Hello everyone. Welcome back in this video. We're
going to be taking a look at service Vision detection, operating system
detection and how to perform various types of
Port scans with nmap. All right. So now that we've established what
IP address, our Metasploit Bowl
three virtual machine is running on. We can now start trying to
probe it for more information so that we have a better understanding
of what we're dealing with. Now, as
I said, we already know that the device is up and
we can now
begin with our first step, which is performing Port scanning on the
target. So if I run a default nmap scan, which
is simply typing in nmap and the IP
So that's 10.0.0.0 six and I just hit enter what
this can does it. It will scan a
thousand of the most commonly used ports. And
when we talk about TCP ports, we have about 65535
ports in
total. And what this can will do is it will
scan for 1000 of the most commonly used Port.
So that's something that you need to take into consideration very,
very closely. Alright, so you can see that
will tell us right over here. The host is up.
So it performs some form of host Discovery based on
the responses. It's getting back from the port's because in
essence, what we're doing is we're sending a syn packet, right?
And if the device responds within
rst packet, or if or, if
we don't get a response again, nmap is able to tell, well, is
that host up or not? So you can see, we scan
thousand of the most common ports, and it tells us for the rest
there, for the rest, which is 990. These
are all filtered or closed. So, the results were
Get back are going to be very similar to the results. We got back
in the previous can because we have pretty much not specified the port's that
we want to scan. Now. Let's talk about Port
scanning a little bit more. If I wanted to scan 1000
or 100 of the most commonly used ports
and I can do that by typing in nmap F4
and the f means fast. This
is a fast scan in that. It reduces the
amount of ports, the amount of ports that you want to scan.
We hit enter and then we'll give that a few seconds. There.
We are that took much less time. And again, this can be used
to some extent for host Discovery. But there we are.
We can see that it tells us the host is up and it's scanned. 100
of the most common ports and ninety four of them are going to
be filtered or closed. The rest of them are open which are actually
listed here. So you can see that included in
some of the most commonly used. Ports are going to
be, you know, really common services like
FTP SSH.
Server running on Port, 80 or Port? 443.
I also have an HTTP proxy running on
port 8080, so on, and so forth. So,
that is out about to specify a hundred of the most
commonly used parts. Now, if we want to specify a
custom range of ports, we can also do that. So if I
say nmap and I say something like,
I can use the P option. So that is minus B.
Again, specify a single port. So I can say, I only want
you to scan Port, 22.
And I hit enter, you can see it will tell us the host
is up and it only scans that particular Port. Now. I
can also specify a range of ips or more than one IP.
So I can say what 22 and Port,
443, right? Which again we can test for
and you use a comma to separate the posts that you
want to scan. I'm going to hit enter again. We'll give it a few seconds and
there we are. You can see it tells us that Port. 22 is
currently open. However for Port, 443
is currently filtered and that could.
By through a firewall or a
packet filtering system. And essentially, that
means that it's filtered or closed, which means we really do
not have direct access to it, or we can't communicate directly
with it. And that's the, of course, the conclusion that
nmap has come to so you can do that or you
can specify a range of board. So I can say,
I want to scan ports, 21 to
Port. Let's see. 88, right? So
I want to, I want to scan all ports, between Port 21.
And port 8080 are you can use the hyphen or
the minus key or the symbol here to specify that
and we hit enter and of course it's going to scan all of
those ports. So we'll give it a few seconds.
All right, so the scan completes and it gives us the results we
were looking for so you can see. We have it scanned, all the
ports, which is something you can see about eight thousand
and sixty ports between Port 21 and
port, 8080. And it gives us all
the results right away. So again, we're we're getting an idea of what's running
on the target. But what if we wanted to scan all
65535 ports?
Well, how would we do that? We can specify Port 1
to 65,535. How
Over what we can do is we can use the minus
P minus option, which means scan all
ports. So what we're going to do now is we're just going to
enter and let's see what it gives us.
All right, so the scan is complete and you
can see that it scans all 65535 ports
when it tells us that out of those 65
thousand five hundred and nineteen of them are filtered or
closed and it displays the rest of them to us, which
is again, very, very useful because now we understand entirely.
What we're dealing with in regards to the services that are running
on the target. So now that we've talked about Port scanning
in outer space of five Area sports, let's talk about how
to enumerate more.
From the target. So one of these pieces of information that
we are after is the service version that's
running and the service version of the service Banner gives
us the exact version of the piece of software that
is running on each of these ports. For example, if
we have an FTP Port running or the FTP Service
running, we want to know what version of FTP is
running. And that helps us as pentesters because we can
search for potential vulnerabilities or exploits that
exist for that particular version and that
that helps us understand how to Target, how to approach the
the actual Target and what exploits to
use. So on and so forth. And then another piece of
information that we are after is what operating system
is running on this Target, and nmap can do all of that.
So, to do this, all we need to do is type in and
map, and we can specify, we can combine commands
or options with nmap. So let's say,
I wanted to scan. Let's see. I
only wanted to scan. We want to run a default scanline.
