Welcome back.
Let us finally check out how we can figure out the version of software running on an open port.
For now, we managed to discover open ports.
We also learned what defense can do and which ones are better to use.
And we learned how we can identify an operating system on some of the targets that we can.
Now, let's see one of the most important parts that will also help us in identifying vulnerabilities.
So why do we care about versions of software so much?
For example, I might somehow find out that Anticipatable is running Apache Web server on PT. eight,
but that doesn't narrow all the possible attacks too much.
Of course, it narrows it down to only search for Apache vulnerabilities, but NT map can even go as
far as discovering what exact version of Apache is it running.
Then, after knowing the version, we can that version on the Internet and try to see whether there
are any known vulnerabilities for that specific version.
So Version Discovery helps us a lot and let's see how we can perform it.
To perform version Discovery, we use the option Besch as we run the command and Map Desh ASV and as
usual, we are going to be scanning our anticipatable.
Now this command also requires the privileges, so make sure to type it at the beginning of the command.
Pseudo map, dash, ASV and then the address.
Press, enter, enter the password.
This particular scan could take longer than other scans because right now we are deeply scanning the
target.
Let us check out at what percentage is it that so 91 percent.
It should finish in just a few seconds.
Let's wait for it.
And here it is, we can see we got a bunch of result right here.
The new thing that we got from all the previous scans is this fourth column, remember, once we scanned
previously, we only got these first three columns, which are the port number, the state of the port
and the service that it is running right now.
We also get the version of the service.
So let's go quickly through this, we got port twenty one, which is empty, and right here we got the
exact version of what type of software does it have for the S.H.?
We get the same thing.
So the version of S.H. is open, S.H., four point seven Debian Ubuntu.
We got the Telnet, the S&P, the HTP.
We got that it is running the Apache HTP two point two point eight for the S&P protocol, which is port
four for five and one three nine.
We got that.
It is running.
Semba from the three point something to four point something in this range will be the version that
it is running.
What we would do with this information, as I already mentioned, is we would just try to search for
some known vulnerabilities for the specified versions.
For example, if this Apache version right here has a known vulnerability, we would discover it by
pasting this in Google and typing vulnerabilities.
And whatever comes up, we will test this on this target and see whether it works or not, since some
vulnerabilities could be patched if we never know.
So we want to try it out.
Down here, we also got the positions for the other ports, so we get a bunch of results right here,
what you would do with this can see this is really useful.
We would have this report and we would use for the future references.
For now.
Let me show you another option that you can use with the version scan.
And that option is intensity of scanning versions.
We can type it like this.
See, if I use the same comment, let me just clear the screen so we can see it better if I use the
same command and after Desh S.V. I type dash dash version dash intensity and after the version intensity,
we need to specify how high we want the intensity to be.
And it can be said between zero and nine.
The default one which we used in the last scan is seven.
So every time you don't specify this option, it will be seven by default.
If we set it all the way up to nine, then we will have higher possibility of identifying the correct
service version.
However, in ninety nine percent of Americans, this option is not needed.
You can just leave it on default, which is seven.
If you set it to nine, it will take longer time.
And since we are scanning a target that is on our own network, it will still do it in just a few seconds
or minutes.
But if you were to scan the real target and the scans could take a lot more time to accomplish, so
you always want to consider not only performing most accurate scan possible, but also performing as
can be equally fast and accurate.
So sometimes we have to lose one thing in order to gain the other.
That would be pretty much all for the scanning.
Now, we're not going to be running this command since I can tell you right now that will give us the
same output as the previous one.
So in this case, increase in diversion intensity won't help us too much.
And as far as these options go, there are more options for the version of Discovery that you can check
out inside of the manual.
But before I end this video, I want to show you another thing that they also use a lot, and that is
the Dash eight option.
So let me show you right here, if instead of all of this, I specify Dash A.
And there is so-called aggressive option.
It enables some advanced features of unmap, those advanced features are, well, first.
It enables or as detection without specifying the dash.
Oh, that we already covered.
It also enables the version detection without specifying the dash S.V. and it enables something called
and map script scanning what and map scripts are are something that we will cover shortly.
For now, just remember that Dash eight enables all of those things that we covered in the previous
videos, including and map script.
And since this is one of the more aggressive and map options, please do not try this on targets that
you do not have permission to scan.
However, let us test it out no matter what political target.
And if you want, you can also try to scan your whole network with it.
Just keep in mind that since it is using all of these options, it will take some time, even if it
is scanning our whole network.
So if I run this comment, this will take some time, if I press upper error, it is seventy eight percent
done and the output of this option we're going to see in the next video, as well as some other useful
things that we can do with EMAP as soon as we check that we are going to get into final evasion using
and map.
See you there.