Welcome to Part Five of this module.
Today we're going to be taking a look at what many consider to be the king of scanning tools and map
and map is short for network mapper.
And it is free and open source utility for network discovery and security auditing and map uses raw
IP packets and novel ways to determine what hosts are available on a network what services those hosts
are offering what operating system and operating system version they are running what type of packet
filters or firewalls are in operation as well as many other unique characteristics.
It was designed to rapidly scan large networks but works for single hosts as well and map runs on all
major computer operating systems and official binary packages are available for Linux Mac OS and yes
even Microsoft Windows.
In addition to the classic command line version the unmapped suite includes an advanced graphic user
interface and results feature called z map which will be taking a look at in a future module.
Both of these come prepackaged with Kali 2.0 and can be easily downloaded for any operating system from
the end map Web site and map dot org.
The output for any map is a list of scanned targets with supplemental information on each depending
on the options selected during each scan.
Key among that information is the interesting ports table the table lists the port number and protocol
service name and state of each port the state being either open filtered closed or unfiltered open ports
indicate the presence of an application on the target machine that is listening for connections and
packets on that port filtered on the other hand would mean an application listening on them though they
couldn't they could be open at any time ports are classed as unfiltered by any map when they're responsive
to probes but when any map cannot determine whether or not they are in an open or closed state and of
course closed is self-explanatory.
The port tables that in map displays may also include software version detail when version detection
has been requested when an IP protocol scan is performed and map provides information and supported
IP protocols rather than listening ports.
In addition to the ports table and map can provide further information on targets that include reverse
DNS names operating system guesses device types and even MAC addresses and map has actually been featured
in multiple movies including The Matrix Reloaded diehard 4 and The Bourne Ultimatum.
The real value of any map is to learn the lay of the land before a penetration test finding out which
ports are open and gaining critical information about a target.
It is entirely possible to scan entire net blocks using any map such as those you might acquire on a
target after a multi go search.
See the module on multi go for more details about that.
In this tutorial we're going to be covering the basic usage of any map and the core concepts associated
with it loading and map is in fact very simple.
We just go to applications information gathering
and we could click on any map or
or we can do it like pros and type and map in the terminal window.
When you first load and map without any kind of argument you will be presented with a rather intimidating
looking series of optional arguments which will make the program appear far more complicated to use
than it really is.
It is beyond the scope of any one tutorial to show every single possible case example of how to use
this powerful tool covering every possible use of any map might almost be a class unto itself.
The goal of this presentation is to get you comfortable with the core concepts and give you a strong
idea of how to use and map in your penetration tests once you're comfortable with basic use.
You can experiment with more advanced options to suit your specific needs but briefly I will illustrate
that in map has a very detailed man page.
Which you can read through at your leisure and it can be quite handy if you run into any problems not
covered in this tutorial.
So to begin I'm going to illustrate what a basic scan using any map looks like before I do it is once
again necessary to point out a few key things that I already mentioned in prior modules first as always.
For legal reasons you absolutely must have written permission from the owner of any system or network
that you intend to scan before you scan it.
Otherwise you might be breaking the law.
Second and map is a very noisy tool and using it can often leave lockable fingerprints if you are performing
a penetration test and part of that test is to see if the system administrators are asleep on the job
and you have written permission to conduct the test.
There are ways of using and map more stealthily which will be addressed shortly for our initial foray
into using and map.
We're going to be using this target sites
as you can see.
This site is offered by the developers of any map as a way to test the tool they provide written permission
to conduct and map scans against it legally.
Please note that they ask you to limit the number of scans per date for a reasonable number and this
permission does not extend to using brute force or password cracking applications.
This is a public service that is available available to everyone so please don't abuse it.
All right that was a lot of preamble.
So let's dive right in
in the terminal window.
We're going to type and map and then we're going to provide the domain which in this case is scanned
me Dot and map dot org press enter.
This is going to start the scanning process now at the risk of sounding redundant.
Please keep in mind this is not a passive scan OK.
Here we see which ports are listed for the target.
