Hello, my name is Stephen.
Welcome to another awesome lecture of Nmap.
Nmap is a versatile network scanning tool.
It's widely recognized for its exceptional capability to not only detect the open ports, but also identify
the operating systems and services running on remote hosts.
So this recipe explores the process of fingerprinting, operating systems and services using Nmap,
providing valuable insights for security assessments, vulnerability detection and network monitoring.
Terrorist detection is a crucial feature of Nmap that unveils detailed information about the specific
software versions running on a target host to enable service detection include.
You can include the SV option in your port scan command, for example.
Nmap, nmap sv and here you can enter the target host here.
In this case, let's actually scan the code sally.com.
And here by employing this SV option, Nmap initiates service detection and augments the scan results
with additional column named version displaying the precise software version associated with each detected
service.
And here now we are waiting for let's actually and as you can see you can by using the arrow here arrow
keys.
You can see the process here.
And here let's actually learn my open my windows machine on my.
So I opened my windows machine on my.
Uh, virtual machine here.
Now, what we're going to do is.
Scan all the hosts to find that open here.
Parsley and here.
Say that.
And our scan is almost complete.
It's 81% here.
And here are operating system detection is ended here on console.com.
And here as you can see here we are seeing the domain here with ports and so on.
We have next service fingerprint.
So when performing a port scan with a service detection enabled in Mac Nmap furnishes us an extensive
report on the identified services.
So the service version information is enclosed in parentheses here.
Red Hat Enterprise Linux six.
So let's consider an example where we can where we can well known scan and mapped at all costs here.
And as you can see, let's actually read this.
And here we are seeing some information here, fingerprint, open ports and their versions, their services,
lightspeed, so on.
So this gives us a good.
Insight on what this posting is using in this case, for example, XML, Smtp smtpd 4.95.
In this case we can search exploits for this.
We can also search exploits for this.
In this case it's a red hat, but in most cases it's actually pretty secure.
But nothing in nothing is unhackable.
So.
And here we have XM Smtpd as well.
So here let's actually use the Nmap.
Scan me here, let's clear and now Nmap sv again.
Actually if we use the sudo it will be much pretty good here.
Nmap scan me.nmap.org here and nmap sv.
To though we forgot to write Nmap here.
Nmap is face scan.
Org and.
Here.
I'm sorry.
Here, we will see an output here, which the output showcases a comprehensive list of open ports along
with their corresponding services and versions, aiding in identifying potential vulnerabilities and
monitoring software updates.
So here we are waiting for this.
It's actually and here, I think 16% is done by now.
Let's check it again.
Let's say it's 18.13 here.
So while scanning this actually use another here so we can also enable the operating system detection
here.
So in addition to service detection and Map offers powerful operating system detection capabilities
to activate the operating system detection, you can include the uppercase or option in your scan command.
And keep in mind that running Nmap with operating system detection requires privileged, privileged
user access.
In this case, we will use the sudo here again and sudo nmap here and operate uppercase o and here we
will write code solely code Silicom and then here.
That's it.
And here are scanning is complete by now.
You can see the server again, the services and here we are and provides a.
Output here or scan results may be real or unreliable or unreliable because we could not find at least
one open and one closed port.
And here aggressive operating system guesses is action tag this here we probably servers and it's probably
to windows in 1997 present Linux 94% 94% and VMware player virtual net device here so no exact operating
system matches for host.
So here we can also scan the our localhost.
So I have Windows 10 machine on my network 1333 here and now we are going to scan this.
So because of the, our Windows system, so our target system in our localhost, it will do much more
fast.
And here, as you can see here, it's guessing Microsoft Windows 2019, which is Microsoft Windows 10.
And here aggressive guesses is say they are the pretty same here, but that's it.
So this is how operating system guessing works.
So the actually let's actually I want to also tell you something.
Let's actually run it again.
So this upon enabling the operating operating system detection Nmap appends operating system related
information at the bottom of the port list in the scan results, as you can see here and here, Nmap
service detection is facilitated by the SRV option operates by dispatching a series of predefined probes
for the Nmap service probes file to the open ports detected during the scan.
So this probes are selected based on their likelihood of identifying a specific service, taking into
account the port number and rarity score.
So service detection plays a crucial critical role in various scenarios such as vulnerability assessment,
service verification and patch update assessment.
So similarly, the operate minus O option here empowers Nmap operating system detection features, so
it achieves this by sending probes to the TCP, UDP and ICMP protocols against both open and closed
ports.
So Nmap is a vibrant user community has contributed an extensive collection of fingerprints encompassing
diverse systems including residential routers, operating systems, IP webcams and various hardware
devices.
And it's important to note that operating system detection and necessities, raw packet manipulation
requiring Nmap to be executed in privileged mode so Nmap adopts the common platform.
Common platform enumeration CP naming scheme.
So while the embraced in the information security industry to accurately identify services and operating
systems.
So this standardized convention facilitates precise identification of a packages, platforms and systems,
streamlining vulnerability assessment and risk analysis.