1
00:00:00,150 --> 00:00:05,430
Another tool for active reconnaissance called Though Nyko, the very useful application, getting to

2
00:00:05,550 --> 00:00:09,690
actually find vulnerabilities and weaknesses that exist on, you know, Web servers, even though some

3
00:00:09,690 --> 00:00:15,540
Web application scanner, you can actually use it against servers and you might find some, you know,

4
00:00:15,540 --> 00:00:20,520
vulnerabilities that you could potentially exploit, you know, on these servers.

5
00:00:20,780 --> 00:00:26,100
Right now, we're going to hold off until we get to the Web application contesting sections, actually

6
00:00:26,250 --> 00:00:29,930
look at McDo and see what it can actually find because it'll be more useful there.

7
00:00:30,930 --> 00:00:35,280
Another tool that kind of combines multiple tools into one is called Spartan.

8
00:00:35,310 --> 00:00:40,590
It just puts everything together like one interface so that you can see everything is automated and

9
00:00:40,590 --> 00:00:45,370
makes the information gathering portion of your reconnaissance pretty, pretty easy.

10
00:00:45,390 --> 00:00:51,360
Some of the tools that it actually includes in it is and map McDo, like we just went over Hydra, which

11
00:00:51,360 --> 00:00:55,090
is like a brute forcing tool and also a HGP screenshot tool.

12
00:00:55,090 --> 00:01:00,840
So actually go through and screenshot what it sees, like if you want to access a certain address over

13
00:01:00,840 --> 00:01:02,660
a certain point in a browser.

14
00:01:02,670 --> 00:01:03,570
So it's pretty useful.

15
00:01:03,600 --> 00:01:09,330
You can do these port scans, web application scans and brute force all by just, you know, typing

16
00:01:09,330 --> 00:01:11,350
in the IP addresses that you want to target was part of.

17
00:01:11,520 --> 00:01:14,790
So let's go ahead and check out Spada and how to use it back in the car Linux machine.

18
00:01:14,820 --> 00:01:20,670
So one thing that I noticed, I wanted to note that if you have the 20, 20 version of Linux, Fatah

19
00:01:20,670 --> 00:01:23,310
is not going to be included on it and you won't be able to download it.

20
00:01:23,310 --> 00:01:29,670
From what I know, at least not by no means, because it relies on an earlier version of Python and

21
00:01:29,670 --> 00:01:34,350
they took out tools that relied upon that version of Python in this version of Linux.

22
00:01:34,710 --> 00:01:36,750
So there's another to the exact same thing.

23
00:01:36,750 --> 00:01:37,700
It's called Legian.

24
00:01:37,860 --> 00:01:42,540
So if you can check to see if you have it or not, or if you use an early version of colonics and you

25
00:01:42,540 --> 00:01:47,550
want to be beyond exactly what we're using, you should install Lesin.

26
00:01:47,820 --> 00:01:52,110
And I believe that this just comes with it on there so we can just type in Legian, hit, enter and

27
00:01:52,110 --> 00:01:58,680
let's give it a minute, is going to pop up with a nice little GUI so we can go ahead and actually conduct

28
00:01:58,680 --> 00:02:02,100
our scanning so we could just click here and add our host to the scope.

29
00:02:02,100 --> 00:02:04,740
We're just going to do one just for the sake of time.

30
00:02:04,770 --> 00:02:08,300
So we're going one or two, one, six, eight, five, six.

31
00:02:08,310 --> 00:02:13,440
And right here you put zeros last twenty four if you want to do a whole subnet for your own purposes.

32
00:02:13,470 --> 00:02:18,480
Right now we only have limited Hosai anyway, so that would just waste time and resources on that one

33
00:02:18,480 --> 00:02:19,010
laptop.

34
00:02:19,350 --> 00:02:24,930
So I'm going to do one of four for the machine and then it's going to run a map post discoveries.

35
00:02:24,940 --> 00:02:29,520
I was going to check these hosts up and then also was going to run a stage and map scan, which is going

36
00:02:29,520 --> 00:02:33,540
to take a layered and map scan that is like pretty efficiently.

37
00:02:33,540 --> 00:02:39,240
And then it's also going to be running nikto and we can optionally run like the brute force tool if

38
00:02:39,240 --> 00:02:39,930
we wanted to.

39
00:02:39,940 --> 00:02:40,860
We're not going to do that here.

40
00:02:40,860 --> 00:02:42,510
But you can play with that on your own if you want to do.

41
00:02:42,730 --> 00:02:48,120
And it's also going to do the screenshot where it's going to take screenshots of, you know, some potentially

42
00:02:48,120 --> 00:02:49,050
open ports and stuff.

