Welcome to part six of this module
now let's go ahead and take a look at Zen map Zen map is the official in map security scanner graphic
user interface it's multi-platform just like in map which means that you can use it on Linux Mac OS
and even Windows it's a free and open source application and its goal is to make and map a little easier
for beginners.
It also provides a few advanced features for and map users frequently use scans can be saved as profiles
which make them easier to run repeatedly and a command creator allows interactive creation of and map
command lines within the tool itself.
Scan results can be saved and viewed later and scan results can also be compared with one another to
see how they differ.
All the results of recent scans are stored in a searchable database so all in all it's a pretty convenient
tool
Zen map comes prepackaged with Kelly Linux 2.0 or it can be downloaded from the end map.
Dot org web page.
So before I begin I have to give.
I'm afraid the same tiresome admonition that I've given in previous modules and map is by its nature
an aggressive scanner unless you take special steps to make the scans passive which means that I have
to remind you to only scan networks that you personally own or have written permission from the owner
to scan.
Otherwise you could be doing something illegal in this tutorial.
One of my targets will be scan me Dot and map dot org and as you can see on the web page written permission
has been given to conduct these scans.
They also ask that you don't use brute forcing or cracking tools on this site or conduct excessive scans
and provided you follow these guidelines.
You may also use this site as a test of your end map or zone map utilities for as long as this permission
lasts.
But please always check and make sure that the permission is still being extended.
All right so with that necessary admonition out of the way I'm going to call ups and map.
I'm going to minimize this to loads and map.
It's just like any map we're going to go to.
Applications
information gathering and we will and we will click the Zen map.
You can also load this from the terminal window by typing Zen map now before we begin.
I do have to say that when I create these modules I do my best to make each one a standalone video so
that you can learn everything there is to know about an application simply by viewing the module that
pertains to it.
However in this case Zen map is literally just an map.
So in the previous module which deals with any map I go over all of the specific particulars of how
each different command and option within and map works.
And it would be extremely redundant to go over all of that ground again when speaking about zen map.
So for that reason if you haven't watched the map tutorial I strongly encourage you to do so before
proceeding with this introduction to Zen map.
However it's not absolutely necessary.
You can get the gist of how this program works just based on what I'm going to show you but even so
for the finer points you will want to see the prior module.
So with that in mind we're going to take a look at this and as you can see this is very similar to other
applications you may have seen already such as Sparta.
We have our command line here which is exactly like the terminal window command for and map in this
case.
If you watch the prior module you will know that if we ran this in the terminal window it would have
a timing set to 4 which is the second fastest the dash a or tack a means that it will conduct an aggressive
scan which z map calls it intense scan but it is the same thing and TAC V would stand for verbose now
our target to start out with is going to be scan me Dot and map dot org and as far as our profile we
have many options for the drag down menu.
The intense scan is the default option selected when you first loads and map we could do an intense
scan and include UDP ports.
If we select this notice that the command line has actually changed to include this option
if we wish to do a quick scan instead
we're presented with TAC F instead and those prior options are removed.
Now bear in mind that if you know what you're doing and if you watch the previous module hopefully you
do.
You can manually change these commands in the command line to anything you want which you will see me
do before this tutorial is over
in fact I think I'm going to do that right now going to change T4 to t five the fastest scan.
It's also the loudest but I'm scanning myself so it really doesn't matter and I am going to make my
first target.
The Met exploited all virtual machine I have running.
And the reason for this is I would like to show off the topology and I've noticed that with multiple
different scans sometimes the topology does not update correctly.
So with that in mind let's select intense scan and we will scan all TCB ports.
So this is an aggressive scanner.
Change the timing again.
OK change that back to five five is the fastest and sure this is good.
They really need the ping in there but we'll go ahead with it and we will click scan
and as you can see there is a small little bar over here that indicates the scan is taking place.
This is an aggressive scan.
So it's going to check for absolutely everything.
We didn't expressly select any scripts but we could do that in the command line if we chose.
Or we could go with whatever defaults come with the preloaded profiles for us and map
information is being gathered.
I'm going to make a small cut to the video at this point and resume recording after this is complete
as it will probably take several minutes.
And here we can see that the scan is complete.
The bar has stopped flashing so scroll down and take a look
as you can see by the readout it'll give you a step by step report along the way.
In this case it's telling us that the Syn stealth scan was about forty six point seven two percent done
at that point in time and it gave an estimated time to completion of five minutes and forty seven seconds
several NSC scripts were initiated whatever was default for that part of the profile
and now if we come all the way down
we can see the full readout
and we can see in multiple places that it is a Metis Floyd ABL machine using a Linux kernel OS detection
puts it at Linux.
