As an analyst, you may be expected to understand not only your network, but also the subnetworks that
are attached to your organization as a whole.
You can have a cloud environment, a hybrid environment, an on prem environment, and then several
different offsets of each environment depending on what your organization entails.
This can range from a couple of machines all the way to several thousands of different machines.
Within this chapter, we're going to discuss vulnerability scanning methodologies as well as the concepts
associated with them.
Specifically, within this episode, we're going to talk about network mapping and what it entails and
how to identify the different subsets of within each network, whether it's in an isolated environment
or within the network as a whole.
We're also going to dive into an individual item on your network and be able to fingerprint exactly
what's going on with each individual system.
Now we're mapping includes different aspects of scanning the network as a whole to identify the different
machines or IP addresses associated with it.
You have to remember that each physical device has a respective IP address associated with it to be
on the network.
Now, we talked about dynamic and static IP addresses, and that's not really what we're discussing
here.
What we're discussing is each item on your network is interconnected to another item on your network.
And you, as an analyst, need to be able to formulate an exact map of each device and how it interacts
physically with each other device.
Now, that sounds a little bit more complicated than what it needs to be.
We can usually pull this off via a different subset of networking tools in one way, such things as
a ping, sweep, or port scanning.
Ping sweeps really provide us a different aspect of every IP address associated on the subnet that we're
operating on for each physical device.
Within that, we want to know what ports are operating on it, how is that device communicating with
other items or objects on our network?
We also want to be able to enumerate its services.
What services are associated with that specific device?
Does it have a web server operational on it?
Maybe it's using something weird, like RDP or a specific port or protocol that we don't normally see.
We need to be aware of those because we need a baseline in order for our network to function operationally
within our own organization.
How do we know if something's going wrong, if we don't have a baseline to identify exactly what's on
our network now?
Once we've identified the different services, ports and the different IP addresses on our network,
we need to dive into an individual device in order to fingerprint every known service, operating system,
and expansion pack that's operating on that specific device.
We want to keep a list operational within our environment so that if something does occur or if our
investigation takes us to a specific operating system, we can identify everything that was originally
on that device from two days ago or a week ago.
If something has changed, that's an indicator of compromise that we need to be able to identify.
We're going to go through right now and discuss that on an nmap and show you exactly what I'm talking
about when it comes to network mapping.
Once we're in our Kali environment, we're going to open up a terminal that's that little black box
at the very top left hand side.
I'm going to blow this up so you can see it a little bit better as I'm typing out these different commands.
Now on my virtual network I have both a Windows 10 machine running.
I also have a Archaeopteryx two, which is a vulnerable machine that we've identified before within
this lab environment.
So I've actually got two machines running right now on the network, plus my Kali box.
In order to scan, I actually need to know what my IP address is because all of my machines are operating
in the same subnet.
So the very first command I'm going to input is ifconfig.
And this is just going to give me the same principles that an IP config would on a windows machine.
Here you can see my IP address is 10.0.2.9.
And you can see my netmask as well as my broadcast address.
Throughout this we're going to run a simple network ping scan.
And I'm going to do that using the nmap command switch or tack Sdn.
And I'm going to do a 10.0.
Oh, there we go.
Let me do that num lock button in there.
We're going to do a ten .0.2.0.
But at the very end we're going to do a slash 24.
This is the final octet or what we're really scanning here is zero through 255.
On that last octet right there.
If I hit enter it's going to go through.
And it's just going to run that ping scan very, very quickly to identify everything that's on my network.
You can see here the output.
Now I am in a virtual environment.
And because I'm in a virtual environment using VirtualBox, this IP address right here 2.1 it's not
a real IP address, it's just something VirtualBox uses so that I can see what's going on within my
system.
If I scroll up, I know that my IP address for my Kali box is 2.9, which is right here.
Now, I did notice something and I'm sure you did too.
I've only got one box operational.
I've only got that 2.5, which means my windows machine is most likely not on this network.
Now, I can't be sure of that because I've only got one IP address.
We're going to dive into this a little bit later when we get into fingerprinting in the next little
demo.
The next thing I want to do is port scanning to do port scanning I'm just going to open up that nmap
command again.
But instead of doing Sdn we're just going to do a p switch p.
This is going to provide me a very detailed port scan of every device on my slash 24 network.
Again, I'm not identifying a singular IP address.
I'm going through the entire Cidr.
And this is what network mapping is all about.
We're not identifying a specific operating system.
We're not doing fingerprinting.
We're doing network enumeration and mapping.
