Another tool for active reconnaissance called Though Nyko, the very useful application, getting to
actually find vulnerabilities and weaknesses that exist on, you know, Web servers, even though some
Web application scanner, you can actually use it against servers and you might find some, you know,
vulnerabilities that you could potentially exploit, you know, on these servers.
Right now, we're going to hold off until we get to the Web application contesting sections, actually
look at McDo and see what it can actually find because it'll be more useful there.
Another tool that kind of combines multiple tools into one is called Spartan.
It just puts everything together like one interface so that you can see everything is automated and
makes the information gathering portion of your reconnaissance pretty, pretty easy.
Some of the tools that it actually includes in it is and map McDo, like we just went over Hydra, which
is like a brute forcing tool and also a HGP screenshot tool.
So actually go through and screenshot what it sees, like if you want to access a certain address over
a certain point in a browser.
So it's pretty useful.
You can do these port scans, web application scans and brute force all by just, you know, typing
in the IP addresses that you want to target was part of.
So let's go ahead and check out Spada and how to use it back in the car Linux machine.
So one thing that I noticed, I wanted to note that if you have the 20, 20 version of Linux, Fatah
is not going to be included on it and you won't be able to download it.
From what I know, at least not by no means, because it relies on an earlier version of Python and
they took out tools that relied upon that version of Python in this version of Linux.
So there's another to the exact same thing.
It's called Legian.
So if you can check to see if you have it or not, or if you use an early version of colonics and you
want to be beyond exactly what we're using, you should install Lesin.
And I believe that this just comes with it on there so we can just type in Legian, hit, enter and
let's give it a minute, is going to pop up with a nice little GUI so we can go ahead and actually conduct
our scanning so we could just click here and add our host to the scope.
We're just going to do one just for the sake of time.
So we're going one or two, one, six, eight, five, six.
And right here you put zeros last twenty four if you want to do a whole subnet for your own purposes.
Right now we only have limited Hosai anyway, so that would just waste time and resources on that one
laptop.
So I'm going to do one of four for the machine and then it's going to run a map post discoveries.
I was going to check these hosts up and then also was going to run a stage and map scan, which is going
to take a layered and map scan that is like pretty efficiently.
And then it's also going to be running nikto and we can optionally run like the brute force tool if
we wanted to.
We're not going to do that here.
But you can play with that on your own if you want to do.
And it's also going to do the screenshot where it's going to take screenshots of, you know, some potentially
open ports and stuff.
So hit submit and then it's going to start the process, going to start to cook stuff up and you're
going to see stuff on the screen and then we could check out the results.
So let's just give it a minute and we'll come back.
So now we have some results in here so we can actually go ahead and start to look at the results and
see what's going on.
As you can see, it found that a lot of the open ports that we found before, we believe still doing
some things, but it can take a while.
So many Stage IV scans could take a while.
It also ran some like a enumeration stuff like some of the tools from and map.
So to actually look for vulnerabilities for us.
So that's pretty neat.
So what we can do is see that, hey, these ports are open and is running these services.
So it kind of automates the process for you.
I prefer to use this and in combination with and map because I like to do some, you know, some hands
on stuff myself with and map of some very specific things.
But this is a good tool.
The lays it out so you can see everything.
And it kind of like like I said, it does it for you.
So like I said, it does the Nikitas scan.
This is what output from McDo will look like.
We'll also see that a little bit later on.
But it's actually seeing that there's a lot of stuff that we can potentially take advantage of.
And these are things that we can search up and probably find.
Like, for example, you know, the PSP environment is something that's very commonly found, that's
exploitable and can be an issue that I something we'll look into once we get into that section.
So we found a lot of vulnerabilities and then they did a screenshot.
I don't think that it has anything close to it right now for Haiti, but it would hit on a screenshot
of the Web page if you would have found something.
And let's see around these other Allscripts.
And these didn't have any input output for the SMTP one, but it does have some help for the SMB enumeration.
And it's kind of what we did before we used the it found like, you know, the SMB share that it's connected
to and such.
So you can play with this and look through the different stuff like, hey, we ran the Postgrads a default
script to see, doesn't it.
Yeah.
So it found a valid password actually.
And, you know, Hijau actually went through it and figured out what the parser was.
So that's pretty good.
So it kind of automates a lot of the process for you.
So I really recommend that you look into this and try to see the different stuff that you can actually
find.
And like once again here, you know, it found a valid password as well.
Pretty much like right here is FTP Anonymous log on is allowed.
So that's pretty neat.
Very powerful tool automates everything for you for the most part.
So you can use this or you can do the command line stuff.
If you want to be a little more hands on specific, go ahead and check out Legian.
But it's definitely something that I use on every assessment in combination with other things that we
talked about as well.