Hello everyone. Welcome back to the windows pentesting Essentials
course. In this video. We're going to be taking a look at Host Discovery
with nmap. During the previous section. We
actually took a look at how to create our virtual hacking
lab, which is a nap Network and we
very briefly took a look at how to actually perform host
Discovery with a utility called net discover
or whether we're going to be using a very very powerful tool
called and map which allows us to perform a variety or
a plethora of things or tasks in regards to
Scanning on network. One of them is host Discovery. Now, in
the following videos, we'll talk about performing service version
detection, operating system detection scanning for vulnerabilities,
etc. Etc. Now, the current virtual
machine we're going to be using in this particular module is
going to be met exploitable 3 and we're going
to be scanning it. And I'll be showing you how to perform the very the various
types of scans with nmap. So this video is
going to be focused on host discovery, which is really, really simple.
So our job now is to actually
Discover what IP address. The Metasploit able three virtual machine is
on. Now with nmap. You can pretty much run
a variety of scans to test if the device is
online, but the one I'm going to be showing you is the Ping option and
of course, you can also run the don't being option,
which is great. If you don't want to perform host
Discovery, but you want to perform Discovery by
actually performing a port scan, which I don't recommend if
you're still in the scanning phases. So again
to perform our scan, all we're going to do is type in
Map and Alden say s n that is the Ping option. And
then we provide our Network, IP address or
subnet, and we can specify individual IP
addresses. So for example, I can say 10 10.0.0.0
one, which is the Gateway,
the default gateway or the router IP
address and we can hit enter and you can see
it will tell us right over here, nmap scan report for the IP. The
host is currently up. Now. You can see the very important thing
with the ping. Only option is it does not.
Not perform Port scanning, which is very important.
So that means that this is going to be very, very useful and effective for
scanning targets and discovering whether they are currently online.
So to scan an entire network subnet. We
simply say,
And my s n.
4/24 that was the subnet that we
had created. And again, we can specify the actual
subnet range, or you can specify the range of
IP addresses. So I can say, 10.0.0.0 1
to 255 and that will scan the entire range
of 250 for IP addresses. Whereas
also for using the forward slash 24, option
will scan, the 254 IP addresses. This
is going to scan our virtual hacking a lab Network. We're
going to hit enter.
We're going to give that a few seconds and there we are. You can see immediately,
we get our results and with the ping scan. It
is only going to perform the scan. It's
only going to display the the actual devices or the
hosts that are currently up. Alright. So for example, we
have the default gateway of the router, mean it tells us that, that is
up. We have the DHCP server running on
10.0.0.0, which is also up. And
then, of course, we have 10.0.0.0 six and
ten point zero point, zero point nine. Now, if we check
Our current IP address at
least in my case. You can see that the Kali virtual machine is
currently on 10.0.0.0 nine. So
that means that the Metasploit of old three virtual machine is
currently active on 10.0.0.0 X.
All right. So what we're going to do now is I'm just going to take you
through how you can also also run the don't ping
option, which again is very useful. If host
Discovery is being blocked by a firewall or
by a, by a packet filtering system.
All right. So what I'm going to do is I'll just clear that out, and we will
try the same now, but we, since we know the IP
address of the Metasploit Table, Three virtual machine, all
we do is we're going to say nmap and we use the PN
option. So that is uppercase p and lowercase n
and this is going to avoid any type of
host, Discovery. Remember, it's not going to check if the host is up
its going to start targeting ports. So I'm going to say PN.
And we're going to specify the IP and I'm just going to enter. So
we'll give that a few seconds. And the way this works is it's going
to perform a simple TCP scan or
on the ports. And you can see right over here. It performs
the actual port, scan, and it tells us right
over here, the bottom nmap done. One IP, address, ask
and and one host is up. And, of course, we know that
it's up. So it's going to scan a thousand of the most common ports that
you typically find and immediately gives us
the port, the state and the service. So,
Can see we have Port 21. 22, Port, 80 running soap,
FTP, SSH and HTTP or a web server
running respectively. So, again, now that we've established what
IP address, the Metasploit about three virtual
machine is on and what IP address it is,
is actually assigned to. We can now move on to
the next step, which will involve performing service version detection,
operating system detection, Etc. So that we can
learn more about our Target.