One of the big challenges we have when we're looking at a network is we need to know what is in this
network.
Now other episodes we talk about tools like for example net stat which allow us to know what's happening
on an individual host our local host.
But what if you have a whole bunch of computers there's a zillion scenarios within the I.T. security
world where you want to be sitting at one computer and you want to start checking out other computers.
Now what I'm talking about chicken and other computers we're talking about using powerful tools that
will queery not just one system but all the systems within a certain say network ID to determine what
is going on.
So I call these in general network scanners but they go by a lot of other names as well.
Port scanner's is another name you hear quite a bit.
The bottom line is is that on security plus you're going to be running into certain tools that will
go out and sniff a network and that's what I want to talk about right now.
Now the first one I want to talk about is probably the most famous called and map and map is a powerful
powerful tool.
It is used for inventorying of networks it's used for looking for bad guys it's used for all kinds of
stuff but it's not the easiest one in the world to use.
However I'm not too bad at it.
So let's take a moment and use it now I need to warn you and map is more commonly used in Linux systems
but I'm a Windows guy so I've got it running right here so anybody out there who likes Linux don't yell
at me.
All right so here I am at a command prompt.
I've got unmap installed.
So there's a lot of different ways to run and map so the first thing I'm going to do is I'm going to
just check out the network around me.
So I'm going to type and map give me lots of verbose information.
And then do what's known as a Ping's scan and then I'm going to give it a network to check out which
is the local network for this right here.
And let's see what happens.
When I run this now it's going to be taking a minute.
So that's the one downside and mapping sometimes you've got to sit around and wait a little bit.
OK so we've got to tell about it here.
Let me scroll up to the top so we can see this.
So basically what I've asked and mapped to do is I said look out on the entire 192 168 for with a wack
24 subnet mask and just give me a quick idea of what's out there.
I'm not asking for much information.
So let's pick individual ones so you'll see it just starts at 0 and goes all the way through.
And here it found like this is my router.
These are some more unused IP addresses.
And as we go through you'll notice what it's doing is it's giving me an idea of how many up and live
systems are out there.
Right this very moment.
So there's a lot of computers on my little network.
No big surprise there.
Now it doesn't stop there.
We can actually go a lot deeper now.
One of the things I want to do this time is I'm going to run and map again this time but this time instead
of just looking on my own little local network I'm actually going to go to a very specific computer
out on the Internet that and map has been nice enough to set up for us to play with.
And it's the infamous and mapped out scanned me computer so let me type this in real quick.
So you type and map again.
I want verbose output this time I'm saying I want to know what the operating systems are
and we're going to let this puppy go.
Now in this particular case we're not scanning an entire network.
I'm actually trying to zero in on one very specific computer.
So let's see what he came up with.
All right.
Fantastic.
So let's take a look at what's happening on just this one little machine.
Now if you think about this they're going to put some fun stuff for us to find here.
All right.
First of all here's all the different types of work it's trying to do.
But here's what I'm interested in.
I notice that port 22 is open so it's an S-sh server.
I see that port 80 is open so I know automatically that's a web server and then port 90 9:29 which is
a nonstandard port number is also available and I can go ahead and start doing stuff with this.
So that's one of the most important aspects to unmap is that and that by itself doesn't have anything.
What unmap allows me to do is to go in query a system and then I can start doing stuff if I know that
port 22 is open.
I might turn to some S-sh attack tools to try to break into the system via S-sh.
If I'm just a network administrator and all of a sudden I see one of my services running S-sh I might
be making some phone calls to shut that port off.
So when we're talking about a tool like unmap keep in mind different scenarios require different actions.
But this is actually pretty cool because not only that it not only does it show that it's S-sh.
Here's my S-sh keys that are involved with that particular one.
And I've got some other I know this is a Windows machine because I see it's running 135 1:39 for 445.
And then it gives me a little trace route so I know the process I went through to get to that particular
system.
So here's just one example of how that can really be handy now.
I like that quite a bit.
It is on every thumb you come up and say hi to me I'm going to have a thumb drive on me and on that
thumb drive is going to be Unmap.
But one of the downsides and map is that it's a little hard to read as like this so there's a wonderful
tool that comes with unmap called Zenn map and awls and map is is a graphical user interface an overlay
that runs on top of the map so let's fire him up.
OK so welcome to Zenn map.
Now one of the things you're going to learn about Zenn map is that you basically just as he saw me type
in those strange commands at the command prompt you're really doing the same thing it just organizes
it a little bit better.
So let's go ahead and have him do so.
He has all these pre-made scans.
I'm going to do what's called a ping scan which is not super aggressive.
Now while this guy scanning there's a couple of things I need to warn you about.
Any decent intrusion detection system either host based or network base is going to go bananas if you
start running scans like this onto a network so be warned if you you're in the office and you actually
get to try and map you may end up getting a phone call.
OK so we've got some output here.
So now we can see we've got a whole bunch of systems on this network.
I want to keep that a little bit close because I don't want you guys seeing exactly my DNS settings
on everything.
But the bottom line is I've got tons and tons of systems.
It's a little bit easier to use than running and map from a command prompt because I can click around
a little bit.
It also has some handy tools for example a typology tool he's a little bit of a challenge to work but
we can make him work.
Let me zoom in a little bit.
And all this is doing is representing all the different systems on this individual land.
So it's got of pretty in the way that it just shows all this stuff.
Let me scroll it a little more if I can get this fish I have to bring up a little bit more he's not
going to play that's OK.
And I could actually click on individual systems and I can do whatever research I need to do on it.
What are reports and whatever.
Now that was a bad example but I can go through and look at all these individual systems and figure
out what's going on to see if this one little bit more interesting.
There we go.
So on that one particular system which happens to be my router I can get whatever information is going
on on that particular system.
So zen that is just a semi graphical and map and it is an incredibly powerful tool.
Now IMAP is great but it's not the only one out there.
In fact there's a lot of really wonderful absolutely free tools out there and I'm going to show you
one real quick let me close him out.
And what I have here is a wonderful free tool called Advanced poort scanner's is completely free it
works fantastic and it's kind of doing the same job that we saw with unmap or at least the Zen mat interface.
You can see that I've told him to scan everything from 192 168 4.1 to 192 168 for 254.
And this guy right here gives me all kinds of information for example I can click on a particular system
I can see what ports are open on this.
I can run tools there.
I could run an S-sh against it and see if that actually works.
So I can connect into something if I want to.
But the bottom line is is that I know all the different systems that are on the network and I also can
tell what ports are open.
So that's really what these type of network scanners can do.
So when you're using network scanners keep in mind there's going to be three big areas where you're
going to be using them.
Number one you're looking for open ports maybe not necessarily on one machine.
Maybe you are but these types of tools tell you all the open ports on all the different systems on your
network and then you can decide to do if you're doing a vulnerability assessment.
Well maybe you can use that as a way to attack a system if you're a network administrator and you're
trying to stop these guys.
This is where you can then go over to that system and turn off whatever open ports are running.
The other big thing that makes these incredibly popular is network inventory.
It shocks us how many times we don't know what's on our own networks.
Now I'm not talking about individual desktops and things like that but people bringing in smartphones
and people plugging in their own little laptops or anything like that.
Tools like this will find them.
It's got to have an IP address to be on the network and they'll help you with it.
The last thing you want to watch out for is what I call rogue systems a rogue system is generally any
system that really shouldn't be on the network.
That doesn't always mean evil.
For example it's really common for people to bring in an extra system and they plug it in.
It's just their home system and that could cause problems in terms of does that system have good anti-malware
whatever it might be.
So when you're thinking about these tools keep in mind of those different types of scenarios.