It appears that 991 are closed but we see at least four that are in open state we can see the port number
in the first column.
It's state in the second and the service typically associated with that port in the third.
Keep in mind that sometimes and map just takes a guess about which service is running on a particular
port a canny system administrator might switch things up and run services normally associated with one
particular port on another port so as to confuse would be hackers.
This is rare of course but I have seen it happen.
It's also possible to hide services that could be brute forcible or otherwise compromised able in this
way by obfuscating them.
Of course this philosophy of security by obscurity is not reliable but it does effectively frustrate
the efforts of the lazy anyway now I'm going to perform an end map scan against a metal spoil machine
that I've set up here in the office.
This machine is on my own network.
I picked out the specific address for it using the Net discover command which I'll demonstrate later
in this module.
So in this case we're going to do and map.
And then I'm going to give it the IP address on the network of the many exploitable machine and press
enter so to start off.
If we're running any map against a target without any of the optional switches it will by default run
what is called a stealth scan.
This word's stealth can actually be pretty misleading and I don't exactly mean it the way you might
think that I do.
Please bear with me and don't make the mistake of thinking that I am in any way suggesting you are anonymous
or shielded if you run and map in this way.
Additional steps must be taken for true anonymity to be achieved and some of those will be covered in
a section of this class that deals entirely with that subject.
There are a few different scan types you can use such as a teepee full Kinect scan the full Kinect is
exactly what it sounds like you will do a full spin since an act three way handshake and fully connect
the target port to verify its status.
That is the most reliable and it is also the most noisy if a part of your authorized pen test is to
test the administrators.
Keep in mind that this sort of activity can be highly visible to them.
In this case the TCE full Kinect scan is not the one you want to use because a lot of admins will log
and even be alerted to all full three way handshake connections.
That being said the T C P is the more reliable for detecting the status of ports the stealth scan on
the other hand is a little bit different.
It sends the sin and then the destination if the port is open will send the snack.
Then we on the source and will send an R S T.
What that will basically do is stop the three way handshake from taking place.
It won't actually fully connect.
The idea is that we don't actually need to do a full connect to verify that the port is in fact open
because it sent a reply in the form of a snack and thus strongly implying that the port is in fact open.
So we effectively have our answer already and there's no need to perform a noisy lockable handshake
but again be very careful with this word stealth just because any map calls it's stealth it doesn't
mean you're anonymous.
I'm sorry to repeat myself it's just very important to understand that without the use of additional
methods for example a virtual private network or some form of proxy your activity will remain visible
to your Internet service provider and the target may still have wire shark an operation to log and analyze
traffic.
So even if you sidestep a log event for a three way handshake you really aren't invisible.
Again please see the section of this class covering methods of anonymity for more information if this
is a topic of concern for you so just by doing that basic quote unquote stealth scan we can see that
this target computer which is my met a spoiled evil machine has a bunch of ports open for you to peruse
because of course it's meant exploitable.
In this case what it did essentially at the beginning was to take the hostname and use DNS to resolve
the hostname if you wanted to skip that you would use a dash an that will disable doing a DNS recursion.
You could also disable the potentially noisy ping against the target by adding a dash p n and that is
capitalized so it would look like this and map dash and dash p.m. And then your target.
Note that when we do it this way the port information we get back is limited to just open or closed.
We won't know specifically if a port is in a potentially filtered state.
The results we get back are therefore more limited now in this case.
We can see that we have a bunch of ports open and a service beside it.
For example Shell and an F S shares so if that is what we're going on the thing we may wish to consider
is what version of I don't know let's say h TTP.
They are using we don't know if it's Apache or something else so we can add another switch to the mix
here.
It's called Dash s capital V so it's going to look like this map dash and dash a little fast capital
V and then the target
when you do a little lowercase s what you're saying is script type when you add another letter to the
end of it it tells and map what type it really is.
So in this case if we do the dash n we are disabling and maps DNS recursion the V stands for version
scan when we do run the scan it will look for what ports are open on the target and hopefully come back
with a detailed version information
so just to make things a little easier to follow along.
