WEBVTT 00:00.750 --> 00:08.310 You may have noticed that this video is really something a bit unique for the course, and that's because 00:08.310 --> 00:10.830 it's a video dedicated to one tool. 00:10.920 --> 00:15.210 We don't often do that here in the aftermarket, but we've done it. 00:15.210 --> 00:18.540 And that's because End Map is something you just have to know. 00:18.550 --> 00:28.650 This is an incredibly popular network scanning tool and this is extremely popular, not just above, 00:29.040 --> 00:31.140 not just among the black hats. 00:31.440 --> 00:37.950 This is something that has been used by network administrators to help them document network information 00:37.950 --> 00:39.140 for a real long time. 00:39.150 --> 00:43.290 But of course, it's also popular in the hands of the attackers as well. 00:43.710 --> 00:50.640 One of the reasons it's so popular is it's ubiquitous for every operating system you can imagine, and 00:50.640 --> 00:57.810 there's a convenient graphical user interface as well as a command line option for running this popular 00:57.810 --> 00:58.230 tool. 00:58.860 --> 01:04.470 So let's go ahead and take a look at end map in action right now. 01:05.310 --> 01:11.880 If you had up to the end map dot org website, you're going to see this beautiful site. 01:12.800 --> 01:13.070 Yeah. 01:14.420 --> 01:14.750 Yeah. 01:14.750 --> 01:17.470 This site has looked like this for a long, long time. 01:17.480 --> 01:25.010 But anyways, notice there is a download tab where you're going to find the platform for your download. 01:25.010 --> 01:31.070 So you would download and install this on a machine, of course, and in a network where it would be 01:31.070 --> 01:32.150 authorized to run. 01:32.870 --> 01:38.660 Now notice here I am in the graphical user interface of the application. 01:38.660 --> 01:40.430 So I've just launched the application. 01:40.430 --> 01:47.930 And one of the things that's nice about the GOOEY is it will help you learn the switches and the syntax 01:47.930 --> 01:48.740 of end map. 01:48.980 --> 01:50.720 Yes, I've got flashcards. 01:50.720 --> 01:52.070 It'll help you with this as well. 01:52.070 --> 01:55.970 But you really should know these switches and this can really help you. 01:56.330 --> 02:03.290 So let's say my target is my entire 1921680 subnet. 02:03.590 --> 02:08.270 So notice I can enter 19216800 slash 24. 02:08.600 --> 02:11.510 And then notice there is this profile here. 02:11.510 --> 02:22.280 So if I want to do just a quick scan notice it will drop in these parameters here for me in an automated 02:22.280 --> 02:22.970 fashion. 02:23.090 --> 02:26.930 So it builds the command for you based on this profile. 02:26.930 --> 02:29.720 And then I will click the scan button. 02:30.080 --> 02:39.530 If you look really closely here, you will see that when you have a scan in process, you can see that 02:39.530 --> 02:40.790 the scan is in process. 02:40.790 --> 02:44.030 You'll see this little meter is running. 02:44.540 --> 02:49.880 So notice that's how easy it's going to be to utilize the gooey in there. 02:49.880 --> 02:51.620 You can see what I was telling you about. 02:51.620 --> 02:59.390 There's the scan running that little meter off to the right there and notice it started the end map 02:59.390 --> 02:59.840 scan. 03:00.290 --> 03:03.770 Now these and MAP scans are very active. 03:03.770 --> 03:05.600 This is not passive scanning. 03:05.600 --> 03:07.280 This is a very active scan. 03:07.520 --> 03:14.060 And notice it's going to take some time for it to complete the scan of my local network. 03:14.060 --> 03:19.340 And keep in mind, I chose the quick scan profile option. 03:19.850 --> 03:26.210 So while this scan is running, we'll come back and take a look at the results in a moment. 03:26.210 --> 03:32.690 I thought this would be a great place for me to educate you on ways you can speed up your end map scans. 03:33.620 --> 03:40.040 So the key to speeding up and map, well, first of all, only test for what you need. 03:40.220 --> 03:48.380 I think that pretty much goes without saying that you don't want to be doing any map tests for information 03:48.380 --> 03:50.150 that you don't actively need. 03:50.150 --> 03:53.480 So make sure to keep the scope nice and small. 03:53.990 --> 04:02.060 There are timings that you can manipulate, so you can always tune your end map scans by manipulating 04:02.060 --> 04:03.500 the timer values. 04:03.770 --> 04:10.370 This is often hit or miss, but can make vast improvements in the overall times of your scans. 04:11.090 --> 04:14.450 Something else you should consider doing is separating your tests. 