Hi, and welcome back to the Deep dive in
Natick assessments, by easy console. This is
Section 3. Hands-On with network assessment.
In this video. You will
learn how to perform Network on Port scanning.
So let's try phone. So what
exactly is coming to put? Simply scanning? Simply
allows a cybersecurity professionals to discover
Life host alive systems or
devices on a network. It also
helps to identify or profiled
identity of the operating system running services
on even open ports
on Whose devices.
Fillmore. It can also help you to
identify any unauthorized devices
that may be connected to your network.
So let's dive in to get a better, understanding on how
to perform Network scanning on
discovering open ports are running
services.
So log into Kali locks and let's
click on it to know. I'm going
to make this a little bigger so you can see a bit more properly.
Bright Water first and
so do you want to do a super form passive information-gathering
but just before we do that,
let's check to see what's all IP address on A1A to it. You
can simply do I have concert at
it answer and it will show you all your
network adapters and IP address on that. Particular
doctor. I'm actually
using e t h which is eaten at
one in the face. And this
is Anatoly that I'm connected to right now. The other
end, the phases does not have any IP addresses Crystal.
Centerpieces are disabled.
Another technique. As you can use IP addr
on breast center on. This will give
you a summary of all your interfaces and their
corresponding IP address. So you
can see for ETA is 1.
It's 172 TT Wonder
20/24.
So that's actually begin my Posse cut. So
let's begin by performing passive
scanning, we can use it to such
as an ad discover Discover. It
was simply listened for any sort of Erp Pockets,
or Erp messages on
as you know that they are P. Address resolution protocol,
will contain IP addresses and
a corresponding Mac address to perform
this task. We can do sudo, net. Discover.
Josh r.
Unspecified our network ID,
which is 17223. One
third, series, 24, and it
answer, if it ask, the boss would simply
enter the password, you use to login to call Xanax and
it answer once more.
I type my password wrong and
type it one more time on this to
take pops, a few seconds to a couple
of minutes so I can show the results. So now
the results are back. We can simply see that there
are three phases connected. There's a. One
which is most likely, the default heat. We dance. 21.
There's also the 23
we also goddamn Mac addresses and also
give them the tight. So without even
saying, proves on a network, our system simply
listen for Bruce, which is pretty cool. Actually, because this
is a technique of passive scanning. We don't rely on
something, prusso to patiently, wait for other systems,
to send a r p messages across our local area
network.
There's another way we can perform is coming
as well to quickly identify. Let's see whose systems
one in at work. Before we do this. Let's
just get our IP address once. More on all
wipees. 1722, 81. 20
/. Capitis.
What we can do, we can use and mop now.
So, I'm up. As an to perform at things,
can Alice performing things,. No one
at work. However, less exclude, or IP address, so you
can do. Josh. Exclude.
I'm simply specify the IP
address of your taco. Machine is answer. And this
will perform a pink sleepover things, kind of
grows on a two-week. So, in other words, I'm talking machine
is using a map to San icmp messages
across the entire, some nut
and devices that response to our machine. It
will appear in the sky result. So as
we can see 172 281
the 21 responded and also
want someone to TT on the 23 responded.
So they'll be more specific when we actually have
two active systems when I, when I do it with the
exclusion of our attacking system.
So let's say we take one of these
systems to be, let's see all Targets. What's copy
this one? And I just want to use that 21
as an example. So to perform a
port scan on a Target, we can use
a map. Unspecified IP address of our Target.
This will do. It was kind of
tough 1040 off the stereo system and
provide results to it will provide
results to us, so too, but simply, we
can see in number of portal pain. And you
think about this gun is, this can use
this TCP connections by default. I'm not
scared for you to be bought. So all the ports. Are
you see in the sky on artist Vives? You can
see the status of one and we can see the service that
is associated with a particular Port, Orange, purple,
this poor 2283 port
and it's running the SSC service.
Another example is we can see poetry 306-0186 report
on its using MySQL to the
mall. If you want to get more specific information, we can
simply use a dash a parameter and
dash. He will allow us
to perform.
A port scan, it will also help us
identify the operating system of or Target are
also to see this version enumeration
while be sitting in
your sunglasses, on his will perform basic strips coming
and I will
take a look at the results once it's completed.
Cenotes cars, complete. Let's take a look at
analyzing the actual results. So before we
only had the port number to portabella cease,
will you repeat the poorest state on the service? However,
we actually got to switch on so
you can see here for poor 21. It's Ronnie FTP, but
specifically, Microsoft ftpd. You
notice here, that under, and
then expect or oriented cut
all the indentation area. It tries
to do monogramming, to give us more
specific information about as he was running.
For example, we can see SSH but
it's running openssh 7.1 on
a protocol aleutians 2.2. And we
have their sausage public keys, or the
web service, which is 140 t, of course,
astronomy hdb. But in this case, it's using
Microsoft is each DVD 7.5. Provide
some of
the sleepyhead Aintree Mission force will get
additional information such as to Which Wich
on each particular service. An open port. And
Mom is able to identify, but keep in mind that the
default on maps car performance. Can only do
the top 1,000 votes.
We don't see that. Here. It is able to perform basic
strips coming to help identify the target operating
system. So we don't even knowing the
target operating system prior to the scan. And Mom is able to
help us identify to Target. So
we got a netbios name. We
can see the sea is the name of the system which is Bargain Hunt.
2008 are too, so we can get
the MAC address. It's running in virtualbox. So
it detected a MAC address which is the flu's
24, bits of the MAC address to be
identified as a blue. Trollbox, buchona to confuse God.
So he notices which language, she was able
to do SMB, vs. Coveri to
help her file operating system so we can see
here the OS, it says Windows Server. 2008 R2
standard, we have the
bill number, which is 76017 Service
Pack 1. So this means as a
tractor or let your ethical hacker.
Faster, we'll be able to look
for vulnerabilities on the Internet by do not destroy
our research, identify whether there's any sort
of known vulnerabilities and what type of
a play, some may be best suited to take advantage
of two security weaknesses. We can
see down here where it says, computer name,
/ netbios name of the group, what is connected to a do mean
boy, with group? So, simply by showing it's a
Wood Group. It is independent. It's not connected to
a Windows Active Directory. Do mean we can see the system
of time. We can see what it is and he sort of
SMB houses on SMU. Super
message block is used to provide file
on sharing Services across 80s, VIP
Network and additional
details of the world here.
Having completed a section. You have to learn the importance of
Performing Network scanning. I have also
learned how to use a map analyst only discover
to perform both passive and active scanning
of a Target. The whole Salud. How to profile
a Target? Identify its operating system
on any services and yes,
it was versions of maybe running on the target device. In
the next video will take a look at
explore and fears. Icmp proven techniques. I
hope this video hospital for me to see you and I
will see you in the next one.