I'm going to pull up a little cheat sheet at this point
so when we run and map without any kind of argument just by itself it's what's called a stealth scan.
Remember that word stealth does not mean invisible when we add the switch and we are disabling the DNS
recursion when we add dash p n we're disabling and maps pinging function.
That was the one we just did along and when we add and when we add s capital V we are doing a version
scan
so as we go along I'll add to this little cheat sheet that we're forming here.
Excellent.
All right.
So here we can see if I scroll up a little bit
we can see that we have an F tepee.
But it also tells me the version we can also see that they are running Apache for each TTP.
It looks like there's v NC and look some old school.
Unreal I.R.S..
Wow that takes me back and it looks like the creators of metal split have a sense of nostalgia.
We can also see an operating system scan as well
even though the information is visible.
We can do a specific scan just to determine the nature of the operating system by doing and map dash
and dash capital O.
And then we'll give it our target and this is a little bit less intrusive because we're really looking
at.
Here we go.
OS detection performed
and we've got Linux.
Two points six nine
just keep in mind this is an effective 100 percent of the time sometimes and map will just take its
best guess based on the information that it gets back.
It's usually pretty accurate though.
Now on the subject of where in map is getting this information we do see user share and map and then
we do an Alice we can see here that there are a few different files the OS one is on the right OS D.B.
and it does a variety of things.
Oh we've had this here to bring it up.
One moment
and what this basically does is send a variety of different probes out to the operating system that
we are trying to scan if it responds back with an expected response.
It will verify based on that response to the probe sent.
The target is running a particular operating system again not 100 percent effective 100 percent of the
time but it is basically reliable.
If you do a quick search
for let's say Windows 7
we can see the types of probes that it sends.
If you really know your stuff you can edit this file and save it to change the behavior of these probes.
But such changes are frankly beyond the scope of this tutorial and I don't recommend it unless you have
a strong reason to do so.
The same thing happens when we do the dash lowercase s capital we scan it bases off this and map services
probes to determine what it is actually looking at so it sees port 80 open and sends some probes to
it to determine what is the actual service running on it.
It responds back with Apache to point to point three or whatever else is indicated by the parameter
set in the file there and we can know with some confidence the exact service and version as I said before
this is key when using things like met a spoiler to attempt to penetrate another system because knowing
the exact version of a particular service you can easily look up known vulnerabilities and you can tailor
your attack against the service in a very strong and well established way.
Half the battle is knowing your foe and its weaknesses and with just a little bit of information and
maybe a simple Web search you can create all sorts of operational vectors against a target machine.
So going back to our cheat sheet here for a minute we'll add the new switch to the mix that's dash capital
O and it's going to be short for operating system detection.
Another thing that can be done through any map is the running of what's called scripts.
Scripts are allowed here using what is called the dot in a sea format which is what a map uses.
There are some scripts called default scripts for example and mapped ash and ash and see which runs
are defaults.
And while this is a running
we'll take a look at the section of the website dedicated to and map scripts.
Now if we look at the script interface we can see that there are a variety of different categories
everything from brute forcing to selective scanning.
You can read through all of them and see what they do as you click on each one you can see a description
of what they are and what they do.
So let's just
open up a new tab window here.
And here's an example script I just picked it at random called file off owners.
It gives an example of case usage and the script output
in this case we could just run the scripts by themselves.
Just keep in mind you can run them individually if you like.
Just look at all the scripts they have so when I did the lowercase s capital C it started and map running
all of the scripts which were installed and I'm going to go through what each individual script does
because as you can see at the time of this recording there are five hundred and ninety one of them but
if you are interested please do read through all of this information and have a look at the finer details
of each one.
So a moment ago I ran and map with the lower case s capital C switch.
What that did was it ran all of the default scripts which we have installed.
If we screw up
quite a ways in this case we ran a script called F T.P. anon which shows us that anonymous f teepee
log in is allowed if we scroll down a little further we can see that open SS H is allowed and shows
an SS H Host key again.
What you're seeing is the result of one of these specific scripts testing for this specific vulnerability.
There are some each TGP ones that they around she gives methods.
