>> First of all, we know that it's running telnet.
Since I'm in the script folder,
I'm going to go ahead and do a dir and all
the telnet related attacks
or exploits that we can run in and map
against telnet enabled devices.
There's a telnet brute script.
We'll go ahead and run Nmap,
dash a script telnet brute against that target.
Actually, this isn't
a true brute force attack that tries
every combination of letters
and numbers and special characters,
it's really a dictionary attack.
In other words, it uses a list of credentials.
Because of that, it actually runs a little bit
faster than a brute force attack would,
especially given the fact that we're
having to provide a username and password.
I didn't adjust the timing on this attack,
so it'll take a little bit of time.
In the future, I'll probably adjust
the timing just to make it go a little bit faster.
There's the results. As you all know,
running telnet on any modern device is a terrible idea.
If any half decent hacker
or network administrator is listening on traffic,
telnet usernames and passwords are sent in
plain text and really
without any script arguments at all,
and not very much time.
This discovered the username here and
password for that device at 1.2.
Granted, it's not an extremely
complicated username and password,
but this is it right here.
Just to prove that it works,
I'll clear the screen,
it's the username of admin and the password of
trustno and then number one.
I'll clear the screen,
we'll do a telnet of 192.168.1.2,
username, admin, password, trustno1, and I'm in.
It's a Cisco switch.
I got in with just a simple NSE script.
Running the vulnerability scan showed us
what the vulnerability was and I
ran an exploit using the telnet brute script.
I'll get out of that Cisco switch, clear the screen.
Another one of the vulnerabilities had to do with
HTTP since HTTP was open.
I'll do a dir of
all the HTTP attacks that we can
>> run against this device.
>> There's a ton of them.
The one I'm most interested in is
the default accounts script,
and that is right here.
Go ahead and highlight it. Copy it.
Clear screen and I'll do a script help first.
Gives us a ton of detail about how it works
and what arguments you
can pass to it and where you can
get more information about it.
Really good information. We'll do an Nmap,
script bot and paste it again against the same target.
Actually, I'm going to adjust the timing too,
we'll make it a T5,
which is insane, hit "Enter".
It should go a little bit faster.
This right here, it shows me the default accounts.
It's a username and password of Cisco.
We know it's port 80.
We'll go ahead and open up our favorite browser,
which is Internet Explorer. I'm kidding.
We'll navigate to that address.
The username provided in that NSE script was Cisco
, password was Cisco.
We're in.
Granted. This device
is vulnerable,
I'm not going to act like it isn't.
It has some obvious flaws,
has a default username and password enabled,
has a very weak telnet password,
but nevertheless, it was
pretty easy to break in using standard NSE scripts,
and that's the main point.
We saw the vulnerabilities,
we saw how to attack it,
and usernames and passwords.
Now, I'm going to minimize this actually.
I want to go over one more exploit.
That is one that is actually very common out there.
Don't do this against a device or a target that
you don't own or
that you don't have a written contract for.
That is the slowloris attack.
We're going to do a Nmap,
HTTP slowloris, I'll do the timing of T5.
In this case, it really matters because
this is a denial of service attack.
We'll do it against that same target.
I'm pretty sure that this one continues to run.
I don't think that it has a timeout.
While this runs, it's running against
the same device that we were just on.
Here's the device.
I'm going to do a refresh on this device.
You can already see it's taken it down.
The slowloris attack, the denial of service attack,
you can look at the details about how it works,
but it is basically opening up
so many connections against
this web server that it can't keep up.
I'm not even running it from multiple hosts.
It's not a sophisticated denial of
service attack in the sense that
it's not using a botnet or not.
It's not distributed.
It's not a reflective or amplified attack.
It's a simple attack against a Cisco switch,
which really could affect production if
you're in an enterprise network.
Even still, I'm refreshing and,
at least, a web interface is completely down right now.
I'll go ahead and hit "Control C" and stop that.
It might take it a second.
I'll minimize the Nmap scan and I'll do a refresh.
Eventually, the device
should catch up and be able to respond.
I encourage you to look into that slowloris attack.
The main point is try it against your networks,
potentially vulnerable devices and
see if they can handle it.
Then do a script help
and go to the URL provided and learn more about it.
Hope this is really helpful for you and
>> I appreciate you
>> going through this lesson on Nmap scripting engine.
I'll see you in the next video.
In this lesson, we answered the questions,
what is Nmap scripting engine and how does it work?
Next, we examined how the Nmap scripting engine
gives us the ability to perform advanced scanning.
Then we went through a lab that demonstrates its use
as a vulnerability scanner and exploitation tool.
Thanks so much for going through this lesson with me,
and I'll see you in the next one.