>> Welcome to the next lesson on Zenmap.
This lesson, we'll cover the custom
>> scan profile editor.
>> The profile editor is simply a way for you
to build out your own custom scans,
then save them so they can be run
>> again anytime you open
>> Zenmap without having to remember all of
the options that yielded such great results.
The lab for this lesson is fairly long.
I'm going to do two things.
First, I'll show you how
the profile editor works, and second,
try to provide you with some useful, and handy
WhoIs an OS detection scans.
I hope there'll be really useful to you.
Let's get started. Here are
the learning objectives for this lesson.
First, we'll talk about what
a custom scan profile is in Zenmap.
Next we'll discuss why they're important.
Finally, we'll go through a lab on creating them.
Custom scan profiles are used in
Zenmap to allow you to save all of the options
and command line switches you've
worked hard to create in an
easy to find, and recall graphical environment.
One of the nice things about them
is that once you create and save them,
they'll be available to you every time you open Zenmap.
As you'll see in the lab, they're
extremely easy to create, and modify,
and almost all of the options can
>> be set by mouse click.
>> Why are they important? Well,
the first reason is that they provide
such an easy way to see, and set all of
the options at the command line, and map requires
you to either remember options, or
use help, or a reference.
In Zenmap, all of the options are categorized in
a common sense way, and can be set or unset easily.
Another reason they're important is that
they provide a really good way to
learn the way Nmap
determines the default order of options.
As we discussed, the order that
options are placed in does not
really determine whether a scan will
succeed or fail necessarily,
but I'm convinced that placing options in
a certain order will speed up processing.
If nothing else though,
it helps you to learn a standard for
building Nmap command line scans.
Finally, there are important because they allow
you to save and name,
modify, and run them many times.
At the command line,
the only way to duplicate
this functionality is by either creating
batch files, or keeping
a personal scan reference library at your disposal.
Now, onto the lab.
In this lab, I'll show you the Zenmap profile editor.
I'll give you a tip for naming your custom scans.
Then I'll show you why leaving
the target blank helps you in most cases.
Finally, a walk-through creating
three pretty useful custom scan profiles.
Let's get started. Welcome to
the Zenmap lab covering one
of the coolest features of Zenmap,
I think, and that is the profile editor.
I have a lot to cover so let's get started.
As you can see, I have Zenmap open.
The first thing I want to show you, and what
this whole lab is about is the profile editor.
It can be found on the top menu bar,
and it's called profile.
Then click on " New Profile or Command".
This brings up the profile editor.
Inside the profile editor,
there are many, many different options.
I think probably all of the options that Nmap
provides in a point-and-click environment,
and they're all in these tabs here at the top.
You can click on "Scan",
see a lot of options there.
Ping, all the different type of
ping scans you can do, Scripting,
Target, Source, Other, and Timing.
The first thing we want to do is we want to
name our custom scan profile.
What I usually like to do is start
each custom scan profile with the word custom.
It differentiates it from
all the other scans built-in to Nmap.
We'll say Custom: and then the name of your scan.
I'll just call this one test.
We'll just make this a really simple scan.
I'm going to do a ping scan, there ICMP ping.
Then I'm going to leave the target blank.
The reason why is because
after you build out your profile,
usually you're going to want to run that scan
again using a different target.
I hope that makes sense.
I'll show you what I mean, "Save Changes".
What happens now that we've built
that custom profile is under Profile,
this drop-down list,
your custom scan will show up.
You can see why I like to call it
custom, or name it custom at the beginning.
That is to differentiate it between all of
the other built-in Nmap scans.
If I click on that scan,
you can see that my command is built
out and there is no target.
That was by default because
I usually run my scans on different targets every time.
That is, unless you're going to do
an inventory of your network and you want to
see the differences between one network scan and another,
but we'll cover that later.
Here my target, I'll just type the IP address of
my default gateway, which is 182.168.1.254.
Hit "Scan". If I click on the drop-down again,
click "Custom Test",
I can clear out the target,
put in a different target.
Do 1.1.
I don't know if there's
anything there, but let's scan it.
It looks like I have telnet open on
that device and it is a Cisco device.
That's good information.
Now, we covered where the profile editor is,
and what a naming convention is,
and I also gave you a tip to leave the target blank.
Let's build out some actual
valuable custom scan profiles.
Now that we created a test custom profile,
let's create one that does something actually valuable.
Click on "Profile", "New Profile or Command".
I'm going to clear out the options
here in the command line and we'll name
it Custom WhoIs IP.
Really, we're only going to set two options.
One of them is an NSE script so we'll click on
"Scripting" and click in this list of scripts.
One cool thing is you can just start typing.
It brings up a little search window and it will take you
to the script that you're looking for.
We'll click on "whois-ip".
You can see it building out the scan here at the top.
The only other option I wanted to set was the verbosity.
I'm going to click on "Other".
We'll click on "Verbosity Level".
Then we will make it verbose 1.
Then we'll save the changes.
It didn't already default to that scan profile,
so we'll find it in our list,
here it is, WhoIS IP?
And it's doing a WhoIS IP on
the last target that we
selected so I'm going to erase that.
One of the things that you might want to do when you're
looking up an IP address is first of all,
deciding what IP address
that you want to find information
about and a lot of times
that's going to be a public IP address.
If in your intrusion detection system you find
a strange IP address and you want to
know a little bit more information about it,
this is a great scan to run.
I don't have an IDS installed on
this machine so I'm going
to actually do a little bit of email header analysis.