Did a banner grab as well.
Pretty good so you can see that there are all these different scripts that it runs and there are various
pros and cons to each one when trying to walk that fine line between getting the best possible information
and trying to remain stealthy.
See it looks like my sequel was running I saw that appear
and version that's good.
All right.
So lowercase s capital C will run everything in the defaults.
I'm going to do one more here before I pull pull up our little cheat sheet again.
This one is in map.
Dash and dash capital a and then the target and we'll let that run what we've just done is what is called
an aggressive scan which is just about as noisy and blatant as you can possibly get.
It'll take a moment to finish so I'm going to pull up our cheat sheet again
and let's go ahead and add Dash.
S. capital C running the default scripts all of them now.
Every time you update any map you're going to see that people have added more scripts to it.
If we glance back at the scripts web page we can see the current number of scripts at the time of this
recording.
Five hundred and ninety one.
Now there are some people who like to use and get hub as a method of distributing their scripts for
any map.
But be aware that that is somebody else's code and it won't be vetted by N map itself.
If you pull it off GitHub it may perform malware or perform in some kind of a loud way that is undocumented.
Still it's worth mentioning as you can find some real gems if you look just be sure to do your due diligence
and check into them carefully before downloading.
I'll just go ahead and add dash a to our cheat sheet.
This is called an aggressive scam
and this will definitely be picked up by any halfway competent system administrator.
The reason why is that it literally throws the kitchen sink at the target.
It runs a variety of scans such as include these here
the version scan
the operating system scan
all scripts
and even performs a trace route to the target by running that one command.
You're running many that you might wish to run.
So it's a bit of a shorthand method or a lazy method if you prefer.
Now it does take a while to do it.
And like I said it will be detected.
So let's pull up our results here as we look at it here we can see that it ran all the scripts again
and it did the regular version detection as well.
Basically the same thing as we did before but it added a trace route which obviously didn't have very
far to go in operating system detection and so forth a pretty handy tool to use.
I don't recommend doing aggressive scans out in the wild.
Still I had to include it for the sake of completion.
You can also do a pure ping scan which is s capital P.
So let's add that real quick to our little sheet.
The idea of a pin scan is that when you first start doing your scan based off what you have from your
reconnaissance phase you may want to go ahead and do scans of either subnets or IP addresses but you
first want to see in a subnet if anything is up and running.
So very quickly here is what that would look like
quick and painless and an easy way to see if a particular host is up.
But again it's useful if you're scanning a lot of different targets all at once because it brings back
information quickly and it's less likely to be picked up so moving on.
Now I'm going to momentarily set aside and map to talk about another tool that is useful in conjunction
with it.
And that is net discover.
So if we do net discover dash AI and then we put in our interface which in my case is at zero and we
do dash ah and then we give it a subnet IP range.
So in this case
everything between 10 0 0 0 and 10 0 0 0 24 will be scanned.
I think I added in another zero there.
Pardon me.
So when we PRESENTER We can see all of the other devices connected to our network it does not pick up
the address of the scanning machine.
Now if you were testing it this at home or you are in a situation where you don't know the exact address
to scan this is how you would start.
I can identify my metal supportable machine at 10 1 0 0 0 to 8 and if I wasn't already sure I could
disconnect it scan again and then verify by running net discover.
So if the machine didn't show up in a second scan I would know that that was not the correct IP.
Assuming of course that I didn't already recognize the host name and the Mac address
and when you're done just press the controls Saeki to get back to the prompt.
Now when you're looking for a particular port to scan you can proceed in a variety of different ways.
For example if we do in map dash n dash P for port and I'm going to give it port 80.
Because that's a pretty common one and then we'll give it the target
on the Met hospitable machine now and map will just do a regular scan of port 80 which of course reveals
what we already knew from the previous scan it's open but you can also scan a port range for example
and map and then do one two let's say two hundred
and what this does is it will scan all the ports between one and two hundred so this can get back quicker
results.