This is going to take a second as it goes through the command because this is a very detailed command.
So you may have to wait a few seconds for this system to finish up.
Okay.
So our scan has finished.
And you can see here that it provided us a 2.1.
But there's no ports except for 53 open bonus points.
If you can remember what port 53 TCP stands for.
Let's drop down to 2.5 now.
2.5 is the IP address of the singular machine that's operational on my system or on my virtual network
right now.
And we know that because 2.5 pointed out some different aspects here.
You can see with our port scan that we identified several different ports that are open, starting with
port 22 on SSH.
We can also see port 8111, 443, 631, 825 and 3306.
All of these provide us a service, but it's not a lot of information when it comes to that specific
service.
It's not telling us the version, it's not telling us the specific software that it might be utilizing.
It's just giving us a broader categorization of the service that it's utilizing in conjunction with
the port that's open.
Again, it's telling me that SSH is open, but it's not telling me which version of SSH is open.
This is where network enumeration kind of stops.
We've identified the IP addresses associated with our network, and we've identified the ports that
are open.
Now let's talk about Services.
If I want to run an nmap services scan, I'm going to do nmap tac or switch lowercase s, uppercase
v and again 10.0.2.0 with a forward slash 24.
Again, that makes sure that I'm doing that last octet of 03255 on the 24 Cidr.
I'm going to hit enter, and it's going to go through and start scanning all of these IP addresses.
In my case, just the one for different services that are operational on this specific machine.
Again, you can recognize from the output that it's providing us that report for 2.1, which again is
just VirtualBox.
And it's saying hey port 53 and it has one service that is unrecognizable because it is in fact VirtualBox.
Okay.
If we scroll down, we can see 2.5 is pointing out and it's providing me a little bit more information
to the specific machine.
It's telling me that port 22 is open on TCP with an open state running SSH, and the version it's running
in is OpenSSH.
Version 3.9 P1 with protocol version 1.99.
This provides me a lot of information specific to this specific box.
Now, because I ran it for the entire octet, you can see that it's providing different aspects.
And if I had other machines, it would provide that output for each and every machine on my subnet.
This is where network mapping really comes into play, and where you, as a cybersecurity analyst,
should be able to read this output within your Cisa exam.
You may see scenario based questions with an output like I'm showing you here, going, hey, what output
or what version of software is running?
We'll start again from the top on this one, not from the top from the from the Cisa exam.
You may see a question on your Cisa exam asking on port 80 what service is currently running and it
will provide you this blank out right here.
Which port 80 is running TCP open.
And the correct answer would be running Apache HTTPd, and it may be version 2.0.52 and maybe even asking
you what operating system.
And in this case it provides us using CentOS.
This is important information that you need to be aware of for you to see why I say exam, because you
may see outputs like this.
It may also try to trick you where it's not providing that service column right there.
And it'll say something like what service is running on Https.
And you may be able to opt to identify that Https is actually running on port 443, which it didn't
tell you before because it's not associating with it.
And then you may have to put out the version service as Apache HTTPd version 2.0.52 CentOS.
So again, just like Security+, you need to know what port and protocols are matched and they may not
provide you everything when it comes to that, a specific attribute I expect to see.
Different questions associated with that on your CSA exam.
We talked about network mapping and how it includes mapping your entire network and how those physical
connections take place.
When we talk about fingerprinting, we're specifically talking about a single device on your network.
This could be a server, a client.
It could even be an IDs or IPS or a firewall.
It doesn't really matter.
It's just dependent upon what you're actually scanning.
We're going to provide you an example today on nmap again of actually fingerprinting a specific device.
From our previous scan.
We know that 2.5 or 1 0.0.2.5 is actually running our soul machine on our network, associated with
what we're doing here.
Now I know what that machine is, but let's pretend for a minute that I didn't.
If I've already done the ping sweep scan, which I have, and next thing I may want to identify is the
operating system as a whole.
Now, in our previous scan, we identified that as possibly being a CentOS operating system.
But if I want to know for sure, I can do a tag or switch capital O and then provide the exact IP address.
You'll notice in fingerprinting I'm not doing a scan or a Cidr.
I'm doing an individual IP address, specifically 10.02.5.
You can see here that within my system it's telling me I need root privileges.
And like anything in Linux, I'm just going to provide that sudo or sudo command in there.
And again I'm going to run nmap switch o capital O10 .0.2.5.
And it should run okay for me now.
If we see here you can see at the very bottom it's providing me what the operating system is.
