Welcome to our first exercise, NMAP Host Discovery.
And I'm your instructor, Josh Mason.
I'm going to jump into the environment.
We have a Kali Linux desktop and the browser.
It gives us his target IP address.
And let's see if it is 10.4.28.137.
And we're not getting anything back.
Four packets transmitted, zero received.
That's strange.
Let's do an ARP scan on that same IP.
10.4.28.137.
And no response.
Well, dang.
Well, let's just run an NMAP scan
and see if that does anything.
And it says it seems like it's down.
But it's really up, but blocking our ping probes.
Try tack, Pn.
Well, we were given target IP.
It would seem silly that they would give us
an environment and a target IP, and it wouldn't be reachable.
So let's try it with the tack, Pn.
And this is going to turn host discovery off.
It's just going to assume that it's there.
And it's going to do the rest of the port scanning
that it normally does.
Oh, and there it is.
I got 80, open.
Usually the web server.
445, microsoft-ds.
That's a guess.
Based on 445, it could be a Samba server for all NMAP nerds
at this point.
But we know it's there.
Supposed to do 80, 135, 19, 445, 3389.
This is a good sign that it's a Windows machine.
And by the way, based on those results, we'll run the scan.
And we'll hit services and operating system.
Now we're looking for the ports under 1,000.
So there's 1, 2, 3, 4 of those.
And there it is.
We've got a Microsoft Windows Server 2012.
And that is backed up.
Again, it says, Microsoft Windows
Server 2008 R2 or 2012 for this SNB 445.
That, along with the operating system enumeration,
pretty solid.
And that's where it is.