If you already have an idea of what services you're looking for and you know what particular ports they
would be running on and sometimes because it's quicker and it's a little less intrusive it may slip
under the radar to do it this way
and just for the sake of completion I will add that you can also scan all ports by doing dash P dash
you could even manually input the maximum number and scan all sixty five thousand five hundred and thirty
four if you really wanted to just keep in mind that if you have a range of targets rather than a single
target that you're trying to scan your scan time is going to run quite long.
If you do something like that.
So again limiting the number of ports that you're scanning to the specific services that you're planning
to exploit.
For example if you were using Metis ploy and you've had a few particular attacks in mind and your scanning
a whole bunch of different systems on a network that this can be a lot more efficient.
You know one thing that you don't notice in a video like this although you're seeing it now just against
this one target.
It takes a considerable amount of time if you're scanning absolutely everything but when you're scanning
absolutely everything on a lot of systems you know I make edits to the video to make it more watchable
but you're going to have to sit through it and believe me when I say that if you've got a lot of systems
it can take actual hours to conduct these scans when you're doing absolutely everything.
So just keep that in mind.
Now if for some mysterious reason you wanted to scan ports non sequentially and you might do this if
you're concerned that the admin is looking at their their wire shark panel or something and you want
to make it look less like a a scan and more like something random is going on what you can do is and
mapped dash n dash P 80 and we'll say karma I don't know 443
so weird as that sounds it's going to scan port 80 and then port 43 except that I I'm sorry I did I
did the wrong thing there I meant to do P not o I apologize
and there we go.
No the example I'm about to point out next May seem a little bit silly and you might be scratching your
head why you'd want to do it but bear with me because this this will actually lead somewhere.
You can also specify if you want to scan for TCE or UDP so by way of another example and map dash and
dash P T for TCE
colon twenty five eighty so it's going to scan ports twenty five and eighty but then we're gonna do
another comma and we're gonna do a u for UDP colon and I'll just give it random ports 137 get it the
target press enter
in this case we'd be scanning both t C.P. ports 25 and 80 and UDP ports 161 and 137 against the specific
target IP.
Now this might be useful if you want to quickly check for a specific exploit and you know which ports
to expect when scanning in the range but in this particular example and this is what I'm kind of leading
up to.
We have to make this a little more complicated.
Let's look at any map
s s p h t 25 I want it to cooperate and demonstrate what I want you to see.
It's not always easy even when you pre-recorded
OK as you can see right here it has given us a few different ports that we specifically looked up.
So that's another way of doing it.
But one important thing to note here is that if we scroll up to our previous scan
which is a ways up here
notice that the previous scan says all T.
We scroll back down can see that there is actually a UDP port open 137 so why did that not get picked
up in the normal scan.
I hear you ask that is because any map does not do UDP scans by default this may stump newer users who
think based on how it is written that the aggressive scan I mentioned earlier would of course do a UDP
scan.
I mean why wouldn't it.
This is just one of those little quirks about any map to do a UDP scan.
We need to specify that we want to do one.
So coming back to our cheat sheet here
we add s you first scan for low repeat scan now make me kind of slow if you did it by itself without
any other switches but it is viable to do that.
So this is something that's worth remembering.
In this case we can see that it did in fact find UDP ports that were open but you have to add the switch
for it otherwise it simply won't pick it up and you might miss out on a very good open port.
You can also do n map scans based off the name of a service.
In this case we can say for example and map each TTP which is the service we're going to be looking
at.
Give it the target information
and run it that way.
Some of the other scans that we can run
or a little lowercase s capital T
and that specifies that you want to do the full Kinect scan.
We didn't do any version scan with that so coming back over to our cheat sheet
now as I mentioned before this option does do the three way handshake when it connects to ports so it
will most probably be logged
probably.
And then if we do lowercase s capital S we specify these stealth scan also known as the half open scan
because we only find out if ports are open or closed and not in a filtered state.
But remember that word stealth does not mean invisible.
I know I keep harping on that but I really don't like that word because it misleads a lot of people.
And while I'm on the subject another scan that we can do although it does not.
OK another scan that we can do with most versions of any map is called an X Smith scan.