I am running a Linux 2.6. x.
It's not sure exactly what the last version is for that, but we are fairly confident that it is running
on a Linux platform of 2.6.
If I drop down one line, we can see the operating system CP.
This tells us that it's running Linux Linux kernel version 2.6.
Right here.
And if I look at the operating system details, it's making a best guess here.
And it's saying it's running Linux 2.6.9 through 2.6.30, which means it's fairly confident that our
operating system is one of these versions.
Between that, we can also see, unlike before, there is only one hop between my machine, in which
case I'm running the scan.
And the virtual machine that's associated with that means there's nothing in between, because one hop
is actually the machine.
There's no route switching or anything else in between our two devices.
This is important to note when we're doing a fingerprinting, because it really tells us how many machines
or how many systems are between me and the operating system or the fingerprinting system that I'm actually
trying to communicate with.
You may see exam questions here specific to this.
And again, you just need to know how to read something like nmap that provides us this detailed information.
The next thing that we want to run is the software for software.
A lot of times we're going to run a basic nmap scan with the SRV command, which we showed you specifically
with the network mapping, except we're doing it on the client base as well.
If you don't remember it's just nmap with a switch or tac lowercase s uppercase V.
And then the specific IP address in this case 10.0.2.5 and pressing enter to let it go through.
Uh, this isn't the only software that you should be associated with or understand on your network.
Uh, nmap doesn't have a specific command to identify every piece of software on an individual client
or a server, but it does provide us a basically a high level overview of what's going on.
If you're in the CSA or if you're an analyst, you should have a list of, uh, software or assets associated
with every client on your network.
Meaning if you're running a windows system and it uses Microsoft Office Excel, maybe it uses outlook
for its email or other proprietary software or even common software like Java.
You should have a list of every software that's associated with that specific device.
A lot of times that software is held at the IT team, because that's more of their primary responsibility
than ours is cybersecurity specialists.
But we want access to those services and software that are associated specifically with that machine.
Because if we're doing patching, if we have a piece of malware or we have something that's going on,
we obviously need to know what was associated with that specific machine, because it could lead us
down some interesting pathways as we're doing our investigation.
However, for nmap, we're just going to run a basic services scan like we saw before.
In this case it really nothing has changed because we only did it for a specific machine.
And you should know how to read this again.
You may see questions specific to a Https or even EIP where it's not really providing you the port number,
but expecting you to understand the correlated port address for it.
Again, with open ports, we're going to run the same command as before.
We can do that switch p switch just like before.
I'm not going to show that again because I feel like we've already covered that in the network scan.
And it's really no different except we're going to provide that same scan to an individual IP address
rather than a network as a whole.
Now, you may be asking yourselves for network scanning and then again for fingerprinting.
Why would I run the same command twice on an individual machine if I already have it on a network scan?
A lot of times it's because of the reporting feature or the output feature of the actual software.
And nmap.
You could actually do an output for a report based on the entire IP address range that you're utilizing.
For instance, if I'm doing network mapping, maybe I want to fill out a report for every IP address
that provides me all the port numbers and associated services for the entire gambit of the Cidr address.
But maybe I have an individual report on a shared drive that tells me, hey, I have a windows IP address
associated with Windows 10 running this, uh, this service and this software.
And here's the open ports associated directly with that specific device.
So I have an individual report for that specific machine.
But I also have one for the network as a whole.
And they should match up.
If they don't, then that could pose some possible issues.
Again, I can run services on the system using SRV.
I can also identify the specific Mac address associated with it.
To do that, I would run an nmap command to the specific IP address, in this case 10.0.5.
And I could run through and grab that specific IP address.
Now if I wanted to find out the specific Mac address to identify a specific Mac address on our specific
machine, we're going to again run nmap.
I'm just going to throw sudo in front of it because and then we'll do nmap.
I can't type today nmap.
And then we're going to do a switch or tag lowercase s uppercase p.
And then we're going to do a switch in lowercase space.
And then the specific IP address we want to run in this case 10.0.2.5.
And it should run through.
And here you go.
We can see our Mac address right here.
The Mac address in this case right here.
0800 2742887 for our Mac address again.
CBSA isn't going to specifically identify nmap commands that you may have to remember.
If I'm showing you the nmap command here on today's lesson and on our previous lab, I would memorize
those.
I really would because there are labs specific in your hands on material there.
You may have to identify specific commands for nmap.
They are few and far between, but they are there.
It's not uncommon for your Cisa exam to ask for a specific command.