That will only scan 1000 of the most common ports will say nmap
and to scan the service versions. We
use the - SV and the S is lowercase. The
V is uppercase and then we specify the IP address like
so and we hit enter. All
right, so we're just going to let that give us all these service versions
that are currently available. Now. This is going to take longer
than a typical port scan. Because now nmap
is actively trying to probe the
The actual device and its trying to get all the relevant banners,
so that it can actually again, understand or
it can actually deduce what versions are
running on those particular Port. So again, we'll just let this
can and I'll get back to you when this is complete. All
right, so the scan is complete. You can see took about 122
seconds. It's going to take significantly longer
primarily because it's going to try and
probe the target more as I mentioned. So if
we take a look at the results, and now they're going to be vastly different.
The results we got earlier where we only have the port. We
we only at the Port, the state and the
service. Now, we have the port State service
and the version. So that's the additional column that's added here.
Now, given that we only scanned 1000 Bots. It's only
going to display those results. So you can see for example on
the FTP Port, we have Microsoft FTP
D. Alright, so now we understand. Firstly, that we
are running a Windows box directly from that
and it's running FTP Dee really did.
Not get much information out of that. But for example, on the
SSH Port, we can see we have openssh 7.1 so
that can be used again for vulnerability scanning. And
we can then potentially find exploits. If they exist for
this version of openssh, you then have the
web server, which is running, Microsoft IIs, httpd
7.5, and then we have custom
services like, the HTTP proxy that are, that is
running sunglass fish and this is the open source
Edition this version for. So you can see
It's very, very useful information because we can actually
numerate actual versions of software that are running. And
then, before we actually start targeting the device or
performing exploit, we can again structure our
attack based on low-hanging fruit. So
again, these are the actual results returned to us.
Now, you can see, for example, here, it
tells us that one service is what was unrecognized, despite
returning the data and it actually gives
us the fingerprint here. So again, this fingerprint can then
Be used for future analysis to try and US understand what
what actually actual service was was
running here because nmap was not able to do to come
to a conclusion as to what was running. Alright, so that is service
version detection. And again, you can run this it is
recommended that you run this scan on all ports so that
it is as comprehensive as possible. So again, we
can then use the - be my the
- b - option. Now, let's talk about
operating system detection. All right, so the operating
Addiction is very simple. All we need to do is
specify 0 so that is a uppercase also - uppercase
o and will also include it with service version
detection and we are going to then perform the
scan on all the ports and we are just going to
hit enter. So again, it's going to tell me that right over here. So
TCP IP fingerprinting for the operating system, scan requires,
root privileges. So if your non-root user,
you want to make sure you use the sudo command, so
I'm just going to hit enter and it's going to
ask me for my password.
I'll just paste that in and the scan is going to complete now. It's going
to it's going to start now, and I'm just going to wait for this to
complete.
All right. So as you can see, the scan is complete and
we get the same fingerprint book from before. However, now
you can see, the results will remain the same regarding service
version detection. We take a look at the bottom here.
We have a new section or a new piece
of data that's added in. That is operating system details.
Now, the way in map will do, this is based on
the responses. It's getting from the target. It will
come to a conclusion as to what operating system detection, what
operating system is running and of
It's going to do this through prediction based on the signatures
that it currently has stored within its own database
or signature file. So, you can
see that from the operating system details. It
tells us that we are running, Microsoft Windows Server, 2008, or
2008 beta 3, it also gives us
other guesses like Microsoft Windows Server, 2008 R2,
which we know is actually correct or
Windows 8.1. So, typically, this is very is
usually going to be very active in.
In regards to giving you the correct operating system. And
again, it gives you a warning, right? If you're telling me that the
OS, scan results, may be unreliable, and
that is because we could not
find at least one open board and one closed Port. So,
again, it gives you an update of an idea as to how nmap comes
to these conclusions. Now, as I said, the most important thing,
he to take a look at all the first two
or three predictions because they are going to be, they're
going to be the most correct or the ones.
The highest probability of being the actual operating
system running. So in this case, we have a pretty good
idea that is running Windows Server 2008. And
of course given that we know Metasploit Table, Three, we
know that it's currently running Windows Server, 2008 R2.
All right, so that's something that you want
to take into consideration, but you can see where
we have immediately performing just to scans. We've
been able to get a ton of information from our Target. And
now that we performed a comprehensive port,
Can or that we scanned, all the ports. We now have a
pretty good idea of what's running on the actual Target
in regards to service versions and the current
open ports. And we also know the operating system that's running
which means we can. Then start performing or looking
for exploits that are targeted or designed for
this for these particular versions of
Windows server. And of course we can. Then Target
the surfaces will be looking at all of this in later modules of
the course. Now, before
Actually close off this video or I end of this video. I
just want to take you through some very, very useful tidbits
or tips that you can use with nmap and
one of them. And that's going to be extremely useful is the
ability to Output your results into a file. So,
for example, I'll just head over to my desktop here. And
if I open up the Man pages for nmap,
and that can be done by simply typing in, man, and
map. And I scroll to the bottom here. You can see
that if we go right at the bottom,
Mm to the output here, you can see that we can output our
scans two different types of files and we have a
normal output which is going to be displayed exactly
how it displays it on to the terminal. We
have XML format and we have the script kiddie format
and the groupable format. The three, most important formats.
