Network enumeration involves querying a group of hosts to gather specific information about our network
assets.
When we look at network scanning and mapping, we're really talking about the aspect of gathering as
much information about our network as a whole.
That usually includes scanning for specific ports, protocols, software, and vulnerabilities or flaws.
When across our entire network, we're looking for active ports.
We're looking for specific software vulnerabilities.
We're looking for flaws that go through the entire network as a whole, not within just one aspect of
a specific machine, but across the entire domain, whether that includes operating systems, routers,
switches, or pretty much anything within the entire network.
We're usually doing a vulnerability scan to look for specific vulnerabilities, but we're also looking
for problems that may erupt from different troubleshooting lags or flaws Within the network traffic.
So we want to identify the different ports.
We want to identify the different protocols that we're utilizing.
But it's more than just finding out if this port is open or closed or if this protocol is actually active
or not.
What we're really looking for is what version of that protocol are they utilizing?
Are we using an outdated or flawed protocol or a port that is seamlessly, more often than not, very
vulnerable to attack, such as FTP or telnet?
These specific ports or protocols that are often used can indicate a major flaw within our system as
a whole.
Nmap is one such tool that is greatly known as an open source tool utilized for scanning.
Most people use nmap specifically for identifying operating systems or ports or protocols different
services that are being offered, but it can also be utilized as a vulnerability scanner.
In such a way, we can identify whether or not a specific protocol has a known vulnerability on it.
If a specific port is well known and providing a flaw within our system such as telnet or FTP.
And it goes without saying that nmap is widely used as a command line based tool.
You'll probably also heard of Zenmap, which provides us a overall network kind of topology that's easier
to use.
However, it's not really supported anymore and it's hard to find that zenmap.
I would caution you against using Zenmap as you're going through your tools.
Most cybersecurity professionals, it's expected that we understand command line interface and that
we expect to understand how a Linux system actually operates.
Get used to typing out those little commands.
It'll be good for you in the long run.
Metasploit framework is an open source framework that's widely adopted for penetration testing.
When most people think of Metasploit, they think penetration testing.
Most people don't realize that that tool actually has scanning, uh, scanning services involved within
the tool itself.
For instance, we can use Metasploit framework to find out if a specific SQL or a specific samba is
vulnerable to attack.
It goes a little bit more in depth when we use it for scanning tools because it's specific for penetration
testing.
But there's no doubt that Metasploit Framework does provide us not only some scanning tools, but also
exploits into vulnerabilities that those scanning tools find that can be compromised.
Recon Ng is an open source framework that specializes in reconnaissance and open source intelligence
gathering, and much like Metasploit, it focuses on target discovery and infrastructure mapping.
But it goes a little bit step beyond that by identifying specific subdomains, email addresses, and
pretty much anything on the internet that you could think of that would be open source for gathering
information and intelligence.
It really goes without saying that recon Ng provides us with a vast understanding of the network and
how your domain, how your website is seen by the public eye.
All of this information is open source.
So what is your information that you're leaving on the domain or on platforms such as Google or Bling
or being?
Excuse me?
Operating across the board and what can our attackers see about our specific domains?