Identifying open ports and services on systems in this video we will discover any open TCAP and UDP
ports on our target systems.
We'll use that information to enumerate software packages running on those ports.
And we'll attempt to identify the operating system running on each host as we talked about in several
of our past videos and map is an incredibly powerful tool for learning more about what's connected to
our networks.
In the last module we did a simple ping sweep of the network to find our live hosts and we saved it
to a file called Target ATX XTi.
So now we're ready to perform some deeper scanning and figure out what software and operating systems
are running on these hosts.
Before we scan this entire list of hosts though let's get more familiar with some unmap commands by
targeting just a single host for the time being the most basic and map scan you can run is just the
map command followed by the target IP.
I'm going to use this 1 9 2 1 6 8 3 5 IP which is the DNS server here in my test lab.
From the results we get back we can glean a few things.
First that map has reported the host as being live on the network.
The host has S-sh DNS and HTP open and unmap has determined that this system is likely running with
a VM where manufacturer network card.
Also we can see here that the scan ran pretty quick.
I also want to call your attention to this line here showing that nine hundred ninety seven ports were
closed.
It's important to know that when you do this basic and map scan with no additional flags and map is
going to scan the 1000 most common ports.
Now how does it determine which ports are the 1000 most common ports.
By referencing the built in end map services file located here at slash us our slash share slash and
map
the third field in this file assigns a frequency value to each port and that frequency value is based
on end maps own in-house research as well as data from IAEA and a the Internet assigned numbers authority.
Now if you're interested in looking at which thousand ports are the most common you might find that
challenging as this list is currently sorted by port number not by the frequency value.
Fortunately with a little Linux command line kung fu we can use a command called sort to do just that.
Now I know this sort command is nothing we've covered so far.
But don't worry as I've done in previous videos I just like to sprinkle in some more advanced commands
now and then to show you how useful the command line can be.
In cases like this where we need to manipulate data to get the most value out of it.
The tack are will reverse.
Sort the results and the TAC K-3 will sort by the third field which is the frequency value and then
I'm adding a pipe symbol followed by the word more so that we can see the results one screen at a time.
We can see the end map services file is now sorted by port frequency value.
So we can get a feel for which thousand ports and map is looking for by default OK let me run that initial
and map scan again and point out another important consideration that often confuses new and map users.
The system I'm scanning is a DNS server so we'd normally expect to see UDP port 53 open as well but
we don't see that here in our output.
So why is that well with a default and maps scan only the top 1000 TCAP ports get scanned if you want
to scan UDP ports you need to specify that with the TAC lowercase s capital you Flegg noticed that scanning
for the top thousand TZP ports took just a few seconds whereas scanning UDP ports took considerably
longer.
We'll talk more about why that is and how to fine tune our scans to be a bit more efficient.
A little later in this course in our next video we will take the information we gathered from some of
our target systems and use a built in Cali tool called Search split to identify and remediate potential
vulnerabilities.