So I'm going to open up my email
here.
This gets a little bit personal
and a lot of times in your junk mail
you'll see some strange stuff.
So I don't know who
this review safety is.
It's probably something that I
looked up or bought at some point.
But your
email client is going to be
different than this, obviously.
I'll leave it up to you to decide
or determine how to get to
your email headers.
But in Microsoft Outlook,
you open up the email, click on file
properties.
And here's your email headers right
here.
One of the things I like to do
when doing email header analysis
is come through
and look for IP
addresses so we can
see that the sender's
IP address is this address right
here.
So I'll copy it.
We'll close out of my email.
And we'll add that is the target.
All right, so let's find out
information about this I.P.
address.
OK, so here's the scan results, you
can see all the detail here,
the IP address resolved to this
name, and
here you can see who the IP address
is registered to
and their organization,
an email address.
And so that's a pretty cool scan.
All right. So let's create another
custom scan.
This one is we're going to
call it.
We'll call this one who is domain.
I'm going to clear out all these
options.
And this one also
is an NSC script,
McKagan scripting,
start typing. Who is
she? Choose who is domain.
I'll uncheck who is
IP.
And I'll leave all the other default
options as they are.
We'll save changes
and in the drop down list, there's
the who has domain
clear out our last target.
And again, I'm going to open up my
email and
we'll go into our junk mail folder
again and do a little email header
analysis
junk through this
trophy depot.
All right, so this time we're going
to do who is on the domain itself
instead of the IP address.
We can just choose trophy depot,
dotcom.
We're going to close out of that
again,
make that our target and
let's find out more information
about Trappy trophy depot dotcom.
What the scandal do is return
the information from
the registrar who
is database.
Again, the most important part about
this is not
so much what this scan does,
but the fact that
you can name your custom
profiles and you can set all those
options.
So don't get too hung up in the in
the other details.
So here you can
see that the registrar is
Network Solutions.
Here's the abuse
email and the phone number.
And you could see that their DNS
is hosted by CloudFlare.
So they have some data protection.
OK, let's do one more
custom profile,
the new profile.
Clear out all these options.
Call this one
quick detailed
D technician.
OK, so this scan is pretty useful.
I know the IP address of my
server on this network,
so I'm cheating a little bit because
I already have that IP address.
But again,
when we're building up profiles, we
leave the target blank.
So this will work on any target.
So I'm first going to
go to.
Scan,
we're going to do an OS detection.
And here I'm going to choose the
timing template of
aggressive
that makes it work a lot faster,
but it is more intrusive.
So if you're doing this to an
outside or unknown IP address
or target, it could
be flagged by an I.D.
or firewall.
One other really useful OS
detection.
Option is
an easy script, so
we'll go to scripting
and we'll do it at
some B OS Discovery,
S&P Discovery works really, really
well, especially against Windows
House.
So I'll save that.
Go to quick, detailed OS detection,
you can see it's built out right
here and it changed the target
to a server on my network
and that is at 192 dot 168
dot one 10.
And that's a 2012 server.
SkÃÂ¥ne.
The scan for all it does actually
works pretty quick.
The timing template of a T4
helps with that.
So you can see a
lot of details, it actually is a
Windows Server 2012
are two essentials,
and that's thanks to the Sambos
Discovery NSC script
up here.
You see all the ports that were open
on that server
and you'll
get the Mac address, know
that it's a Dell that's accurate.
It says the warning right here, OS
scan results may be unreliable
because we cannot find at least one
open and one closed port.
And that's what I was talking about,
how the dash capital O
is sometimes sometimes
yields
less than perfect results.
It did figure out that it's probably
server 2012 or 2012
R2.
But like I said, the SMB
OS discovery got it exactly
right.
All right, that's the end of this
lab. Thanks a lot for going through
with me
in this lesson.
We talked about what a custom scan
profile is and ZENAB.
Next, we discussed why they're
important.
And finally we went through a lab on
creating them.
That completes our lessons on and
map basics.
From now on, Will dove a bit
deeper and we'll cover many more
useful scans.
Thanks so much for working through
this lesson with me, and I'll see
you in the next one.