By now, if you covered all of the videos that we did, you should have an intermediate knowledge of
and map all we are left to do to check out is just some of the few options that you might find useful
once you're performing your scans, which we will check out in this video.
And after it, we need to check out two more things.
One of them is running a map with scripts.
Which part of it we are going to see right now with the results of our Desh.
A scan from the previous video.
And the second thing is how we can bypass firewall IDs and IPS using and map.
So for now, we only noticed how we can perform different scans, but we never really talked about what
if our target is well secured?
What if they have a firewall?
We want to perform our scans as quietly as possible in order for us to not get detected.
But before we jump into all of that, let us check out the output of our Desh option.
Remember, from the previous video, there are a bunch of different things, such as always detection
versions scan and it also runs something called AMP scripts.
You will see down here that we are getting output that we didn't get before.
So besides the open port and the version that the open port is running, we also get the output of different
scripts that are running on the target as we execute.
This can see right now here we can see that it executed the script for FTP Anonymous login, and it
says that it is allowed.
And we will check out what the anonymous login is for now.
And I can tell you that it is not really that secure, even though if we go all the way down here,
it says FTP PD two point three point four, which is this version that the target has, is secure,
fast and stable.
And I can assure you this is one big lie as this FTP version is vulnerable.
And we are going to see in the exploitation section how we can exploit this and gain access to our target
machine down here.
We also get the enumeration of the S.H. So we get the message koskie.
Nothing really useful for us.
The SMTP comments that are allowed, the SSL cyphers right here.
We also get the server, Saddat, the DP title.
And these are just some additional information that we got from running script.
If it go all the way down, well, to get information for some other open ports and down here, we will
see the towers can also perform the SMB enumeration.
So we got the computer name net bias computer named domain name cybersecurity security mode down here.
We also get the traceroute to this target's IP address.
And this is the one hop that we have since it is in our own network.
He tells us down here that it'll perform the oath and service detection and here is the always detection,
but we already saw this.
We got Linux running.
So this is just some additional information on top of the information that we already had.
But remember that she is an aggressive Schenn, it does give us the most output out of any other options,
but it is also pretty aggressive and easily detectable if Target has some security measures, since
our Anticipatable doesn't have any security measures or is not behind any of this can is best for targets
like that.
So we got the most information using Dash eight.
But besides this Dash eight, let us also check a few more useful options that map gives us.
And to do that, we're going to run the unmap manual type man and then map and it will open up the manual
once again.
We already know how we can go through it with upper and lower error.
And we're going to just go really quick through it and see whether there are any useful options that
we haven't covered but that you might want to use.
So if we go down here, this Besch as an option is really useful option, and it is not really useful
for discovering what abilities or open ports.
Matter of fact, this option right here performs the same thing that our net discovered to that.
Remember, we use net discovered to locate all of the hosts that are up and running on our network and
Desh and pretty much does the same thing as we can see right here.
This option tells EMAP not do a port scan, so you will not find out any open ports with the scan.
The only useful thing we get from this is which hosts are up and running.
So let's test it out real quick.
And this is a scan that you would use probably on multiple machines to discover which ones are up and
which ones aren't.
But you can also use it on one machine if you'd like for this scan.
I will use my whole network, Swadesh and and then one of the 168 that found that one two fifty five
if I press enter.
This should pretty much just a few seconds and here it is, it will give us which hosts are currently
up, we get their IP addresses.
So one I to the 168, one to 10.
This is my laptop.
We get them exploitable if we get Windows 10, probably and forget my router.
So instead of net discover you can use this to figure out which hosts are up.
But for me personally, I like net discover output of a little bit better than this one.
This right here looks a little bit messy.
OK, so the second thing that I want to show you is Desh B option, and this is an actual option that
you will use a lot.
So for this, we're going to scan our display to also change the IP address to the IP address.
And what that option is, is simply you can specify what range of port you want to scan with and map.