However this version will only work with Linux versions of any map and I believe Mac OS.
It will not work with Windows.
So for that we would do lowercase s capital X and that sends scan with push and Fin flags set.
It does not work with Windows and really there are only a few select cases where you'd want to do that
anyway.
But it's just worth remembering that when you're using and map with windows it just doesn't work.
And again the idea of doing doing that is to try to bypass logging and last but not least
we'll throw in and map dash lowercase s capital a and this one will work with Windows
and the scan will come back with whether or not the port is filtered.
Oh I forgot to add the port.
I'm sorry low mistakes.
There we go okay.
Right here it tells me that it is unfiltered
and determines the state of the port.
And that is essentially it so those are all of the basic examples of using any map.
There are many other switches that you can use as well.
But those are some of the most common that you would use.
It just depends on how sneaky you're trying to be during your licensed and authorized penetration test.
It is even possible to setup your end map scan to use.
Timing and timing is a bit interesting.
It goes from zero to five with five being the fastest and zero being the slowest.
You might wonder why anyone would wish to slow down these scans.
But the idea is to avoid the all seeing eye of the system administrator.
So in this case going to pull up the cheat sheet one more time
and we're going to add our timing switch so dash T.
And then it would be 0 to 5
so again the idea is if you're doing it at full speed and by the way if you want to do it at full speed
you don't really need to specify five.
This is just the maximum that any map will run by default.
But if you're doing it at full speed you have the highest chance of being picked up and you'll see why
this is when we get into the wire shark section that the module pertaining to while wire shark and I
don't want to pull that up now because I think that that would be confusing for newer users and I don't
want to muddy this module by bringing up another module.
But when you're seeing things from a system administrator point of view you can see that packets are
coming in at regular intervals being mixed with other packets.
So by adjusting the timing what you're trying to do is you're trying to make your scan kind of slip
through the cracks so to speak.
In other words you're hoping that your scans will get lost amidst other noise and the bigger the delay
between the scans the less likely you are to be seen.
At least that's the idea so I'll give an example of how this works gonna do end map.
Dash T for.
Because I don't want to be here all night.
10 0 0 8.
And we will press enter and essentially all of this is doing is running a generic and map scan with
no switches set which means it's technically a stealth scan but we've slowed the timing down and you
can see it still came through rather quickly.
But if we did it at 3 2 or or 1 it would be very very slow and that means really really slow when you're
talking about a lot of different computers on a network.
The more targets there are the more brutal it can get its what it's doing it's sending a probe it's
waiting it's sending another probe it's waiting and it's usually going to be a predetermined amount
of time between each probe.
Fifteen seconds fifteen minutes whatever it happens to be.
So if you decide to go with T1 and you're scanning a large net block I recommend going out for a bite
to eat maybe see a movie cause you're gonna be at it for a while now I'd also like to demonstrate the
verbose option and it goes well with timing because it lets you see what the timing actually is.
So if we add a dash V A Dash V V or even a dash v v v we are specifying that we want the output to be
either verbose very verbose or very very verbose and I know that's a mouthful.
I'm also going to add the the dash d d option which is short for debug mode so it'll give us even more
information.
I'm going to cover both of these at once so we do and map and I'm going to do it at full speed but I'll
still include timing and we're going to be very verbose remember 1 v is verbose 2 is very verbose 3
is very very verbose and then D.D. for debug and give it our target
you'll see here that it gives you a timing report when you add those switches in their
it is extremely slow particularly if you select a number lower than 5 for your timing switch in the
case of a T C P port it's going to wait a thousand seconds at a setting of T T1 before it sends another
probe just to give you some idea when you do something like this against the larger network just remember
it it can't it can't take a long time and this is something to consider when conducting a penetration
test for a particularly demanding employer if you're on a schedule or a timetable and you have a limited
number of tests that you can run in a given day.
This may not be viable to try to use timing to circumvent detection anyway.
Let's let's talk about outputs we can take the information that any map gives us and put it into reports.
For that we just use a dash and a lower case O.
