Hi and welcome to the Deep dive into Network, assessments
by EC console. This is
Section, 1 introduction to network.
Security Assessments in this video,
will take a look at exploring Network enumeration
on scanning techniques. So, let's Dive
In.
So what exactly is coming to put?
Simply will you scarring to discover Life? Host
will I devices on a network?
It's Cynthia, Lowe's cyber Security
Professionals Network Security, Professionals an
event ID administrators to identify any
sort of open service ports on
a whole system. Whiteline device scanning also
helps us identify any running
services on Evelyn profile, the
target operating system some scanning techniques.
I also use within the network security industry
by professionals, to identify security
weaknesses, such as vulnerabilities on
a system, within a network using scanning
can be beneficial to an organization such
as detecting. Any Roku devices. I want
profiling systems.
Is subset of scanning is known
as Innovation, Innovation, simply allows
a cybersecurity professional to Godda. Let's
see the usernames and even the user groups
from the target system ID professionals, within
the industry, can use an immersion techniques to
easily discovered that old chairs which
are, let's see, accessible by any owner
tries. You just want the next week. This is a really bad
thing, simply because you don't want any sort
of malicious users or threat actors to gain
access to your file shares, food. Amore numeration, can
help ID professionals to retrieve to
serve running Services, routing table
running applications on Yvonne Carter. The
body inflammation, Sunday Services know that.
You understand, the concept of scanning an enumeration, what
size engine do some practical exercises?
In this exercise will be
using Kali Linux as a taco system, and
will be using metasploitable 2 as a
victim system.
Now, let's open a to know unless you buy
Pedder command to identify or network address.
So now that we know the network are we connected to which is
a 192 168 241 and
a wipey * 20 to the
network ID will be 192 162 41.0.
Next. Let's
use the net discover command together
with Dash are within network ID. To
identify, any sort of lets the
devices which are connected to our Network.
This process usually takes a minute or two to
complete because this tool simply listened
for any sort of address resolution protocol Pockets
or messages, which is ARP messages, on
a transverse singing at work on identifying their
IP addresses.
As you can see, it has identified two
systems on a network is in the two I. 19.
We also get their Mac addresses and their
vendor identification.
Next, we can use a map and we
could use a dash s n switch to
actually do a ping on a network. So to
put simply Dash as an will some
PLO at Maps actually do with pink sweep on a network. So
am I fixing to setup thing to or something
at work and actually record the systems which
respond
So here we can see we have. 1920
as well. Remember the
20 is all Kali, Linux machine. On. 19
seems to be our Target, which is Metasploit
a little too.
Next, let's use and map on. Let's
specify the target IP address of metasploitable
to this will simply allow us to see. All the
fun boats are states and their services.
The thing about using a map as
it is to Scarlet sea in network.
Even let's see a single
IP address, its concept top 1000 Sports
on the target to self. So therefore
doesn't scan the. Entire range of
metal posts, such as 65535 for
the top 1000. Watts. Something
to always remember next. Let's use
a mop Dashie to perform an
aggressive scan on using that he will
simply allow us to identify the operating system.
It will to service a
mini version.
It will also perform basic scripts coming
to identify again. Breathing system. Using various default
SMS groups. Will you stash
tea for, to perform,? Very
fast,, but not too aggressive
or not too noisy and will
specify. Let's see - P -
12/3 scan all the votes. So, pretty
much what does e -
34. + - P - will do.
It is going to perform an aggressive scan very
quickly and scan all the six
5535 ports on this.
19 system.
Cenotes Carlos finish, let's take a
look at our results. Let's start from the top. We can
see. Poor 21 is open, as we knew
already on. This is wrong FTP, but I'll
look, as we can get. It serviced version, which is
vsftpd 2.3.4 information
to
events, which have honorable teased about the solution using
Google.
We can also see the FTP server status
and Emma was able to perform some type
of connectivity to the and mop service.
We see SSH is open.
Together with his service which I'll just open as a c h, 4.7 P
one on a TV on or are you going to
storm? And it is running protocol to point to the mall.
We can see additional Services running
such as SMTP, we can see the bottom
half was able to retrieve going on. We're
able to actually in numerate the operating
system. So here we can see, it is
running a type of lettuce. Only
flavor of Linux top is, so we
know definitely by profiling operating system.
Here. We are able. To, let's say,
for example, if you were looking for exploits, we know we need
to eat a develop. All the fun exploit.
That is used to Target in Lennox base, operating
system.
The default assembly scripts able to
identify assembly version together with operating system
and whose name?
To get more information on how to use a map. We
can use some on space and Malcolm on and this
will provide us the manual page for a map.
As you can see, he had
different switches and you're able to get a description of
how to use the switches and their rules and function.
Play the more you can use it and Maps piece Dash. Help.
Come on as well to actually get the same
type of information, but muscle on how
to actually use the tool to perform your various accounting
techniques.
Now, let us move on to using Metasploit to actually
perform enumeration to get started
on a 2-mile simply type msfconsole and
hit enter.
Simpsonill a mask on. We were able to identify evolution of
smbs running to filter. Any
metal suede, mules, that will help us identify the actual
version of SMB. So you can do
is search SM, be on the skull version and hit enter.
And as you can see, it return, the
auxiliary Scana SMB. SMB on the school version.
Mario Mario, as a description size,
is it simply identify a
profile of Lucien office and Beyond the target system? Now,
we can use use command together with
the name of the module and hit enter. Next.
Let's type of options to see
what options open photos. I needed. You can
see, we required to our host to our
host, is simply the target system. So, now,
we'll need to set. The are whose value we
can use the set Aarhus command
to get over the target IP address on.
This is the IP address of all metasploitable to system.
Once we started, we can use her options command
once more to actually determine what
are the value set on here? We can see the
value set.
Launch on auxiliary mode. You, you can simply use the
wrong command or exploit come on, but we're
going to use you as a run command.
As you can see, tomorrow, you'll run.
It was able to eat a cat's MB version 1
on a Target system. And it
gives us a little bit of information about, who's the
top sweetest thing. The hose cannot identify, but it
seems to be a Unix base system.
Next, we can use it to such as
a zombie map to actually identify if there's
any files who shares on the target system for this
to we're going to use SMB map, each
followed by the IP
address of the Target Center.
Yeah, we can see list of available shares their
permissions on any sort of comments.
If you look closely, you can see that there's a 10 folder TMP.
At the permissions are read and write. This
means to say we can read the data from the
share and even righted the ship. However, the
other shares and not accessible.
To read the data within the timeshare. We
can use the assembly. Each command followed
by the Target, IP than -
are on the name of the target folder and Otis.
We are able to read the contents of the
solar.
In this video. We took a look at discovering who
systems on a network using a map. I
will also take a look at using Metasploit to
perform in numeration on Network Services.
In the next for you will take a look at identifying
vulnerabilities on in at work on assets.
I hope this video has been a phone two for
you and I will see you in the next one.