In the last two lectures, we studied the networking concepts and the different types of scans.
Now it's time to actually see how scanning does and what is scanning.
So in this lecture, we will scan a target using Zenab DUI.
Then we will trace all the send and receive packets.
We will perform a slow, comprehensive scan, create a new profile to perform an old scan and analyze
the scan results.
So without wasting any much time, let us directly get started.
First, we need to download the then map.
Then MAP is actually the UI for any map that we have used in Cali.
So what do you have to do?
You have to open the browser, go to Google and then you have to type download then map.
Click on the first link, that is a map dot org.
It is the official platform.
Download the map, go to the download section.
Then you have to download the two softwares and map and pick up and pick up is the support for the Nagwa.
So download all the two setups and wait till the download completes.
The files have been downloaded and I have installed both the files.
But you have to do is just open the files and run both of them.
This is the Zen map.
You can see we have to enter the target IP address there, then commands.
We have to enter there.
The profile tells us with scan.
It is so for first, since we're using certified hacker dot com, we need to find the IP address of
that.
So let us find IP address.
We know how to find the IP address using Pinkman, we have seen it in the networking codes, so typing
certified hacker dot com, we get the IP address, 162 point to forty one point two one six point eleven.
So take that IP address and then navigate to the map based the IP address there you can see automatically
the IP address appears in the command prompt.
Now we have to select the type of the scan which we want to do.
So these are all the different scans, intense can UDP scan.
We will see each one of them hit the start.
But first they're going to do the intense scan.
Now, this can take a lot of time for all the scans, I have fast forwarded the videos so that I can
explain what is happening on the screen.
You can see this scan has discovered the open port 53, open port 143, 995 and all those things.
So we have got the result completed as well.
And Stiltskin, in the last lecture, we had seen an example of Stiltskin.
And in this lecture we are seeing the use of that scan in the command section.
You might have wondering what is Dashty for Dashty?
Food stands for the maximum level.
You want the map scan to reach from zero to five.
Dash A stands for all the data to be displayed.
That is, while scanning the entire information should be displayed.
That is can Vergence can scan everything and Batsheva stands for verbosity.
That is more deep information.
So we have completed the scan and now we can see the open ports.
The open ports are displayed in green color.
We can see for twenty one is open, Port 22 is open, Port 26 is open for 25.
Might be open, but our scan detected it as a filter.
But we also find out the vergence.
As you can see, Port three to zero six is a minuscule port using the word five point six point forty
one to eight forty one.
These are disservices Microsoft Maisky will pop.
So by clicking on these services, you can get the entire information.
Now, what is the use of the and why do we require that virgin?
I will demonstrate to you, why do we require that virgin no.
Down the Virgin and go to Google and just type the name of that virgin.
My squirrel exploits so exploit for my esquibel and the Virgin is five point six point forward and then
hit enter.
My bad, the spelling is hard.
So, yes, we found out the exploits for my school version.
There you go.
These are the total exploits that were available.
It is the score is not so good, though.
These are not civil liberties.
But yes, there are vulnerabilities present.
So hackers use such information to find out which one their abilities can exist on the system.
You can see the Virgin is Apache, HTP is open, FTB is open and the domain is I see BitTorrent one
is filter network topology or topology that just tells you how earth can reached the destination.
That is the target IP address.
We can see different forms of topology, you can explore it here and there and just try then the whole
detail and scans.
This was the first scan.
Let us see a different type of scat.
Again, open and map and face the same target certified Hadco, but in this case, we are going to use
a different carmin.
What we are going to type is a map.
Dash, dash, backtrace, followed by the IP address by issuing the packet to trace command and map,
sends some packets to the intended machine and receives the packet, the sent packets.
It prints the summary of every packet it sends and receives.
The dash dash packet resorption causes Inmet to print a summary of every packet it sends and receives.
It can be, as this can be, extremely useful for debugging or understanding and maps behavior.
So you can see on the screen the packets are sent from host to target and the packets received from
target to host, consider one example.
Each line in the output contains several fields.
The first is whether the packages sent or received.
The second is the second is a timer counter providing the elapsed time started.
Third one is the protocol that is used.
The Ford Field stands for the IP address of the source and the fifth wheel stands for the appearance
of the destination, which in our case is the IP address of certified hacker dot com.
It also gives the idea and you can see there are numerous buckets which have been sent and received
in this process, the scan is still going on.
