All right, so welcome back, everyone.
This is Rajneesh, and the situation is about to start when we need to do this.
It's a regular practice.
In fact, if you remember, I told you about this every week, every month.
What happened is, even in my organization, whenever we take care of any clients, we do the monthly
scan for their entire network.
We perform this scan for all their all their assets.
So in that situation, we identify all the assets based on the IP address.
And once that is done, we get the report on the spreadsheet and then we share across to the specific
person, usually the team manager.
And then they each day they make apply a filter on the spreadsheet and didn't share to the respective
team.
Maybe if we got, you know, hundreds of vulnerabilities on the firewall.
So it would be shared with the firewall team.
If we have 131 liabilities on on a Cisco router, it could be shared with the network team to fix that
problem.
If we got maybe, you know, 20, 21 already is on the servers, which is comparatively pretty low in
number.
But still, for example, it would be shared, shared to the server team.
Now, all of those teams then responded back to the team to, you know, update them about this is what
happened and this is the part about it.
Right.
So this is how the dart structure really works.
And usually it would be shared, shared infosec manager shared to the, you know, the managers of those
department and then the manager of maybe network team then shared through the network analysis manager
of firewall team, shared to the firewall analyst and manager of sys admin.
Our system team basically shared the system and to fix the vulnerabilities on the server side.
So let's start over again.
In this situation, what happiness will be straight away going to our scanner?
OK, this is our scan.
Let me close it.
Yeah.
And let me launch a new scan.
At this moment, what we can do is in spite of network scan, in spite of just specifying a single IP
address, will be making use of the entire network.
So standard zeroed out one dot seal.
So zero.
So this covers the entire network because let's say I know that my Internet workspace is of Ten Network,
so I can consider all the IP address.
But if I know I just have to fit the system to scan maybe two in that situation, it would start scanning
all the IP addresses ranging from 10, not zero to one, not one to 10 to zero one dot to fifty four.
OK, and that way it would scan all those system and this subnet and I can even and then nodes go door
to door zero four five twenty four as well.
This would again cover another 255 host.
I can keep adding all the network if let's say I just want to scan all of my network so I can simply
scan all the network.
Maybe I have ten slash eight network so I can specify the zero eight.
So this we're going to scan all of my network system irrespective of their subnets they belong to.
In my situation, we have a limited host and slash twenty four.
So we have some servers.
As I have shown you.
We have got so we have got.
All right.
So we have Windows servers running.
So I will be scanning that.
We have Windows Ten machine that has been running.
We have been as DSP servers, we have got databases.
Well let me turn it up.
The difference in DCB services is so works as well and this would be started as well.
And we have got database MySQL database servers as well.
And of course we do have many desperate people running.
Do we have got OS bwl which need to be started to because this is a game that we've made us to, is
host having the ability or SBW, where the Broken Web application is a set of.
It's a group of all the infected web applications, so it more often includes more of it, including
all the Web application in a single host.
OK, and so once we specify that, we can specify the.
Great interest as well, but for now, let's keep it as it is we can in case of basic network scan,
we can't really modify any plugins to be we just have to be hazardous and let's start over again.
OK, so usually what happens is it has to discover all the cost.
So for Discovery itself, the scan is now ready for now.
Let's pause it and let me show you there's a discovery scan.
Is this especially to discover how many holes we have in the network?
So when you ran this disk scan, this will only give you an idea about what almost you or you are having
in a specific network and then you get the idea.
OK, these are the most available.
What are the operating system they are on and what application, what version of the operating system
they are running with them?
OK, that's something you can start with, OK?
So usually before doing the network scan, you can make use of discovery to discover all the hosts in
a network.
That's something you can start with.
But usually when we when we perform the network scan, start with the discovery and then start finding
the vulnerabilities of each and every host.
OK, so let me start to launch this scan and let's see what stopped happening.
You will see a list of all the hosts one by one.
And if we become lucky, we could we could see some interesting vulnerabilities as well.
All right.
So let's pause this video for now and we will wait for some time to get the report, to get the detail
about it, because that's a huge scan.
So we have reset to time, but we have got a significant amount of vulnerabilities.
Let's start with the host.
So the first thing that you see is the discovery of all this.
Who was from then on out one, not 14?
That's our that's portable.
And we have got many other hosts who still have the one liberty as well.
So then not zero on one or two.
That's the host information.
That's the Linux kernel with running the Windows system and everything that seems to be on Broadway.
And we have got one or two and we do have some more system one.
But 15 is the host name is not yet clear.
It seems to be a Windows machine.
And let's talk about one to three.
And it's majorly our server for sure, because that's our that's where the servers are running.
And this is what the vulnerabilities reports will look like.
So most vulnerable system seems to be then large zeroed out one but 14 and then not zeroed out, wonder,
well, why we don't have one of these on our any of our systems to see if we can find any vulnerabilities
for, you know, for any of us, because that's a brand new server.
There's no servers, active service running on it or any.
Well, yeah, we do have a service running, but.
But there's no additional application, no Third-Party application running, which could probably be
a weakness or could create a vulnerability on the system.
What we have a problem is with the postal system where we where we have maximum vulnerability and you
can see Eighty-three vulnerability out of that maximum.
There are 77 percent of them are critical.
Seven percent of a highly critical high would be high reach, and then 16 percent are a medium than
a four percent low and then 66 percent are of information.
So this is pretty great information.
Even if you look at the first Apache Tomcat, which is for a Web application.
So even if you look at any of this one liberty, you get the information about what those vulnerabilities
are.
And this is more likely for injections.
And this this seems to be a very risky as well if you want to get more information about any one of
them.
So what you can do is you can actually copy the.
CV, no.
And then again, you can reach out to the CBD or see the CBD and then on the CBD, you can piece the
detail and you can get to know about is it really the one?
Is it really the correct one?
Yeah.
So absolutely.
This is the right one.
It is for Apache Tomcat.
And yes, you can see this is for I don't get it.
This is how you can go deep into it and get the output about it as well.
So this is how this scam was launched and the output was available here as well.
What is the solution when when this report is downloaded by the vulnerability or security is infosec
team, it will be given to the one, you know, web developer.
Why, you may ask?
It's a security issue nationwide.
Why would you give it to the developer team?
Because while fixing it, it is all the software related problem, because this is this platform is
owned by the owner of the platform is the developer, because this is the application.
Right.
So if you see the solution, even solution can give you the better idea of doing the AJP configuration
to require authorisation or upgrade the Tomcat server two seven one zero point 100 or dissuasion or
maybe Linko.
So when you want to upgrade the server Tomcat, it's a Web application.
So if you want to upgrade the Apache servers, you need the Web team, the application team to perform
that activity.
This has nothing to do with the security right in order to upgrade any software or downgrade any application,
adding a new application or removing any application.
This is all has to be done by the application owner, the stakeholder of the application.
So this will be given to the right person, right team as well to perform the activity.
The purpose of the scanning is are the responsible person of the scanning is the security team whose
task is to detect the vulnerability and get it fixed by the concern being.
So that's the responsibility of it.
Usually it's not the it's not the way, you know, it is getting the the they just they can just simply
hand it over or give the report to the consultant manager and then it's a job of that concern manager
to get it fixed from the analysis.
All right.
So that's all about the network scanning.
I hope you've got a pretty clear sense about how this scanning really works.
We can take you in the next session where we'll start scanning the application as well.
Thank you.