Section two performing effective network scanning.
Welcome to the video.
Creating a system inventory with unmap in this video we will use a tool called unmap to find all the
live systems on our network.
Use the map tool in combination with additional command flags to get more verbose output out of our
skins and will output the results of our scan into a text file which we will be using heavily in the
next video is in this course and map which is short for network mapper has been around for more than
20 years.
It runs on all major computer operating systems and is well-documented in countless books blogs and
videos.
You should definitely take time to get familiar with that map.
But for the purpose of this course we are just going to jump right in and start using it to learn more
about what's running on our network.
However it's important to note that unmap has a good basic help guide that you can access by simply
typing unmap and hitting enter notice that the screen went by too fast for us to catch everything so
we can simply scroll up to read what we missed or issue the nmap command again with the pipe symbol
plus the word more and hit enter.
That way we can see the unmap help output one screen at a time.
As you can see there are all sorts of options for running and tuning and exporting are scan's.
Now if this was a new network that we didn't know anything about.
One of the first things we may want to do is figure out which hosts reply to a ping.
This is often called a Ping's sweep or Ping's scan and can be done by using unmap with the TAC s n flag
first let's do a quick I-F config command to see which network we're on.
And as we can see it looks like I'm on a 1 9 2 1 6 8 3 x network so I'm going to run and map space TAC
s n space 1 9 2 1 6 8 3 0 slash 24
as you can see the scan finished pretty quickly and has given us a list of live hosts and their MAC
addresses.
But there's no mention here of hosts that didn't respond to a ping any time we want more verbose output
out of our map scan.
We can add the TAC V flag with the V standing for verbose.
So let's run that same map command again this time with the TAC we added And now we can see more information
on all the hosts that did not reply to a ping.
In addition to the ones that did now one of the things we will be doing later in the course is some
deeper scanning on only the Live hosts on our network.
So it's going to be important for us to have a nice clean list of live IPs saved off to a text file
with one host on each line.
We can certainly copy and paste the IPs into a text file one by one.
But I thought it would be fun to show you one of the more advanced commands that can create this text
file for us in one swoop.
First let me type out the command and run it will review the results and then we'll talk through how
they came to be.
Again don't worry if a lot of this looks new or weird I'm skipping ahead simply to show you how powerful
and flexible of a tool and map is especially when combined with other built in Linux tools.
Here we have a nice clean list of live network hosts one on each line.
This is exactly how mapped wants our list of hosts to look like when we do deeper scans in our upcoming
videos.
But let's take a step back and break this down one chunk at a time.
We started with our map space tech and command which again is going to find all the hosts on our network
that respond to a ping then the tack o capital G Flegg is going to export our scan results in a grapple
format.
Now if you've not played with grep that's OK.
Take some time to play around with it on your own.
But for the purposes of this example just think of grep as a way to search for words within a file.
Before we do any grepping though let's just run the first chunk of our command to see what the results
look like.
This output looks pretty much the same as when we ran in map space TAC as in on its own but let's run
the command again this time adding the pipe symbol and then the words grep space up.
What this does is take the results of our and map scan and select or grep only the lines containing
the word up.
This gets us closer to a clean list of IPs but we're not quite there yet.
We still have a lot of extra words like host and status Colan up to get rid of.
This is where the W-K or AHC command comes in.
If you haven't worked with awk add that one to your self-study list to.
But in this example we're using it to essentially say print me out only the second field of data in
the output which in this case is our list of IP addresses.
Ah.
The result is a nice clean list of addresses one address per line.
So the last thing we need to do is save this to a text file for use in our upcoming videos.
We could just copy and paste the list into a file but since we're learning how to save time by chaining
together commands and terminal let's just add a greater than symbol followed by a filename.
What this is going to do is write the output of our long and map commands to a text file for later use.
So at this point we know which hosts are responding to a ping on our network and we have them captured
to a simple text file called targets XTi in the next video we'll build upon our and map knowledge and
begin scanning hostes deeper to discover more about their exposed ports services and underlying operating
system.