Our cruelty stands for received packet's and the stands for sandbaggers, you can see again, we can
see the number of open ports and airports once the scan is performed.
We can see that again.
We can see the services, then host open ports and etc..
As we have seen in the first scan itself, the host of Detailed Tabs allows the user to see the details
of all the hosts discovered during the intense profile that apology tabs help us to view the topology
of the target network that contains the provided IP address click fisheye option to do the topology
in a clear way.
There you have this, a map screen again based the IP address.
The next one is a slow, comprehensive scan look, comprehensive scan uses three different protocols,
TCP, UDP and is this and helps in determining which operating system services and Vergence, the host,
are running according to the most common TCP and UDP services.
It is simply an intense scan using UDP protocol, in addition with some more scanning options.
Now, one thing that I want to tell you that these scans take a very long time.
My scan, it almost took around 20 minutes to scan the complete network.
So make sure you have patience while using such scanning tools and while using and map tools.
Now, after scanning, you can see on the bottom that it is now it is still initiating a UDP scan already
nine seconds having elapsed, and it is really taking a lot of time to actually conduct the whole comprehensive
scan.
So make sure that you use more.
You used to get more patients to such scans because you won't get results in just two to three minutes.
You have to wait for almost half an hour, attack us, scan large networks and wait to get results for
almost two to three days.
So it's that huge.
And you should have patience to wait for such scans.
So you can see after eight minutes, it's only five point ninety six has done and it's a lot to go.
So we'll see.
I will explain everything once the scan is completed.
Estimated time completion is still 20 minutes, so I hope you have got the idea of how these huge scans
are, the results are.
We can see it has discovered some open ports, a four to one, forty three point twenty two point nine,
ninety three and many more.
Now, let us wait till scan can finished.
Finally, we have completed the Europe scan and now it is initiating a service scan to complete the
whole scan.
It will really take a lot of time.
Now initiating any ethics scan.
Vola, after a lot of weight, we have finally completed the scan in around, you can see one, four,
five, seven seconds.
That is almost 22 minutes to complete the whole scan.
But this time we have got all the ports that are open.
This is a slow, comprehensive scan which scans through the entire network have you can see there are
different services open, different versions are open, few ports are filtered.
A few boards are open.
We can try this on any website because this is this is not actually interacting with the website.
It just sends packets.
But we do take prior information before scanning any website.
You can see the signature algorithm is S.A.G. 256.
That is secured hash algorithm.
We will see all the algorithms in details in the last last two or three sections.
Then you can see they have used encryption algorithm algorithms.
So you can see using the dash of DAB has actually revealed us with a lot of information in detail.
Everything is available in detail.
And if you really have patience to wait for the scan, you can find each and everything which are used.
What keys are used, what is the number of bits that keys are using for cryptography.
Then you can see the topology, the fisheye in which form our network was scanned and everything.
In order to learn any tool, you just have to explore.
Keep on exploring the tools.
These are the hosts scans.
Accuracy is 99 percent accurate.
The results are 99 percent accurate, though.
Then we have found IPV for then closed ports, open ports and much more.
Now, let's close this and let us start the last type of scan.
So, again, open then map and start to get.
Yes, the map has opened.
Now let's go to profile and will now create a new profile and low profile, as we have discussed in
the starting of this lecture.
So what are you supposed to do?
So we have to go to regular can.
Then they have to go to profile new profile, then you can enter the name and order under the profile
name, you can enter whatever money.
I will give it a null scan.
Up to that, I will go to the scan tab, which is just close to the profile.
Then I will select a PCP's scan as that is, and that is the null scan.
Then timing template is aggressive that we have discussed before.
Then we have to enable all advanced aggressive options, that is E, which will give us more reserves
and then save.
And whenever you apply these changes to a particular website or a scanning network, you can find the
results.
So let us find out this scan on certified hacker.
So we will bring certified hacker dot com.
And then we will get the IP address and then try the scan on certified hacker, dot com certified hacker
dot com is a website provided by U.S. counsel.
So we have no harm in using the website for testing purposes because it is intentionally meant for testing
only.
You can even try the scans on the dam and the level of the applications which we have seen in the first
section.
So again, it has started and you have to wait for this scan to finish it.
It would again take 20 to 30 minutes, but we will get the results as seem it's still going.
So make sure you wait till the scan gets completed.
So let us have a quick recap again where we learn how to scan the target using then map the bizarre
different tools and techniques we analyzed and create holes.
And in the next lecture we will use and map in Linux.