show you how you can learn more about it and can get details about
those script.
And once we finished this, so the first step is what authors the category for script related to the
user authentication so we can try multiple walkability related to the user authentication and access
control mechanism.
Next, as broadcast, this is to broadcast multiple host and gather the information group brooders related
to the brute force attack.
We can get to know if the users are vulnerable or the systems are vulnerable to the brute force attack.
Then there's one more called default.
This category is for the script that are executed when this script scan is executed.
All right, then.
Then we have the discovery as a name.
So just it as a discovery scan, but even more advanced.
We'll talk about it when we perform this category of unnecessary.
Then there's a DOS, as the name says, it's denial-of-service or distributed denial of service when
it has critical.
So we can even detect if the if the applications of the servers are vulnerable to it, then we have
exploited this category of script can identify if the if there's any exploit available or this can be
exploitable, all the stuff then external.
This category is especially dependent on third party services if we want to test it out.
But any third party integration or API integration or service and then the first, it's basically fuzzier
in a way.
It's just did the software testing McKennis and not very specific to the security one ability.
But I'm more into the fuzzing kind of involvement, the the application testing.
It's getting executed.
Let's continue into this category is for for scanning some instance which may lead to, you know, crashing
up the crashing out the entire software and that application all together.
So that could be because of network noise and in fact, the entire network all together.
So that's, again, a part of testing software, testing and moment malware detecting the malware.
But this is a script.
I'll show you how there are there have been multiple unless the script has been built by a developer
all across the world for specific malware itself to detect some of the signatures of those malware is
OK.
See if this is not about finding the vulnerability, more of finding some of the safe application.
OK, then we have Wazzan.
And this is specifically, as I told you earlier, for avoiding detection.
But advanced version detection, OK, not the minus as we basic version detection option at the end
we have one.
This is for specific CV detection to let's say you have been notified with some.
KVI, and that found to be very critical at that moment.
You can get those KBE and you can scan all your net worth against that CB number and can get to know
if any of your host is affected with that or not.
OK, so that's all about it.
And this is all available as a basic part for the new script and the in the next lecture and the next
section will talk in detail about several vulnerabilities and, you know, exploitation of those vulnerabilities
as well.
So next lecture, next section would be very, very interesting from now.
All right.
Thank you.