You're going to be using going to be normal XML and
the grip herbal format, which can then be used with a command-line utility
like grip and you have all
the options here. So for example, if I
To Output the foil into a normal file
out. Use the 0n option. If I wanted to Output into an
XML file. I can use 0x and XML, files
are useful. If you want to parse the information into a
web page or into a report, and then, of course,
you have the OG, the OG option, which will output
into a grip herbal format. So for example, if
I wanted to Output a simple scan Soul,
say nmap, F only want to scan a hundred of the most
common ports and I want to perform some service version detection.
So you can see how I'm combining scans here. It really is fantastic that
you can do this with any web and then I provide the
IP here and then I say o n. So that
is a - lowercase o and an uppercase n
and then I specified the actual file name so I can
say nmap dot txt right.
If I wanted to Output into all formats. I
can then simply type in 0 a and that will output it into
all file format so I can also do that as well. And
then I get rid of the extension here and I just give
They file names. I just call it nmap scan and I
just hit enter and that is going to perform the scan and is
then going to Output this scan into these three formats or
three or four formats that that we
can actually use for, you know, generating reports.
We can use it for reference or to
access later, so that we don't have to keep on running our,
our scans to actually analyze the results time
and time again. All right. So again, we'll just let this
run. Alright? The scan is
complete.
Complete and again, it will display the information to us on the terminal
but if we list out the files in our, in our current
directory, you can see that it outputs into the gray
purple format, which is G and map and then outputs into
the normal n map into the normal n
map output format. And then we have
the XML file. So, if I kept the contents of nmap scan,
the nmap, you can see it
actually displays exactly what we got on the terminal. So this is
again, just human readable information.
Then of course have the XML output so I can just say
nmap scan dot XML and you can
see that that is indeed in XML format. Which again is you
very useful for generating reports or for parsing
it into the web or into a web page. All
right, so that is how to actually specify your output options. And
again, I'll just take you through some other really, really cool features
that you can use with nmap. All right. So what I'm
going to do now is we'll just run the same scan that we run before and
let's talk about verbosity.
In terms of what is outputted to you on the screen. So
when we talk about what is output to us on
the screen, you can see that when we hit enter without specifying
the amount of verbosity and map,
does not display anything to us. Any diagnostic information
to us as the user, if we wanted map to
actually display and to actually State what's going on in
the background before, it actually delivers the results, we
can use the minus V option and that is lowercase V.
So that is level one of the Bow City.
We can also use level 2 and level 3 to
give us more information. So again, if we can
we can we can run that command the way it is. However, if
I just open up the Man pages and I grab and
I say, I'm looking for, let's see,
just use the Expression option and I'm looking for the
Bose, right? So you can see it were both hit
enter. You can see that if we take a look at the Man pages.
We use the normal output in verbose, we use the V option
here.
And then if I look for verbosity.
Just hit enter. You can see that we can increase the verbosity level
by using more Visas, so we can specify
more V. So again, you can also do
this by specifying V1, V2, V3, Etc.
In my case. I would I really like
using just one or two v's. It just gives me just enough
diagnostic information that I need. So
again, I can just hit enter and now you can see that
it's actually displaying what's going on in the background and
now nmap is coming to its.
And the results are being delivered to us life. And
then, once the scan is done, it will give us the information that
it actually was able to get so you can see right
away. It starts the DNS resolution and then
completes parallel DNS resolution and then it initiates the
connects can the TCP connect scan and
you can see it discovers an open port on port. 8080.
It discovers an open port on Port, 80 Port,
22, put 21. So on and so forth. And
then it's going to move on to the next stage, which is
Service version detection. So it actually runs the scan chronologically or
in order. So you can see first of all
it actually performs some host Discovery. So it initiates
a ping scan it then performs a your parallel
DNS resolution it then goes on to scanning for
ports, which is we specify the F option. So
only 100 of the most common ports. We then move on to
service version detection. So it's going to scan six services and
then it's going to essentially going to Output the
results to us and immediately, it did that for.
Write a vso. Now. We have an additional column
that is called the reason column which actually
tells us. The reason it was actually able to
come to these conclusions. In this case. We got a cynic in
return, this particular scan utilizes,
a TCP connect scan, which with
which again will typically utilize
the TCP 3-way handshake, where you
nmap will send a TCP syn packet. And
then based on the response, if it gets a sin.
Tack. It means that particular port is open. If the
port is closed, it will get an RS t or a reset packet
telling nmap that is closed. So, again, that's just a
few tips that you can use in the event. You want to learn more
about and map or you're trying to understand what's
happening behind the scans or in the back end.
That being said, that's going to be it for this video and I'll be
seeing you in the next video.