Acquiring permission to conduct network scanning in this video we will talk about some ways you can
get the necessary permission to conduct network scanning in your own corporate environment as well as
client networks will capture our scanning activity to a log file in case we need to cross-reference
it with issues that may occur during our scans and we'll walk through how to acquire permission to scan.
Cloud services such as those hosted on Amazon or a juror as we've seen so far in this course network
scanning can provide great visibility into not only what systems are on our network but the underlying
software and services as well.
However even something as basic as an end maps scan can have unpredictable effects on the target systems.
To give you an example many years ago I was doing a network scan for a manufacturing company and I started
with a basic unmap scan of their production submit.
Midway through that scan suddenly staff all around the building were popping their heads up over their
cubes in a panic as the network seemed to be completely down.
We pinged the core router and indeed it wasn't responding in the logs for the router.
All we could see is that the device rebooted unexpectedly within the time window of my scan.
We guessed that it was the scan that took the router down.
However I didn't have a good time stamped log of when exactly each system was being scanned.
So I couldn't back up that guess.
This experience created two learning opportunities for me.
First I made sure that all future clients were well aware of the possible side effects of network scanning.
I want to make it clear that network scanning while usually hassle free can cause system instability
and even unavailability.
I now have clients read and sign off on these warnings as part of the statement of work so that everybody
is on the same page before the engagement begins.
I also started keeping a log of devices that had been problematic for me in the past so that future
clients could prepare for my scan Accordingly the second learning opportunity that came from the scan
was the need to log all scanned activity so I can cross-reference it later.
Now we're going to learn how to tune and export scans in much greater detail in future videos but at
a high level it's very easy to capture a log of your network scan by simply adding the greater than
sign a space and a file name to the end of your scan what this will do is log all the output to a simple
text file for later reference.
Note that even though I used the verbose output we learned about in our last video the council is not
showing me any output.
That's because everything is being written to the text file and not to the council.
One way we can still watch the scan results live is by opening a new terminal window and then issue
the command tail space TAC f space.
The name of the log file
so that takes care of some gotchas and permissions we want to consider when scanning customer internal
networks.
But what about cloud hosted services they may have such as within the Amazon or as your infrastructure
well.
A quick Google search for Amazon Penn. test will take you to a form that you can fill out to request
Amazon's permission to do a network scan or penetration test against their infrastructure.
A couple of interesting things to note are that first off Amazon will not grant permission to you the
tester.
You must have your client fill the form out and then inform you when permission has been granted.
Also Amazon says that it may take up to two business days to get the form approved but I've seen it
take as long as five days so please plan accordingly.
The form itself is fairly self-explanatory prompting your client to enter contact information as well
as detailed information about the targets in scope for testing the claim will also need to specify source
IPs that your scan traffic will be coming from in-general Amazon is pretty flexible in the kinds of
testing that are conducted against their infrastructure.
However one important note is that they do not allow any testing where the target hosts are overwhelmed
with network traffic.
Typically referred to as protocol flooding or resource request flooding
on the Microsoft as your side the approach is slightly different doing a quick Google search for your
pen test will lead you to this page which tells you that as of June 15th 2017 Microsoft no longer requires
approval ahead of a pen test.
However customers are offered a pin testing notification for I'd recommend filling this out just to
keep all the work you do well well-documented and auditable.
Note that much like Amazon Microsoft frowns upon you engaging in activities that could exhaust resources
on your target's in our next video we will look at different ways to tune our network scans in order
to strike the right balance between speed efficiency and getting the desired information we need from
the scam.