Section for tuning and map scans.
Welcome to the video.
Finding live hosts on the network in this video we will perform a quick sanity check to ensure the hosts
we are going to scan include all the subnets in scope.
We'll explore some ways to discover the Live hosts on those subjects and we'll save the live hosts to
a text file for more efficient scanning later on as we discussed in past videos.
If you're going to be doing vulnerability scanning for your corporate network or client networks you
won't likely be examining just a single subnet a client might have you scanned hundreds or thousands
of machines.
So it's important for us to be able to know some ways we can leverage and map to make our scans run
as efficiently as possible.
One tip we talked about is having a text file created that has each of your targets subnets in it one
sudden per line.
We can then call that file and map scan by using the TAC lowercase i capital L command and then reference
our file with the list of subnets in it.
In cases like these you might just want to do a quick sanity check on the targets you're going to scan
before you actually begin the scan itself.
You can do that by using nmap map with the Ptak lowercase s capital L command which stands for list
scan and then again we can call our submits file with the TAC lowercase i capital L and our subnet statics
t file.
Note that this scan does not send any traffic to the target hosts.
And if we want to save this off to a file for our client to review before we kick off the more intrusive
scans we can use a greater than sign and a file name to do just that.
OK.
So let's say the client gives us the OK to scan all these networks and they tell us that everything
in their network responds to a ping.
In that case one initial scan that can save us some time is a ping scan which we covered in earlier
videos.
That's just and map plus TAC lowercase s n and the TAC lowercase i n capital L plus our target subnet
file.
And if we want to save those results off to a file called Live hosts XTi again we just use the greater
than sign and the file name.
However remember that if we're going to use this file for later scanning operations and map needs the
file to have one host or subnet per line.
And right now we've got a bunch of extra information in our output.
That map won't understand so to whittle that output down a little.
Let's pull out a command we used in a past video.
Again don't be turned off by this foreign looking command as we'll learn more about our putting our
scan in various formats in future videos.
For now just know that this scan is conducting our ping scan against the subnets start textfile and
then using grep and awk commands.
It filters out everything from the output except the list of IP addresses.
And then we'll save that to a file called Live hosts here XTi.
Also remember that if we want to see the progress of the scan in real time we can open up a new terminal
window and do a tail space task f plus the live hosts textfile OK.
So we're all set.
Now in past engagements a common scenario I've run into is halfway through obtaining my nice clean list
of live IPs.
The customer says Oh whoops I forgot to tell you about this one other sudden that we have.
Can you scan that to well it's easy enough to do this by making a few tweaks to the last command.
I'm going to remove the tech space i l and subnet list since we've already scanned that and I'm going
to replace it with the new subnet that the customer gave me the one other minor but very important change
I'm going to make is I'm going to add another greater than sign before the live hosts Dottie XTi the
reason for that is that if you are writing output to a file a single greater than sign essentially means
creating a file with this output.
And in our case we're using a file called Live hosts Dotti XTi.
But if I run another scan later and send the output to live host 60 the original Live host will be overwritten.
However if I run a command and then use to greater than signs any output from my scan is appended to
the end of the original file.
So let's let this command run and then we'll look at our results again.
Here we see a newly discovered Host 1 9 2 1 6 8 6 6 has been appended to the bottom of our Live hosts
file.
So we found all the live hosts on our network and we're clear to proceed with more intrusive scans.
But let's say the customer told us that some of the hosts we'd be scanning might not be discoverable
by pinging.
And that to be safe we should just thoroughly scan every host as if we assumed it was up and live on
the network.
That is doable with a simple and map Flegg change but to demonstrate the time overhead we introduce.
Let's go back and quickly look at a basic and map scan.
So I'm just going to run and map scan with no flags against just 10 hosts in my 1 9 2 1 6 8 3 x network.
When you run a scan this way and map does a few things to see if it can determine that the host is live.
It sends an ICMP echo request a TCAP send packet to port 443 a TZP ack packet to port 80 and an ICMP
time stamp request.
If a host responds to one of these queries it receives a standard nmap scan of the thousand most common
ports which we discussed in previous videos.
This is a pretty lean and mean scan and as we can see and map found the live hosts in this network range
and completed in just a little over six seconds.
Now if we need to do that same scan again but operate on the assumption that all hosts are alive which
again we might want to do just to be thorough.
We can conduct the scan with TAC capital P and small n what this does is it skips the host discovery
portion and jumps right to port scanning as you'll see this adds significant time to our scan and map
spent a lot of time port scanning hostes that were dead on my network.
So it seems like it would be helpful for us to be able to fine tune our scans and try to strike a fine
balance between thoroughness and speed so that our scans are conducted as accurately as possible but
also finish in our lifetime in our next video.
We'll look at specifying port ranges to make our scans more efficient.