43
00:02:49,290 --> 00:02:54,480
So hit submit and then it's going to start the process, going to start to cook stuff up and you're

44
00:02:54,480 --> 00:02:57,450
going to see stuff on the screen and then we could check out the results.

45
00:02:57,450 --> 00:02:58,990
So let's just give it a minute and we'll come back.

46
00:02:59,070 --> 00:03:03,750
So now we have some results in here so we can actually go ahead and start to look at the results and

47
00:03:03,750 --> 00:03:04,830
see what's going on.

48
00:03:04,860 --> 00:03:09,900
As you can see, it found that a lot of the open ports that we found before, we believe still doing

49
00:03:09,900 --> 00:03:11,580
some things, but it can take a while.

50
00:03:12,000 --> 00:03:13,800
So many Stage IV scans could take a while.

51
00:03:13,920 --> 00:03:18,510
It also ran some like a enumeration stuff like some of the tools from and map.

52
00:03:18,520 --> 00:03:20,510
So to actually look for vulnerabilities for us.

53
00:03:20,520 --> 00:03:21,400
So that's pretty neat.

54
00:03:21,420 --> 00:03:26,160
So what we can do is see that, hey, these ports are open and is running these services.

55
00:03:26,310 --> 00:03:28,520
So it kind of automates the process for you.

56
00:03:28,560 --> 00:03:35,070
I prefer to use this and in combination with and map because I like to do some, you know, some hands

57
00:03:35,070 --> 00:03:37,920
on stuff myself with and map of some very specific things.

58
00:03:37,920 --> 00:03:38,960
But this is a good tool.

59
00:03:38,970 --> 00:03:41,730
The lays it out so you can see everything.

60
00:03:41,880 --> 00:03:44,000
And it kind of like like I said, it does it for you.

61
00:03:44,010 --> 00:03:46,230
So like I said, it does the Nikitas scan.

62
00:03:46,380 --> 00:03:48,780
This is what output from McDo will look like.

63
00:03:49,080 --> 00:03:50,880
We'll also see that a little bit later on.

64
00:03:51,150 --> 00:03:55,800
But it's actually seeing that there's a lot of stuff that we can potentially take advantage of.

65
00:03:55,950 --> 00:03:59,340
And these are things that we can search up and probably find.

66
00:03:59,340 --> 00:04:04,610
Like, for example, you know, the PSP environment is something that's very commonly found, that's

67
00:04:04,620 --> 00:04:09,750
exploitable and can be an issue that I something we'll look into once we get into that section.

68
00:04:10,140 --> 00:04:13,320
So we found a lot of vulnerabilities and then they did a screenshot.

69
00:04:13,320 --> 00:04:17,430
I don't think that it has anything close to it right now for Haiti, but it would hit on a screenshot

70
00:04:17,820 --> 00:04:19,950
of the Web page if you would have found something.

71
00:04:20,220 --> 00:04:23,580
And let's see around these other Allscripts.

72
00:04:24,000 --> 00:04:32,970
And these didn't have any input output for the SMTP one, but it does have some help for the SMB enumeration.

73
00:04:33,240 --> 00:04:39,360
And it's kind of what we did before we used the it found like, you know, the SMB share that it's connected

74
00:04:39,360 --> 00:04:39,960
to and such.

75
00:04:39,960 --> 00:04:45,600
So you can play with this and look through the different stuff like, hey, we ran the Postgrads a default

76
00:04:45,600 --> 00:04:47,630
script to see, doesn't it.

77
00:04:48,000 --> 00:04:48,330
Yeah.

78
00:04:48,330 --> 00:04:50,160
So it found a valid password actually.

79
00:04:50,160 --> 00:04:54,240
And, you know, Hijau actually went through it and figured out what the parser was.

80
00:04:54,240 --> 00:04:55,550
So that's pretty good.

81
00:04:55,560 --> 00:04:57,930
So it kind of automates a lot of the process for you.

82
00:04:57,930 --> 00:05:03,300
So I really recommend that you look into this and try to see the different stuff that you can actually

83
00:05:03,300 --> 00:05:03,960
find.

84
00:05:04,230 --> 00:05:08,610
And like once again here, you know, it found a valid password as well.

85
00:05:08,850 --> 00:05:12,480
Pretty much like right here is FTP Anonymous log on is allowed.

86
00:05:12,480 --> 00:05:13,350
So that's pretty neat.

87
00:05:13,650 --> 00:05:17,280
Very powerful tool automates everything for you for the most part.

88
00:05:17,460 --> 00:05:19,950
So you can use this or you can do the command line stuff.

89
00:05:19,950 --> 00:05:23,790
If you want to be a little more hands on specific, go ahead and check out Legian.

90
00:05:23,790 --> 00:05:29,250
But it's definitely something that I use on every assessment in combination with other things that we

91
00:05:29,250 --> 00:05:30,030
talked about as well.