For example
in map dash 0 and then a and a stands for all of them then I'll give the reports a name which I'm going
to just call you Demi scan for the target
and what this will do is go ahead and pull up the scan in different formats.
You won't see this happen because it's being written in the background as the scan is taking place.
These reports come in three different flavors grapple as well as the normal end map report and finally
an excel file.
You may recall I mentioned it is possible to import an X AML and map scan into Sparta during the module
covering that program.
And this is how you would create one.
So going back real quick talk cheat sheet we do dash 0 to create these reports and then a after the
0 would be for all G would be for grep ABL if you only wanted that in for normal and X for example.
So going back
we can see that there are three new files that have been created you Demi scanned and map you Demi scanned
GM map that's the grapple and you dummy scan x and.
That would be if you wanted to imported into Sparta or some other program that would use the excel file
pretty straightforward.
Now we'll dig a little deeper into scripting the scripting language used for any map is called Lua that's
l you a if you know how to script in Lua.
There are some syntax that you can look up on the script or reference on the end map Web site and that'll
teach you how to make various different types of scripts.
That being said if you'd like to see what types of scripts are currently out there from within your
terminal window you can type and map dash dash scripts dash help and then in quotations we're going
to put the type of script that we're looking for in this case for example purposes.
I'm going to do f T.P. dash and then the asterisk is kind of a wild card so I'll explain that in a minute
and then close quotes and press enter and all this is doing is asking and map to find you all the scripts
that begin with F. T.P. dash and the asterisk indicates you want them all.
If you just want any script with FTB in it you would say F T.P. without the dash and the asterisk.
We know from our prior scan that our target has a port that allows anonymous Loggins.
So if we scroll up
and see a script called F T.P. anon we can also check to see if they are vulnerable to bounce attacks
and we could also check to see if we can see a specific backdoor and you can do this with basically
any of these s empty S M T H GDP and you can just type in whatever you're looking for an N map will
pull it up for you.
So knowing this let's go ahead and do a script
will actually run to and to do that.
We need to separate each by a comma.
So we'll do.
And pardon me and map dash dash.
Script equals.
And then I'm going to paste in the one you just saw me copy
and that ran it by default because of the way my Cally is configured.
Again my apologies you shouldn't do that but we'll separate that by a comma and we will include f T.P.
anon as our second script.
So now when I press enter it will run both of them back to back.
And of course it helps if you give it a target.
So I will do that now I'll run it and now it will check for both of those.
It looks like FCP a non failed perhaps the target is not vulnerable but
we can see that f T.P. V.S. f TPD backdoor has revealed the target is in fact vulnerable to this exploit
and that's basically how you would use a script.
So just for clarity Another example might be and map dash dash script help equals s empty P L throw
in the asterisk because we want all of them and press center
and there we go.
It is a powerful engine to be able to expand and maps overall functionality to add any scripts.
It also allows and map to go from passive or even not so passive reconnaissance tool to an active exploitation
framework which can be pretty handy.
There are a great many other techniques for efficiency and stealth that you can find by carefully examining
all the end maps switches instead of the start of this tutorial that it would not be realistic to go
through every possible case example but you might try breaking up your search packets with something
like the dash f switch or even randomize wing hosts so that ports are not scanned in succession in the
end.
Abuse of any map is both a science and an art.
The science can be taught but the art must be developed through use.
Before we wrap up this module I'd like to make mentioned the fact that in map can be used in conjunction
with met a split and there are many valid ways to showcase it with wire shark.
I thought long and hard about including those techniques in this video but I came to the conclusion
that it would be too advanced for inexperienced students at this point in time both wire shark and met
a spoil it will be covered in sections further down the line and I shall try to include some illustrations
of these techniques when we get to them.
Hopefully after watching this video you have a good idea of how to use and map.
I encourage you to use it against your own met a spoiled bowl virtual machine or computers on your network
that you personally own.
Just again remember never to employ it against any system or net block that you don't have personal
written permission to scan and have fun with it.
And remember that while this may seem like one of the most daunting tools just because of the sheer
options that it offers.
It really is easy to learn with practice.
So have fun with it.
Thank you.