And last but not least, we want to see a more graphical user interface or gooey tool that we can use
for our network scans.
Legion is a great tool.
It's a fork or a branched off version of the Spada tool kit that's been out there for a long time.
It's a really nice multi-purpose scanner.
It can even take advantage of vulnerabilities if you find them.
It's a great tool if you're running in a capture the flag event where you are asked to scan or look
for vulnerabilities.
Legion is a great way to to do that.
So let's come back over to.
And we'll close what we were working on before.
Come up to the Kelly man, you come to information gathering.
And scroll down on the menu there, you should see Legian and it still has the Spartan helmet click
Legian.
And Legian opens up a show window.
But let's minimize that.
Don't close it, minimize it.
And you should see a graphical user interface window.
Now, this may be too big to fit on your screen, so you may have to grab the bottom edge and bring
that up or expand the size of your viewing screen by coming up to view and changing the screen resolution
so that you've got a different size.
But we've got Legian.
Let's go ahead with it.
Just connect to this 10 dot dot nine network and see if we can add some hosts.
So we want to say 10 dot nine, dot zero, slash twenty four.
So this will actually be the entire network, up to 255 computers on the 10 dot nine network.
We'll leave a few of these other things the same.
I might bring this down a little bit.
Aggressive is going to be really noisy on the network and even if.
Well even though we're scanning inside our private, our public mapped, we want to keep it down to
a minimum.
Click submit.
And you will see legions start to scan your network.
And if it finds some computers, it's going to place them right up here in the list.
Tonight, Odah nine to one.
Done two.
That's seven.
That is actually Alcalay box itself right now.
I picked up a new IP address to narrow down seven to nut Odah nine.
Dot nine.
We know was our Windows computer.
That 10 is our Metis political box.
And you can see as it runs through different stages.
Of map searches.
And it's even gathering screenshots of Web pages of servers are running a Web page.
It's going to show us information about what services are running on each computer, look at that.
We've got a ton of services running on this.
Meadow's floatable box specifically turned out Audette nine to 10 on my network.
And it's done several things.
It's gathered some information about vulnerabilities from Nito, which is one of the other tools here
in Kalli.
It's taken a screen shot of the the Web server.
Not much information there because it's just a plain text page and it's got other information that may
get filled in as we go on a little bit further.
But you can see a lot of information about possible vulnerabilities just on this one scan of Almeida's
floatable box.
When we come up to our.
Windows Computer, we can see some SMB enumeration.
It's gathering some information to see if you can access without a username and password.
You might have heard of the eternal blue exploit.
That's checking for that along with a few of the things.
But we can see that even on our Windows computer, there are several services available because we turned
off the firewall in the previous lesson.
This is our Kelly computer itself.
That's our D.H S.P. server and that's our gateway.
So no other information there.
But on this menace floatable box, if this was a computer that you had left running on your network,
you really would need to check this one out, because there are a lot of vulnerabilities and needs to
be updated.
It needs to be patched.
But that's what Meadow's floatable is built for.
So it can find vulnerabilities like this.
Now, there's one other thing that we can show you with a legion of that will at least mentioned to
you if you wanted to scan your own home network.
This is very important.
This needs to be a network that not only do you pay for and you own and you have the full permission
to to read scans against, it needs to be okay with your Internet service provider.
They may have a ban on scanning there.
There can't be any other users on your network.
So be careful if you're running scans on a network like in a big building or if you are in an apartment
complex or someplace where you share an Internet connection among a lot of people.
This is really important.
When you run this scan, it will scan every computer and they'll send a lot of traffic.
And so people will be able to know that you are scanning them if they're looking for that with any intrusion
detection software or a good antivirus.
A good endpoint protection.
It'll tell them that they're being scanned over the Internet and might freak your neighbors out.
So please don't do this anyplace where you don't have explicit permission and control of the network.
But you notice everything.
Here's an item that Odah nine network.
We could actually change our network settings.
For just our Caleigh box, so we changed the network settings for just the Caleigh virtual machine.
I'm going to talk through this.
I'm not actually going to perform it, even on my network here at home, I've got a dozen devices on
the network at any one time, and my sons might be watching Netflix or another video channel.
I don't want to disturb the network because it's a buffer for them.
But you can change this to a abridged adapter.
That bridge to Dafter makes it look like your Kalli VM is actually another direct connection to your
Wi-Fi already or wired network.
And that will give your Caleigh computer access to other machines on your Wi-Fi network.
Once you change to the bridge that after you would do us pseudo service network dash manager restart
so that you get a new IP address out on the public network.
If your network allows that type of connection and then there's one other change.
I'll change just briefly.
But I want to switch back.
Notice this would be over Wi-Fi.
And this one other piece for some scans.
And Kelly, you actually want to allow promiscuous mode.
That means you can listen or sniff packets that were not meant for this particular computer.
Anytime you're in a coffee shop or in a library or any place with public Wi-Fi or open Wi-Fi, you need
to know that people can see your traffic.
So it's really important to use a VPN and you only serve secure HTP s Web pages, especially if you're
ending your username and password, because this one little change.
Go into abridged adapter and allowing promiscuous mode so that it can look at any packets that fly by
can allow somebody to look in on your network, traffic on your username and password if you're logging
and insecurely to regular H.
CCP Web site.
Don't do that from a public network.
Make sure you're doing that from a network that you can control and that you own or have permission
to use.
So those two changes would be all it would take to connect to my public, my Wi-Fi network here throughout
my house.
And it would give me the ability to run.
I'm going to change your backs.
That and don't forget, it gives me the ability to run the Legion scan.
That we just saw right here against every device on my Wi-Fi throughout my house.
That would be my printer.
That would be all of my computers, tablets, my son's chrome books.
All the devices that we have for smart televisions.
Anything in your home network, if you have surveillance cameras, those can be seen on a bridge network
adapter like that.
I'm not going to run that scan.
I just wanted to talk you through it just in case, because this is a really useful tool to run in your
organization.
First of all, make sure you have your organization's permission.
You should probably be an I.T. employee or contractor before you.
You run a scan like this and you do have to have the organization's permission, but it can help you
turn up devices even in your own home that you might have forgotten.
Were there, for example, of if you leave an old video game player connected, if it's not patched,
it might be a device out there on your network that somebody could find somebody could compromise and
turn into a way to access your personal information across your network.
Old Blu ray players that you might have put in the garage but left him plugged in or left home, turned
on.
They may have.
A network connection.
And they may be communicating out over the Internet.
And whether you use Legian use in map net, discover any of the tons of tools that are built into Kalli.
It's a great way to check to see if there are things on your network that you don't recognize or that
maybe shouldn't be there in our public map network.
We had our gateway in our d.H S.P. server that gives us IP addresses.
We had a Caleigh box on Windows and our Met hospitable VIMS and those are the only things that should
be in there.
They're the only things that are there.
So it's really good to be able to do these types of scans to check for devices and then check for using
Legian vulnerabilities in those devices that could make it easy for an attacker to.
Take advantage of vulnerabilities or weaknesses in your network and compromise an old machine.
Well, that wraps it up for what we're going to do with recon and scanning.
But I hope this information gathering has been useful for you, and I hope it's something you can put
to use in your organization and in your own home.