Usually this is Sdn or in order to run a port scan.
And normally it's asking hey this nmap command nmap switch lowercase s uppercase V runs what type of
command expect to see those types of questions.
Don't expect to see questions like.
Input the command for nmap to run this type of scan.
Their testing material or testing database doesn't really form Warm around that type of test question,
but it does form around giving you the command and expecting you to understand what the output of that
command may offer.
That's the type of questions you can expect to see for IP addresses.
We've kind of already covered that with the basic command of switch Sdn, which does a port scan or,
excuse me, an IP scan which identifies the IP address associated with it.
And then again configuration settings for configuration settings.
They're really more talking about specific IP addresses that aren't associated with operating systems.
You're talking about firmware versions or that type of thing where we're looking more at IPS, routers,
firewalls, items on your network that actually take configuration.
A lot of times in my own past, what we used to do is we would share those configuration settings onto
a USB drive, as well as a shared folder that was secured in our own databases, so that if I had a
device like a firewall crash on me, all of a sudden I could take that USB drive which had the past
configuration settings already on it, and it would make setting up that new firewall that much easier
because it's literally loading the configuration settings onto the new device.
It's also nice if I'm troubleshooting a firewall and it has some specific issues with it.
Maybe it took a hiccup in power and it's just not operating properly.
I can already have those configuration settings setting aside where I can plug it in and just streamline
the process all the way from the start to the finish.
Not all network devices have that capability, but it is nice to have that already set aside if you
have an issue.
Remember, configuration settings are something that you should save and provide if nothing else, just
screenshots that you can follow along if something happens within those devices.
As a cybersecurity professional, you should have access to those settings on a case by case basis.
In most cases, we want those settings all the time.
And it just again provides us a little bit of error correction if something goes on with that network.
And then finally unique identifiers.
Unique identifiers can be anything from a one off from a normal configuration.
In my own line of work, we used to have 5 or 6 different routers, and other than the actual IP address,
they were exactly the same.
And those instances, we may have a offset where one switch is operating against the norm.
We would try to identify those unique identifiers specific to that switch.
Normally we'd save those in configuration files, or maybe we would color code it.
I remember on one rack we had five different switches.
And so for that specific switch we would color it green with a nice juicy tag and some spray paint.
I know we were high tech, but we would identify that switch as being unique, and that was a unique
identifier we'd utilize with it.
And it would tell everybody that was working on that switch.
There's a different configuration file for this switch than the rest of them.
We only did that because we constantly had people going in, and then readdressing that same switch
to the normal switch.
Configuration files that we always use.
Unique identifiers can be anything from a color code to a specific IP address associated with it, or
technology that isn't used on our normal switches.
Throughout this episode, we talked about both network mapping and fingerprinting, and how to utilize
those and the differences in between with the network mapping.
We're really talking about the network as a whole and getting that logical or logical point of view
of how our network map actually functions.
This is more utilized for it to identify, hey, the router connects to this switch and this switch
goes to here, and this goes to here.
So that visually you could see all the different physical outputs or ports being utilized.
And the cable throughputs between one device and another.
While it usually supports this mechanism, we as cybersecurity professionals need to know it as well.
And we should have a copy of the network mapping.
We also want the logical perspective where we're identifying each IP address through nmap or some other
form where we can quickly identify what's interconnected between it.
So we want that physical mapping perspective, which we may see from a topological point of view.
But you also want the software version where we can actually see the different IP addresses and how
they're associated with one another.
With fingerprinting, we're actually talking about the specific device and how it operates on an individual
level, what ports are open, what services is operating, the different software that's on it as well.
Within CSA expect to see a lot of outputs within there.
And when I say a lot, I really mean 1 or 2 questions that are associated with specific nmap outputs
or other software that you've been accustomed with, maybe angry IP or something similar to it.
You should be able to read those different outputs and identify what's going on with the device based
on the information they provide.
This seems pretty common sense and should be somewhat easy for you to read as a cyber professional,
but I would brush up on it, especially if I haven't seen those outputs in a while.
A lot of times as analysts, we get pigeonholed into one career field or one aspect of our job.
Remember that Cisa is a broad scope of different jobs, all formulated at a high level, and so you
need to be aware of how those different outputs are read.
I would just go over it once or twice before you take the exam.
You should be okay.
Remember, it isn't uncommon to see a nmap command associated with the exam.
I myself have seen at least one nmap command as a quiz question, so be prepared for those high level
quiz questions associated with those basic commands that you expect to see as part of nmap, and you
should be okay.