It is time to start with the first big tool that is essential for ethical hackers, that tool is called
and we're going to cover a lot of things inside of it.
And unlike all the other tools that we covered by now, which you might or might not using penetration
tests, this is a tool that you will almost always use without any doubt.
So what is a map?
And map is a network map.
It is a free and open source network scanner.
And it is used to discover hosts and services on a computer network by sending packets and analyzing
responses.
It has a lot of different options and we're going to check them out in the next few minutes.
For now, let us just see how we can start and map and run a basic scan.
First thing, make sure your display table is up and running.
And also, if you've got any other devices in your home network, turn them on just to we can scan them
as well.
OK, let's see how we can run and map and what options do we get with that map?
Just like all the other tools, we can get the map help menu by only specifying and mapping terminal
or specifying and map that help.
And you will see right the way we get a lot of options right here.
And this right here is just a short help menu where we'll see the longer menu once we start experimenting
with these options right here.
But for now, we're only interested in running and map with just a basic scan.
So for basic scan, all we need to do is specify an IP address.
If we go to the health menu and you scroll all the way to the top, we should see target specification
right here.
It tells us that we can provide the hostname.
An IP address.
Or a network for scanning.
And below that, we got some of the examples of what we can specify with a map and what is the syntax
for specifying hosts.
We can also read our targets from a list by specifying option that I tell.
And if we want, we can exclude some quotes that we don't want to scan by specifying that that exclude
option for the first time.
Let us get an IP address from our meant to split the and let's send it to see what results we get for
scanning one IP address.
We already saw how we can get anticipatable IP address.
You can either run Nettie's discover to see all the online hosts or if you don't want to bother, you
can just go to Anticipatable right here.
And type I have config, I can see that the IP address of my metals floatable is 192, that 168 at one
point six.
So that is the IP address.
The trouble is, let's run our first and meskin if I type and map and just want to do that 168 at one
point six and press enter.
Wow, this finished pretty fast, but don't get used to it, the only reason that this can finish so
fast is because the target is on my home network too, and my scans can sometimes take hours to finish,
depending on where your target is, how many points they have open.
Are they protected by far?
Well, and many other things that we are also going to cover.
But for now, this is the response for our metal plate with our basic scan.
She tells us the toasties up.
It tells us which open port it has.
We get the exact number of which ports are open on the target machine.
And right here, we can notice that there are a lot of ports that are open, that is because the is
running a lot of services.
And MAP also tells you, besides the port that is opened, which service is running on the open port?
And this is this third column.
So we can see that Port 21 is open and it is running FTB, which we already know that it's file transfer
protocol.
We got Port 22 to be open and that port is for secure shell.
We got Port 80 that is opened, and that is a deep port, and this could mean the tormenta split the
boat, could be hosting a Web page.
We can check this out if we type the IP address of our anticipatable inside of our Firefox.
So let's go up here.
Open up our Firefox.
And if I go up here and type 180 to that 168 dot fund, that six press enter, this will automatically
go and try to connect to the Port 80 and indeed, it is hosting a Web page.
But more about this Web page later on in the course as it holds a bunch of vulnerabilities which we
will cover for now, let us just see what other things we got with our map.
So besides these known ports that we got right here, we also discovered a bunch of other ports hosting
different services and some of them could be vulnerable.
We also see this right here that says not shown.
Nine hundred and seventy seven closed ports.
But wait a second, I said that they're over sixty five thousand ports, why does it say that it didn't
show only nine hundred and seventy seven ports or it shows that only nine hundred and seventy seven
ports are closed?
That is because end up by default scans.
Most known one thousand ports.
It doesn't scan all sixty five thousand.
We can tell it to scan all sixty five thousand which we will see later on.
But in most cases it is not necessary.
OK, cool.
Our first and maps can give us some results and all of these results from our scans you would write
down in our report in a real penetration test.
Now that we know how we can scan one IP address, let us see how we can scan a range of IP addresses.
Let's say we want to scan our entire network.
And for this, once again, you must know your subnet or your network or your networks IP range.
We talked about this earlier.
For me, it is from 190 to that 168.
That one that one up to 192.
That 168, that one that took fifty five.
So we can specify this in two different ways.
We can type and map one, add to that 168 and find that one Besch to fifty five.
Or we can type it like this one idea to that point sixty eight at one point one twenty four.
And if you're new to something, you can think of this twenty four as something that says first three
octets are not changeable and by first reacted, I mean first three numbers, which leaves us with only
last that or last number that will be changeable inside of our IP range.
So let's get it.
If I press enter.
Now, this can right here might take a little bit more time, since it is not only scanning one host,
it is scanning multiple hosts and even though it's scanning multiple hosts, it finished relatively
fast because it is scanning my own network.
That is the results.
So these right here are the results for the.
Anticipatable, as we can see by the IP address, and we got the same results as before, which ports
are open and what services are they running down here?
We get that it scanned two hundred and fifty six IP addresses and three hosts are up.
Let's see what other two hosts are up besides our display.
We got the device with the IP address of 192.
That's 168, that fund four.
And it says right here all one thousand scan ports on this device are closed.
And you remember what I told you, that this is the more secure version, since right now we cannot
connect to any one of these ports and this is probably some home device, possibly my laptop.
It has all 1000 scanned ports closed because it doesn't cost any service to other machines.
And the last device that we got is my router, we got its IP address and we also got Witchboard it has
open so it has bought 22 for Secich for twenty three for Telnet port, fifty three for the domain port
eight and port four for three for HTP and https.
And this port right here that says service unknown.
This is because Unmap couldn't figure out what service is running on this open port.
OK, great.
For now, we perform Basecamp scan without adding any additional options to it, and with this we managed
to discover open ports on our target machines.
That is good for the start.
In the next video, we will see what else can be discovered using and map and what other options it
has.