>> We'll do a more targeted
and sophisticated application
service inversion detection scan.
Will do nmap -sS,
SYN scan -s capital U for UDP scan,
-p and we'll do
TCP ports 80,
88, 135, 139, 389, and 443,
and then UDP ports 123
and 137 and we'll make it a inversion
detection scan of 192.168.1.10
and we'll compare the differences in
the amount of time it takes to run
this scan versus the previous simple scan.
There's the results. We scan more stuff or
more critical stuff in 18.71 seconds compared to
the a 142 seconds it took to do
the simple dash Sv scan
of the same machine and we got a lot more information.
Under version you can see definitely that it's
a Microsoft server and
it's running active Directory LDAP.
You can see the name of
the domain and also you can see the UDP services
running NTP version e and
Windows net bios and then it
>> provides the workgroup too.
>> That's great information if you're doing
an inventory or if
you're preparing for a penetration test.
That was one type of service inversion detection scan.
Now, I wanted to cover a couple of
the additional command-line switches
that we can add to that.
We'll do the same scan but
what we'll do this time is we'll adjust
the version intensity and
then we'll compare the time that it takes
and talk a little bit
about the information that it provides.
As I mentioned before,
I mentioned in the lesson,
the default version intensity for
a version of detection scan is a seven,
and that's the scale from 1-9.
Theoretically, this should be faster,
but in some cases,
it might provide a little bit less information.
That took 17.8 seconds,
provides pretty much all the same information.
In fact, I've checked it before and it is
exactly the same information in this server's case.
It was about a second faster by adjusting
the version intensity down to a five from a seven.
Then I'm going to cover one other command and that
is just shorthand for switching
the version detection down even further and
that's version light and then we'll compare
the time that the scan takes and the results.
That one took 14.8 seconds
and it actually shows the exact same information.
These are common ports and services.
Nmap has a lot easier time matching them up
against their database and you can also
see here the CPE from
the CPE database and operating system
is Microsoft Windows.
It gives you the host name
and MAC address and
everything else just like other scans have.
Now that we've gone through a couple of
those commands and I've showed you how
targeted scans are much better than
a standard service inversion detection scan.
I want to compare some simple banner grabbing
techniques to Nmap's application
and service version of detection.
One common and very basic but very available type
of banner grabbing that people do is a telnet command.
You can obviously telnet to ports other than
just the telnet port and then look at the results.
We'll telnet to a server that
sits in my DMZ on
my network and that is just one that I already know.
I'm not going to run you through
a ping sweep or anything like that.
I know this one is running a mail server.
There you go. That's basically the results.
I'm going to quit.
In some mail servers,
you're going to have a lot more information
if you telnet to port
25 or 587 or whatever port SMTP is running on.
You'll have a lot more information than that.
In this case, my mail server
doesn't provide information in the banner.
When you connect to it, there's not going be
a lot of information and
so that type of banner grabbing
technique doesn't really do you any good.
You could do a telnet against Gmail's SMTP server.
Gmail actually provides a little bit more information.
You know that it's Gmail SMTP server.
If you know how to attack that or whatever,
at least that's a little bit more information
than my mail server.
But neither one of them really provides you with
a lot of details about that mail server.
What I wanted to do is just compare
old-school banner grabbing to what Nmap could do.
We'll do an Nmap SYN scan.
Make it fast. It's a UDP scan
of that same server that sits in my DMZ.
Now you're seeing a lot more services there.
Well, I didn't really do a scan before,
so you see all the services available.
There are no UDP ports open on that machine.
I'll go and do a more targeted scan
against it so we can see
if we can get version information,
especially on that mail server.
Then we'll compare that against
the old school telnet approach. I'll scroll up.
I could just do it against port 25,
but I wanted to show you a little bit
more of the power of Nmap.
I'm grabbing a whole bunch of those ports.
You'll notice here too that I'm not
doing a UDP scan because that
adds to the time and also there were no UDP ports open.
If you're just doing a SYN scan,
a - p followed by a space and
then the TCP ports is all that you need to put.
You don't need to put a T or a U there.
There you have it. The mail server
that is in my DMZ is an H mail server.
That's really good information.
You can look up H mail server and see if you can
find potential weaknesses in
it and work harder
to penetrate it or
exploit it if that's what you're trying to do.
Also, you can see SMTP is also run on
465 with H mail server and you can see that
I'm running FileZilla FTP server,
and also it's a Microsoft web server.
That's all really good information.
I hope that you agree and hope it all makes sense
and I really appreciate you going through
this lab with me and I'll see you in the next one.
This lesson was all about service and
application version detection using Nmap.
First, we talked about what service
and application version detection is.
Second, we discussed why it
is both relevant and important.
Third, we talked about when and how to use it,
including the most important
command-line option you need to know.
Then I provided a couple
other command-line options that are available.
We finished up this lesson with
a lab that demonstrated all
of the concepts and commands discussed in this lesson.
Thanks so much for walking through this lesson,
and I'll talk to you again in the next one.