Now, active reconnaissance tool, so now we're actually going to be connecting and actually, you know,
conducting hands on analysis of what whoever our targets are.
So the first active reconnaissance tool that I'm going to go over is probably the most important one.
And that is the name of the tool and it is a port scanner.
And if you're penetration tester, ethical hacker, you're going to use and you have no way around it,
OK?
It's a very poor scanner that can be used to scan entire networks so that you can see what ports are
open by looking at the ports that are open and can actually determine, you know, what operating system
that device is, what services are running on, the devices.
You'll be able to see, you know, what ports are like closed or filtered and actually find the open
ones, like I said before, and discover like vulnerabilities with them.
And also has like a built-In vulnerability scanner to which a lot of people probably don't even know
about you.
So let's play with a different a few different map commands.
So I'm back on my colonics machine.
And for this one, we're actually going to need some of our targets to be up.
So I have my meds, portable virtual machine up and running right here.
The IP address on this one, all of them.
The network address, if you remember from the network news section that you should have watched the
network addresses one nine two one six eight nine five six.
That's the network address for our little host only network that we have and the specific address for
the metastable machine and the one before and for our Windows 10 machine and in twenty one.
So what we can do is see, let's do a map and let's check one nine two one six eight.
Five, six.
Dotts, let's check out the Métis political machine and actually you don't want to go for.
So when it comes to a map, there's a lot of different flags that you can do, so there's a couple of
different kinds of scans that you can do.
So what you typically want to do is the skin scan.
And it pretty much like it initiates the the TCBY, you know, a three way handshake, but it doesn't
finish it.
So this is the best way to scan undetected in the way that you're going to do that is with a dash lowercase
s and then capital.
So this is going to do perform a second scan.
If you want it to do a full TCP scan, then you would put this, you would just put a T right here.
But for right now we're going to do just assess.
OK, after this, you might want to determine, you know, what point do you want to do, you determinists
with Dash and you don't have to put a space right here, but you can.
So if you wanted to do every single port, so you would do for one through six, five, five, three,
five.
Remember, if you watch the network section, you would know that.
But for right now, we'll just do actually I would do a six five five, three, four.
I would do all the points right now.
So right now we have a set up to where we're going to do a map on our.
But the machine is going to do a second scan, which means it's not going to complete the handshake.
So it's pretty much undetectable for the most part.
We're going to do a dash p specified that water scan every port from one to sixty five, five to five.
So it's going to scan all those ports and it's going to, you know, tell us at the open.
And I saw one neat thing that we can do is if we only want to see results because most missed out on
a lot of results.
If we only want to see results for open ports, we do dash dash open.
And this is just going to show us any ports that Matt finds, you know, that's actually open.
This will conduct a basic scan so we can go ahead and actually run this one and see what the results
look like.
OK, and obviously I need pseudo, right.
So just remember, if you want to do like a pseudo dash, I so you don't have to do this, but you're
going to be Suda.
And then we're going to let it go and give it a couple of minutes and we're going to come back with
some results, look at what our map scanned.
It actually took about like three seconds.
So it scanned all of those ports that fast on that machine and figured out which ones were actually
open and had told us.
So, for example, you know, there's FTP is open on that one.
S.H. is open.
Telnet is open as really bad.
So we can connect over telnet on this machine.
Remember, this is metastable, so it's supposed to be, you know, exploitable.
So you can see all the different services that are actually running over these open ports.
And these are definitely all things that you want to take note of because you could probably exploit
each single one of these if you actually looked into them.
And we're going to be looking at some of those when we actually start attacking.
But right now, in the information gathering stage for our next scan, let's say that we want to figure
out, you know, the like the version of the services that are running on each one of those open ports
that we saw.
So what we can do is actually a version scan audit over here was changed the access to Capital V and
then now that's actually going to go look at these open ports and tell us actually what the services
and their version is going to try to release.
So let's go ahead and run that scan.
And also just a quick note.
If you want to enable verbose mode, which means just showing, like, you know, more output while
running stuff.
So it's kind of entertaining, honestly, to see what's happening.
While I was having you guys do a dash of four, very verbose.
And it's going to show you, Alpe, you know, while the skin is actually, you know, conducting.
So you see it's actually something, hey, discover this portal, but discover that port.
So it's going to tell us stuff, what's actually happening.
So let's give them time and then we're going to look at the results from this very scan.
OK, so our service get a service version scan actually completed and look at all this information that
we figure it out.
So remember, we did a very verbose.
So he showed us, you know, the open ports when it found it.
But look at this now.
We have a column that says Virgin, and it's telling us, hey, you know, overreport twenty one, it's
running FTP D two point three point four.
Now we can use that information and we're going to talk about it later on, like how to find a place
for these things.
So I can guarantee that any of these are exploitable.
And it's going to be pretty funny actually when we actually get to attack.
And so this is the type of stuff that you want to document.
And one other thing that you could do also just for any of these commands, if you do want to, I'll
put it into a file.
You would just do oh, and then filename like, you know, notes, text, and it'll put it into that,
into it'll create that file and those that's in the current directory.
Or you can specify, you know, where you want to go, like, you know, like slash, I don't know,
slash roots slash something.
I don't know, it doesn't matter.
So it'll put that, it'll create that file and put all the output into that file and then you'll be
good to go.
You give our office at any time, maybe during your penetrations, as you know, you're coming back
to see you checking through like one thing at a time, going to see if it is vulnerable.
And I then come back for the next thing you want to document everything very, very powerful.
Another command that I like to run, that's actually a very, very useful command.
Now you can add.
