So remember that while performing a penetration test, we should always test the network devices, whether
they're vulnerable to attacks, all the ones we've mentioned up till now, of course, we have to discover
the network devices and the services running on them first.
So let's see how we discover network devices and their services and what else we can do to attack these
services.
Come on, it'll be fun.
So, as you already know, the first step of a penetration test is always reconnaissance, in other
words, gathering the information.
So how can we collect information about the network devices?
The answer is the same with the reconnaissance of all the other parts of the penetration tests.
We can scan the network and find the network devices according to the fingerprints or operating systems
of the devices found, for example, if the operating system of a device is Cisco iOS, it's most probably
a network device such as a switch or router.
Sniffing is another way to collect data about the network devices, you should always especially focus
on the clear text services such as Telnet.
Now, one of the brilliant ways of reconnaissance is analyzing the documents collected throughout the
penetration test in a typical penetration test, you probably find a lot of sensitive information by
just looking at the file servers, shared files and e-mail backups or unprotected ASCII files of compromised
admin personal computers.
So as we were saying before, the most common services open in the network devices are S.H. Telnet,
HTTP https and S&P.
And the default parts of these services are listed in the slide.
I want to call your attention to these are the default ports, right?
So they don't have to run on the specified port.
You can run an escort service on port for three or an HTTPS service on the port.
I don't know, for three, two, one, et cetera.
You can discover more details about the network devices by analyzing these services deeply.
Right, and now they have the correct result and discover even more, you should always scan network
with OS Discovery and version detection options.
So if you look at the example in the slide, again, you see and and map, command and map is a security
scanner which is used to discover hosts and services on a computer network in the same sample command
shown the parameter is used for OAC detection, while S of Score V is used for version detection.
So just listen to the traffic.
We can gather some information about the network devices here, the protocols which use clear text communication
are especially important because you can see the payload data transferred between the end points.
The most important clear text protocols are telnet.
Cisco Discovery Protocol.
Spanning tree protocol.
Routing protocols.
VLAD trunking protocol and.
Simple network management protocol.
So let's scan the router according to the criteria that we talked about up now.
In Cali, I opened the terminal screen, so I'll use the end map to scan the router, but first.
Let's go ahead and ping the router to check the network.
So unmap is the command itself.
As Hyperscore s to make it a sin scan, a simple scan is a kind of TCP scan where a three way handshake
is not completed, but please refer to my network and vulnerability scan for hacking by and Map and
Nessus Course for more details about the unmap and those scanned times.
Target IP is our router.
Asclepius Gorvy is for the version detection of the open ports.
Oh, for the operating system detection.
Reason is to force and map to tell the reason of its decisions.
And P is for the ports, so let's scan S.H. Telnet https htp and as an MP, ports now hit enter.
So that took 15 seconds, seems the only port open is the telnet.
Here's the details, it is a Cisco device and one of these series.