Two point six nine two point six point nine excuse me.
It takes guesses about its uptime its network distance which of course in this case is only one hop
and so forth.
And if we come over here to ports and hosts we can see everything that is currently open on the target.
Now since this was just a generic aggressive scan with really very little specifications we're not going
to see UDP ports.
We would have had to have specified that in the scan line or in the command line.
Excuse me.
So what we're going to see here is open and closed ports but that is the limit only opening closed for
TCE.
It's coming over to the topology tab.
It's quite small because obviously this is a virtual machine that we're scanning.
However if you were scanning a remote network from a distance you would essentially see a network map
of ever growing circles.
And each hop would be demonstrated along the map
and this is not something I can demonstrate when we go up against scan me dawg because unfortunately
this that would reveal my office IP address which wouldn't be prudent.
But when you try this yourself you will see the map in all its glory it tends to be quite large and
will demonstrate all of the hops between you and your target and here we can see host details
things like number of ports open the operating system the accuracy of the Guess which in this case is
100 percent ports used did it did detect a closed UDP port.
That's interesting
most cases
and so forth and you have the opportunity to add comments to this profile over here.
Remember that as you're using z map you can generate a lot of different targets.
So keeping keeping careful comments is a wise policy
and this is just the services tab.
And if we click on this and then let's say each TTP it will narrow down the results to open each TTP
ports on our target.
So it's just another way of looking at the data.
So now we're going to go ahead and do scan me dawg.
And the reason that I want to show both of these is I want to illustrate how easy it is to toggle between
multiple target data using z map so paste and we're going to make this a quick scan actually we'll go
ahead and make it a an intense scan but we're not going to do UDP that would be a very very long process
and we're going to switch this to five
everything else is in order.
So I'm going to click scan.
And once again I'm going to make it past the video at this point and resume when the scan is complete.
All right.
And we're back now I can't show you all of this data because if I were to scroll down my office I.P.
address is displayed and that's the same reason I can't click on the topology button.
However if I come over to ports and hosts we can see what is listed as available on scan meta and map
dawg.
And as you can see we can easily switch between scans now if you're scanning a very large network with
a great many different targets.
This is a very efficient way of keeping all of your scan results organized and quickly moving from one
to another.
So in this respect Zen map is a little bit better than the terminal version and map because of course
with the terminal version you can save files such as an Excel file or grep BL file but she can really
only deal with one at a time unless you want to have a lot of different scan results on your terminal
screen and scroll up and down her have multiple different terminal windows open some people like to
do that.
I I know that there is a certain class of pen Tester who feels that you know if you're a pro you only
use the terminal and you know goodies are for beginners.
You know that kind of an attitude but as you can see this is actually very useful.
So it's literally just an map if you watched the map module hopefully you know all the commands and
you know the differences between say intent scan or a UDP scan or a ping scan and you also know and
it bears mentioning again that even one map says something is passive or stealth.
You still need to take additional steps to really and truly be anonymous and again if that is a concern
for you please see the modules dealing with anonymity particularly the ones dealing with virtual private
networks and proxies.
So with that being said this has been and map I'm not really sure what else to add.
You can of course save your scans just like with the command line version and you can quickly load them
up again just with open scan you can also open scan in this window.
So if you wanted to I don't know mix here you know have it all on screen at one time you could do that
it's possible to compare results of your various scans filter hosts so we'll analyze and map is a handy
little tool and I think one of the best things about it is that it's a good way of presenting information
about a particular target relating to a pen test or targets to an employer or to anyone who is not shall
we say initiated in the ways of the command line because of course when you're looking at this information
the command line when you know what you're looking at it's very straightforward but it can be very either
intimidating or confusing for people who are more used to this sort of a presentation.
And and it's good if you're giving a presentation to a large organization going over the security vulnerabilities
that you've discovered because it's something that they can look at and see and immediately understand
so that's pretty much all I have to say about Z map.
As I said it's a pretty straightforward tool and I hope you know enough between this module and the
prior module on and map to be able to use it effectively and have fun with it.
It is definitely a much beloved tool both in map and Zend map.
Have a great deal of support in the online community.
You can find additional scripts on GitHub that can be utilized by both end map and z map.
Although as I mentioned in the previous module you will need to do your due diligence and only download
from trusted sources and ensure that what you're downloading is actually what you want.
And of course you can get more scripts off these and map and map Web site simply by updating.
So there is that and that's pretty much all I had to cover.
This is a great utility and I hope it will be of great use to you.
Thank you.