So when these switches you can add the these are called switches.
You can add these like you can do different types at the same time.
But when I what I've noticed is that when I do this kind of overwhelmed with the information.
So I like to just, you know, have one switch at a time and have them in separate scenes.
So there's a I like to call it the all option.
They all switch as well to call it, because it does know the version and it looks for versions of services.
It'll do a port scan for you.
It will also, you know, do operating system discovery and also, like, break down more about each
service that is discovered, you know, on these reports.
So let's go ahead and run this and see what kind of results that we get.
So the scan is finished.
And look at this wealth of information just from this one scan.
So let's break it down a little bit.
So as you can see, it discovered open because it had a regular and map scan, also went through and
scanned and services set up there.
And now it found, OK, Port twenty one is open.
It's running this as we saw before, but it's a little bit more of a breakdown.
Like I said, hey, anonymous FTP login is allowed, so it actually went untested.
So now we know that's a potential entry point for us so that, you know, maybe something to take note
of.
And then also like right here, Port twenty two is open, is running S.H. It gives us the open version
that is running.
It just gives us a lot more detail and breakdown of what's actually found, you know, running on these
ports.
I really recommend that you use the Dash eight switch and.
Be a little bit overwhelming at first, but it's actually really good information is actually informative,
not too bad.
You get used to looking at, you know, all these different textures, though.
And what I what I also wanted to show was that it actually did a operating system scan.
So, you know, oh, is running Linux to point the two point six kernel and just gives you information
about that.
So it's pretty positive.
Sometimes it'll give you a yes of the operating system with this one and knew exactly just based on
the fingerprints that it was able to get from the scan.
So there's a lot of stuff that we can get, you know, with and maps.
I really recommend that you go in and actually, you know, play around with and map because this is
going to be your bread and butter when it comes to, you know, penetration testing.
OK, so another type of skin is very useful that you're going to want to do is a UDP skin, and that
is dignified.
But remember where we had to dash in the capital espersen skin.
So we want to do a dash cap ex capital.
You here to signify, you know, hey, go do a YouTube scan because remember from the networking section,
this ports, the sixty five thousand five is that if I put on TCP but also on UDP and the service is
running on Euterpe as well.
So you definitely want to check, you know, into, you know, specific systems like, you know, if
they have services running over UDP.
I've definitely seen on Assessment's where there's not really many services running on TCP, but when
I do a scan, I find services that I could potentially exploit.
So I'm just doing ports one to 100 just to show and see if we can actually get anything from it.
So let's go, everybody command.
OK, so to finish those actually look at it, so it went through and actually told us, hey, this was
close, close, close, it says open filtered most likely is probably a close port that's just filtered,
which is not going to get your response that you want.
I believe that it actually found like UDP, P3 is open.
So, you know, DNS is running over that port with also new version scans on these ports as well.
So if we can do it on that specific point, just see, you know, just just for the heck of it, just
see, you know, what's on it.
So let's do that really quick.
So, you know, how are we we've been doing range is typically what we can actually just specify a specific
port.
So right here we'd be scanning DNS over UDP and try to see.
See.
We want to figure out a version so we do dash ASV and figure out maybe we can figure out what version
of what's bringing over that port.
So see, right here, it was saying, hey, it's running DNS and you know who's running this right here.
So this version right here pretty useful.
So I definitely recommend play, go around, play with it, make sure that you do your UDP scans.
OK, something interesting and map, like I said, it comes with a vulnerability scanner.
So what you can actually do is you can use it comes with scripts as well that can do different things.
I'm not going to go over all the scripts, but for example, if we wanted to pull this back up so that
we have our target right here, what we can do is actually run an EMAP script to figure out, you know,
if there is any SMB or something like that available on this system so we can do a map and then we have
our target and then we can actually do a dash to script and then say equals and some B dash os dash
discovery is going to go actually run this script that's built into and map and actually let us know,
you know, if it's what it finds.
So let's go ahead and run this.
So it's done.
So it did a quick AMP scan of like, you know, just some default points that I would look for.
We don't like specify specific ports, but right here is the, you know, the script results that we
wanted.
So it pretty much used SMB to try to figure out, you know, what the OS was.
So, you know, it's saying, hey, the OS is Unix or Linux and Somma 3.0 is actually being run.
So that's something that's very useful and it's something that we kind of figured out before from different
scans.
But the point is, is different ways to find out, you know, the different information and that has
a bunch of different scripts that we can actually use it.
There's a DNS transfer, a script that you can use, actually a script that you can call waspish, that
you can call.
So you do a map, dash, dash script, dash help and then you can put the script names.
So like, let's say DNS transfer.
How do I use this script?
And it'll actually spit out some help for you.
So here's the deal, as well as a description of what it does and just some help on how to use it and
such.
So definitely look into the different scripts that Matt provides us with because it's very useful.
And you can actually look for vulnerabilities because there's some scripts that actually will look for
like SMB vulnerabilities, for example.
Also, if you're wondering, you can take a look.
I guess you do a quick ls the directory with ADMET Scripts and see what scripts are available so that
you could run them with that.
Dastan script equals command along with EMAP so you could do a lot of us are slideshare such and map
scripts and it's going to give you a list of all the scripts.
So all kinds of stuff you man so you can find out all kinds of stuff.
So it's pretty good.
They have the Mongo DB scripts, the actual scripts that we're Métis, Bloy, a lot different.
The firewall bypassing Firewalker.
That's the thing I like to use when I'm, you know, conducting penetration tests a lot.
I like to figure out, you know, what rules might be in place, you know, for a firewall so you can
play your attack a little bit better.