WEBVTT 00:00.670 --> 00:07.420 Now there are plenty of other network scanning tools and techniques that we need to talk about. 00:07.600 --> 00:15.310 So, first of all, in addition to the popular end map, I want you to be aware of each ping two and 00:15.700 --> 00:16.760 ping three. 00:16.780 --> 00:25.990 These are additional tools that make it very, very easy to perform reconnaissance using primarily ICMP. 00:26.770 --> 00:32.590 Now, in the mobile scanning department, there are many, many tools. 00:32.920 --> 00:35.860 So just imagine how useful this can be. 00:35.890 --> 00:43.780 You whip out your phone when you're connected to the local network and you run IP scanner or thing. 00:44.230 --> 00:48.190 Notice not ping but thing or the network scanner tool. 00:48.490 --> 00:54.970 These are just some of the popular mobile scanning apps that are available for your mobile platforms. 00:55.600 --> 01:02.710 When it comes to discovering hosts on the network, there's ARP based and UDP based PING scans that 01:02.710 --> 01:09.670 tools like and MAP in each ping can accomplish in order to make sure you're finding all of the hosts 01:09.670 --> 01:10.750 that are on the network. 01:11.380 --> 01:15.820 Ping sweep tools include the angry IP scanner. 01:15.820 --> 01:17.260 How's that for a great name? 01:17.470 --> 01:21.760 And SolarWinds has tools that can perform these ping sweeps. 01:22.180 --> 01:30.100 SolarWinds, of course, is featured in one of our ethical hacking in the headline stories as they were 01:30.100 --> 01:32.710 subject to a major attack that we discuss. 01:33.010 --> 01:40.780 Net Scan Tools PRO is another excellent ping sweep tool that you can have in your arsenal when it comes 01:40.780 --> 01:42.100 to port scanning. 01:42.550 --> 01:50.560 Keep in mind that tools like End Map are going to be able to do TCP based scans, UDP based scan streams, 01:50.710 --> 01:58.120 control transmission protocol as well as the Service Discovery Protocol or SDP. 01:58.530 --> 02:05.110 SDP is advertising and allowing discovery of services. 02:05.350 --> 02:14.950 So these are all protocols that port scans can take advantage of when it comes to discovering ports 02:14.950 --> 02:18.280 and services that are available in your infrastructure. 02:18.640 --> 02:21.850 And of course, we can't forget about IPV six. 02:22.120 --> 02:28.180 While IP is the focus today, more and more networks are running IPV six. 02:28.330 --> 02:31.360 So those scans are a possibility as well. 02:32.050 --> 02:38.380 Now, what about countermeasures for this type of reconnaissance against your environment? 02:38.890 --> 02:50.770 Well, let's realize it really all does come down to many times firewalls as well as intrusion prevention 02:50.770 --> 02:53.770 systems and intrusion detection systems. 02:54.550 --> 03:02.830 Now, in addition to that, what I want you doing for the networks that you're in charge of is really 03:02.830 --> 03:06.040 controlling ICMP usage. 03:06.460 --> 03:09.850 Do you even need it in all areas? 03:10.120 --> 03:18.730 And if you do need it, what aspects of ICMP do you need in one of our Hands-On demonstrations? 03:18.910 --> 03:26.350 We went in and we enabled ICMP all ICMP traffic through a firewall. 03:26.590 --> 03:28.840 But would we do this in real life? 03:29.170 --> 03:30.220 Probably not. 03:30.610 --> 03:36.580 Maybe we need dipping and get ping replies through a firewall. 03:36.760 --> 03:43.390 Well, we can be very specific and we can limit just the echoes and the echo responses. 03:43.780 --> 03:51.070 So notice we don't have to take the broad brush approach of denying all ICMP. 03:51.220 --> 03:55.870 We can intelligently filter the ICMP we need in certain areas. 03:56.560 --> 04:01.690 Another excellent idea is to build a DMZ. 04:02.200 --> 04:06.400 These are for the resources that require external access. 04:06.790 --> 04:15.400 The beauty of the DMZ, of course, is that you can give it security measures that are perfectly appropriate 04:15.400 --> 04:22.690 for those resources compared to internal resources that you don't allow anyone to access. 04:22.990 --> 04:30.400 So DMZ, these are going to be a very, very important aspect of your network design to really, really 04:30.400 --> 04:37.070 make it so that when folks are running scans, they cannot access systems. 04:37.090 --> 04:38.500 You don't want them touching. 04:39.250 --> 04:46.270 Well, this is a very involved topic, to be precise, and we're not even done. 04:46.510 --> 04:48.730 But I hope you've enjoyed this. 04:48.730 --> 04:52.100 Look at some other network scanning tools and techniques. 04:52.120 --> 04:59.500 And of course, we discussed mitigations against things like ping sweeps in host discoveries and port 04:59.500 --> 04:59.980 scan.