Welcome back.
Let's continue with our what we took.
So in the previous video, we only saw how we can perform the basic stealth scan on a certain website.
Another thing that we can do with Fastweb besides testing a website, is to test a range of IP addresses
all at once.
So if I open up my terminal.
And I type what would that help once again to list out all of the available options and scroll all the
way up?
Here under the targets, we can see that we can specify your host names, IP addresses, but we can
also specify IP ranges, we can specify them like this or like this.
Now, to test this out, I'm going to scan my entire home network and to know what range of IP addresses
should I scan for my home network, I could type down here, command I've config or pseudo config since.
Remember, this requires route privileges.
Press, enter, enter our password.
And we can see that my IP addresses what I did to that 168 that found that four and what's more important
than the IP address in this case is the net mask.
And my net mask is two fifty five to fifty five to fifty five dot zero.
The subnet mask right here means that only the last octet of my IP address is changeable, which is
this last number.
So these first three octets or these first three numbers never change in my whole network.
This also means that the range of IP addresses that belong to my network are going to be from zero to.
So basically, the range of the IP addresses that my network can have is this one eighty two do sixty
eight that one dot zero.
To 190 to that 168.
Not one, not two fifty five.
This is the range of my home network.
So let me scan it now for you.
It might be different based on what type of network you got, but in most home networks, the subnet
mask is going to be this one.
Therefore, just the last octet will be changeable for you.
Now, before I actually run the scan, I don't have any websites hosted in my home network, but I do
got some devices running.
Something on Port 80 and Port 80 is in deep port that websites used to host their pages.
So we should still get some result from scanning my network.
Let go delete this and type what one.
And then the French, all my whole network.
Let us go with one to one idea to that 168 dot one two fifty five.
So this is the range of IP addresses that I want to scan and all of them belong to my home network.
And the good thing right here is that I can use whichever aggression level I want since it is my own
network.
Let's test out aggression level three.
To do that, we can specify dash, dash aggression and then three.
After it, we can also specify the dash of option to better output all of this and let's press enter.
You will notice we are getting some of the results, but there is a lot of this error happening on the
screen now for this area right here is let me just control C, since we're not going to wait for this
to finish.
And what this error is, is all of the hosts that it tried to scan but couldn't manage to.
And the reason why it couldn't manage to scan these hosts is because they do not exist.
I currently only have around two or three devices on my home network and all of these other IP addresses
are out of use.
So let me go up here to see what it found, it found the result for the IP address, 192, that 168
that found that one.
And this is my router down here.
We can see all of the plug ins that it managed to detect for my router.
We can see an interesting plugin which is password filled, this is something that we would write down
since any password that we find we can use later on in something like a brute force attack to try to
guess the password and try to brute force the login credentials.
But nonetheless, this is just a router, so we're not really interested in it at the moment.
This is just an example of a test of how it would look like.
And since I don't have any website on my home network, it didn't really give much result.
We can see right here.
Here is another IP address that is active.
It is 192 DOT 168 at 110.
And this is an IP address on my laptop, which is currently up and running.
It detected this FTP server on it, but it got this status code of four or three forbidden so it is
not allowed to visit that page.
Therefore, this is as much information as it's managed to get and all the other ones down here are
simply just offline.
Now, if you don't want this outputted, this text, you can use the same comment and at the end at
Dash Dash, no errors, but this no errors option does is it simply just doesn't print these offline
IP addresses?
Let's test it out.
If I run the same comment just with no errors, you will see we are not going to get any red text anymore.
It will only scan these to live IP addresses, which is my home router and the laptop.
And that is basically it.
That is everything that it will output.
OK, so it took just a few seconds to finish and keep in mind that since we are running level three
of aggressions, can it will take a little bit more time to scan something then with level one, since
it is performing a deeper scan than just did level one stealthy scan.
OK, so if we ran this comment and we use the aggression level three, we use that to output all the
detected plugins as well as their description.
And we use no errors to not print out these offline IP addresses, but what if we, for example, wanted
to save this output that we got in a file for some future references?
Well, if I type the comment, what web does this help?
And I go through this health plan once again, I will get to this part, which is logging.
And down here, we can see that there are a bunch of options that we can use to log our file or to save
our file, so let's just go with the first one, or we can even use the second one, which is to log
verbose output.
To do that, we use this option right here and then equals and then the file name that we wanted to
save.
So if I go down here and another useful comment, once you have a bunch of things happening in your
terminal and buy a bunch of things, I mean, just a bunch of text printed out, what we can do to get
rid of this is run the command, clear.
This will clear our terminal so we get much cleaner.
Look, now you press our Pereiro to find the comment that we ran previously and at the end I add lock
and then dash for both equals.
And here I can call the results, for example.
If I press here, enter now, you will notice that both sides of this are putting it to the terminal.
It will also save it inside of a file.
Let's wait for this to finish to check out the file that we got.
OK, so it finished let us clear the screen once again, and if we type s right here, we will see our
results file.
Let's lower the terminal and open this file to see what it got saved and find a logit, we will see
that we got our results saved for both IP addresses, for my laptop IP address and for my route right
now, for your scan.
If you send your whole network, you will probably have more devices or less devices or you might not
get any result in case none of your devices is having an open port 80 or in case none of your devices
is running in HTP server.
So don't worry if you didn't get any device.
This is just an example to see that we can even run the ranges of IP addresses and to test out this
aggression level triscuit since we can only do it on the websites that we own or have permission to
scan.
OK, great.
So look at all of the commands that we crafted with all of these options right here.
And this is just a part of this, what you don't need to be learning all of these comments, you can
always just from the health comment and read through its help menu to discover what you want to run.
We will be going through all of these options in what we do, since there is too much of them.
But I encourage you to play with it a little bit and see if it has any other interesting options.
Great.
In the next video, we're going to see how we can harvest or gather as much emails as possible from
just knowing a domain.
See you there.