In this exercise, we're going to look at Zenmap on a Windows
machine.
So we have our vm, and it has a maps Zenmap GUI.
While that loads, let's see what our IP address is.
We are on a 10.4.25--
no, not 25-- this is cider 20.
So 10.4.16.0.
An easy way, look at the gateway.
Here is Zenmap.
We'll put it in our IP range 10.4.16.0 cider 20.
And you can pick your scan profile.
Let's just do a ping scan.
And we see it's nmap -sn, and our IP range, our subnet
that we gave it.
So we can run the scan.
And we got our results as if the command line
was in verbose mode.
You can add verbosity to the output
because this line right here can be edited.
And we get a host [INAUDIBLE].
And what we could do is we could pick out of these new targets,
or we could try a more intense scan.
Let's just go with the normal intense scan.
It's a tack T4 and aggressive and a -v. So it'll
run operating system enumeration,
service enumeration, default scripts, and a traceroute.
I'll let that run.
Let's look at what happens over here.
So we have these hosts.
We've got a nice little list of hosts.
And we have this topology that we've
looked at before in the lesson.
These are all the different IP addresses and how they're
connected to us by one hop.
You could look at host information
once we have operating system and services enumerated.
Not there yet, but it's getting there.
Or we can look at the history.
All right.
Now it's starting the service again.
Operating system scan, and then an -sc, which
is the Nmap scripting engine.
All right.
Scan is complete.
Now, we can look at some of our machines.
Let's look at topology.
We have a little bit more breakdown.
We can always move this around and pick out different hosts
to look at.
I'm more interested in these host details
because we can really dive in.
Some, we have nothing.
It doesn't really tell us much.
We could look at ports, but they don't have much.
These two, on the other hand, a whole bunch of Windows
ports on them.
And the host operating system information
says they're Windows. [? That one ?] is
server 2012 and 89% accuracy.
And it does that based off of the ports and operating system
class.
OK, useful.
And then this one is just showing a Windows 10 vm,
Windows 10 machine.
And that's based off the signature itself.
And that's what you get out of the Zenmap.
You get a nice little GUI.
It can be useful.