So remember, when we perform any other scan, it can stop one thousand ports.
But what if we, for example, only wanted to scan one port?
For example, let's say we wanted to scan Port 80 on the metal.
Can we do that?
Well, if you specify that and then 80 and then the I.P. address here, it will tell us port at open
and service that it is running so we can scan only one port if we want.
This option is useful.
If you're only attacking one port and you don't want to bother really and let em scan one thousand port
when you only want to enumerate one single port.
You can also do it on multiple ports.
For example, port at port twenty two, port one hundred.
And let's see what the output is.
And here we can see Port 80 in Port Two are open, while the Port 100 is closed, we separate different
ports with CUMA and instead of separating them with Cuma, if you want to scan a range of ports, you
can also do this.
You can do port one to port one hundred.
And here are the results not shown.
Ninety four closed ports and we got six ports are open in first one hundred ports.
And remember when I told you that there are over sixty five thousand ports.
Well this is the option that we can use in order to scan all sixty five thousand if I type the same
command, just a scan from one to sixty five thousand five hundred and thirty five and press enter.
This scan will take longer than any previous scan that we did since it is scanning sixty five thousand
ports.
Here we can see the output, it finished in seven point seventy four seconds and here all the open ports
that it managed to discover, here are some of the ports that we never really discovered with previous
scans that we did in last few meters.
So this is really useful.
If we used regular scans and we only scan first one thousand ports, we would never really know that
these ports are also open.
Now, on the contrary, instead of scanning thousand ports or sixty five thousand ports, we can use
a call option, which is Desh F and it is Capital F.
And what this option does is instead of scanning one thousand ports, it scans first one hundred ports.
So in case you want to perform a quicker scan and you also want to scan top one hundred U.S. ports,
you would use the dash F option.
If I press enter, you can see it finished in less than one second.
And it can't top 100 ports now, this doesn't mean that it can port from one to one hundred days simply
means it can't first 100 ports that are usually most used.
So we got twenty one, twenty two, twenty five, fifty three and a bunch of others as well.
But whenever you really want to find out everything you can about the target, this can will be more
useful.
The one where we can.
Sixty five thousand ports since you can see there a lot more ports that are open than with this kind.
OK, cool, let me show you one more option before we proceed to the next video, and that option is
how to output and scan.
So there are a few ways that we can do that if I run and map and then we use the same scan which we
covered.
Now let's see if we can do at this point, there are two ways that we can do this if we want the output
to be inside of a file.
We can use to Aros to the right and then output of scan data.
Let me see your request.
The scan type, which requires route privileges.
So let us run it with food and press enter type and password.
And you will see we get no output to our terminal, that is because all of the output is stored in this
file if we use the cat command to output the results.
Here is our scan that is being stored inside of this file.
So this is useful.
Once you want to, for example, add this to your report, so you just save it in a file and then later
on, copy and paste this on our report.
Another point that you can do this in case you want the results to be saved, both in a file and also
outputted in your terminal.
We can use the dash or option so that when I'm not sure if it is with capital end or lower case, and
we're going to check that out with the help menu.
So let's go to the output settings and it is Desh or one option.
And we can see right here that one option is output can in normal.
So we can simply just save this in a normal file.
If you want some other file type, you can use OpEx for the XML and to get some other options here as
well that you might find interesting for now.
And we are just going to check out this one.
So if I go down here and type and map dash on and then Dash S.
S, of course we need to run this with pseudo and we specify one or two that 168 that one dot five output
file begins with.
Yeah, we need to specify the name of the file that we want to save it.
So let's just call it output.
And here it is.
We get the output to our terminal, but I also type less and get the output file.
We also get the results saved inside of this file.
OK, great.
These are just some of the basic options that I wanted to mention, since you might find them useful
and by now, as I already told you, you can consider yourself an intermediate and map scanner.
Now, to take this to the advanced level, we're going to check out in the next few videos how we can
bypass favorable ideas and IPS using and map scans.