04:14.450 --> 04:22.250 So again, make the tests small and precise what you're looking for, and then do another test looking 04:22.250 --> 04:23.180 for something else. 04:23.180 --> 04:29.690 Separating the tests will often help keep your end map upgraded, so always check that you've got the 04:29.690 --> 04:37.160 latest version and you may want to run concurrent tests against different subnets, different nodes. 04:37.280 --> 04:38.840 So that's something to think about. 04:39.050 --> 04:43.760 You might be testing one area of your network at the same time is testing another area. 04:44.060 --> 04:50.360 And speaking of areas and maps, speed and success is all about location. 04:50.570 --> 04:56.600 So you need to be in a location where you can actually access the nodes that you want and test. 04:57.260 --> 05:04.490 Finally, you want to make sure bandwidth is available and CPU resources are available in order for 05:04.490 --> 05:08.420 these and MAP scans to be as snappy as possible. 05:09.170 --> 05:13.610 Well, those are some things to think about in the regards of speeding up end map. 05:13.610 --> 05:18.530 Let's go over and see how our test scan is doing against my local network segment. 05:19.680 --> 05:21.120 So wonderful. 05:21.120 --> 05:22.150 It's finished. 05:22.170 --> 05:23.340 Look at this. 05:23.340 --> 05:26.870 And remember now this was just a quick scan. 05:26.880 --> 05:32.010 So it is showing me the 94 filtered TCP ports. 05:32.280 --> 05:37.510 It's showing me the ports that are open on that particular device. 05:37.530 --> 05:42.300 This is the report for the 19216801 node. 05:42.810 --> 05:44.220 So wow. 05:44.460 --> 05:46.650 It is showing me open ports. 05:46.770 --> 05:51.590 Notice here's the 1921680 to the ports that are open. 05:51.600 --> 05:54.030 The Mac address is reported. 05:54.330 --> 05:59.700 So lots of incredible information on this quick scan notice. 05:59.850 --> 06:01.830 That was the end map output. 06:02.070 --> 06:04.470 They then show me the ports and hosts. 06:04.740 --> 06:08.250 Then there is a topology tab that is fun. 06:08.490 --> 06:13.930 So we can come in and let's see, how do we zoom on this, Poppy? 06:14.490 --> 06:19.840 There's a way you can zoom in to this view. 06:19.860 --> 06:21.510 Let me see here. 06:22.900 --> 06:27.300 But anyway, it's it's not working right now because of my screen recording software. 06:27.480 --> 06:35.490 But just trust me, you're going to be able to zoom in on this and notice move this around. 06:35.850 --> 06:36.180 Yeah. 06:36.210 --> 06:41.190 It's not wanting to work because of my recording software, but trust me, it'll work for you. 06:41.490 --> 06:47.280 Here's host details that were found and just unsaved scans that were performed. 06:47.490 --> 06:50.100 Notice, here's our hosts over on the left. 06:50.310 --> 06:58.500 And there's also a list of operating systems when you do a scan to determine the operating systems of 06:58.500 --> 06:59.190 your hosts. 06:59.580 --> 07:07.350 So this is a very powerful tool that you want to become familiar with, both the graphical user interface 07:07.350 --> 07:07.860 version. 07:08.040 --> 07:11.940 And let me show you the CLIA version as well. 07:13.240 --> 07:17.730 So really we are often running in map from the CIA line. 07:17.770 --> 07:21.140 It is so incredibly efficient to do it this way. 07:21.160 --> 07:29.120 Let's say want a new enumerate information or at least scan for information on one of my nodes. 07:29.140 --> 07:34.840 Notice I can drop to the command line and I can just say and map one nine do 16801. 07:35.170 --> 07:38.470 If I wanted to scan the entire subnet, I could have done that. 07:38.680 --> 07:41.440 But here I am just scanning one of the devices. 07:41.590 --> 07:50.440 This is scanning my local default gateway and I can see that it has ports open for HTTP, https, upnp 07:50.440 --> 07:52.060 and HTTP proxy. 07:52.630 --> 07:57.520 We're gaining so much information, including the MAC address of that local default gateway. 07:58.180 --> 08:05.380 Now, if you want your cheatsheet, just type in n map and you're going to get the cheat sheet with 08:05.860 --> 08:10.960 the switches that we can use with this powerful, powerful tool. 08:11.230 --> 08:16.720 Some of these switches you would really want to know, and I'm going to be assigning you flashcards 08:16.720 --> 08:18.550 so you get to know these switches. 08:18.820 --> 08:24.520 But this is definitely a tool that I want you practicing with from a hands on perspective. 08:25.840 --> 08:34.630 So again, it's not all that common that we go ahead and focus an entire video on a tool, but end map 08:34.630 --> 08:36.370 certainly warrants that. 08:36.580 --> 08:42.850 In the next video, we'll talk to you about some other scanning tools and other scanning techniques 08:42.850 --> 08:44.080 that you should be aware of.