Hi, and welcome back to section three net CAT Penetration test.
In this video, we are going to talk about any map.
Nmap is a open source program released under the guo license.
It's an available tool for network administrator,
which can be used to discover monitor troubleshooting T C P
I P system,
and has the ability to graphically display network topology with Zen map
firewalls, routers, proxy servers, and other secure devices
can difficult the result of Nmap scan. At the full Nmap scan,
we check for the a hungry, most commonly used T C P P ports.
And we have some states for those parts as open close filtering and
filtering, open and filtering and closed filter.
The format of the simple comment of Nmap is any map
and the IP target for the full scan,
but we have a lot of options available to any map and
we have a mode call it aggressive scan,
aggressively scans some system may cause them to crash.
When can lead to undesirable results like system of time and
data loss. Ours scan mission critical system in caution.
The aggressive scan select some of the most commonly used options with the
Nmap and is provided as a simple alternative to type in
a long string of common light arguments with Nmap.
We have some options in, uh,
main app option is about discovery.
So Nmap discover options before PO scan a target.
Any map will attempt to send I C M P or a pinging
echo request to see if the host is alive or not.
Waste time to know if the host is online or not.
I C M P requests are often blocked by firewalls.
Did the full discovery option aren't useful when scanning security systems and
can hidden scanning process?
Here are some alternative methods for host discovery,
which you do perform more comprehensive discovery.
So we have some options and the meaning of its offer. For example,
for don't use pinging or to use ATT c p sync Ping or
ATT c p egg pinging, for example, uh,
options to use U D P pinging options to use, uh,
I C M P or Echo Ping or for timestamp pinging or address
mask pinging or use, uh,
pinging using I R P. We have some,
some options to try to not get blocked by other devices.
And we have some advanced scanning options available in map.
In some situations it may be necessary to perform some complex T C P A T C
P or even E D P scans in attempt to find uncommon services or
to evade firewall.
So we have some scans to use at t p sync ATT p connect scan
ATT p new, uh, Christmas scan,
ATT P ACT scan or uh, IP protocol scan.
So all this options available is to try to
undiscover, uh, some unknown service, for example,
or to evade some firewall, for example.
Now let's take a look at M map here in my KA Linux environment.
We'll do some tests in my, my network. I,
I have a network here in some, some devices.
So let's do some scans in those devices. First of all,
let me open our terminal, okay?
And the basically syntax about inmap is type inmap
in the IP address that for the device that we want to, to,
to a scan like this
and, and press enter. So in map you do a,
basically a scan on this device.
So the IP is this one here. Okay? And for,
for a, basically the scan test you use T C P as the four,
the protocol of ASD four.
And we found four open doors here,
postman for the T C P or A C M S A R P.
The second one for net views, s ss n. This is, uh,
windows protocol for share printers, for example,
uh, we have the, the port of 4, 4, 5
using two from Microsoft and another high port to
use it here. So let's do the same test for, uh,
other device that I have in my network here.
So this device here is he's blocking some pings, okay?
So, uh, as we saw before, inmap has a lot,
a lot of options, switch options to try to
overpass some firewalls or some other other configuration.
Another option to scan is to have a range,
as we saw in Netcat. For Nmap, the function is the same.
We do the ip,
but first in the first IP available.
And second, the high limit that want to, to scan.
For example, in this case we have this range of ips,
press enter.
This could take some time because we have
a range of ips. We have some,
some progress to verify
how long it's taking for take all the scan
for our network.
And then we have a list of all devices in which
ports are open in my network,
in all devices available in my network. So first of all,
we have the first one here. Founded, uh, one.
So in this IP here is my gateway.
We found 22 s s h open.
We have, uh, 2023 DCP Telnet open,
and we have, uh, H T T P server open here too.
So in another, uh, host in the final IP three,
we have another list of uh, uh, open doors.
We have the 80 0 8 H p server.
We have a H P 13. We have, uh,
HT p s out. Another,
another listener here and another bot here
in the, another host in the final IP four.
He was not able to check any doors or any open doors.
He open for the 15 was refused.
This is for the default option.
I don't put any additional option. Here is the default, any map option, okay?
For the host mean final six, IP six,
basically, uh, the same for the IP that we saw before,
the three here, or same,
I have some devices maybe are the, the devices from the same manufacturer,
another one here, another host in the final 10,
we have some different parts here.
N ss p net bus again is uh,
another laptop that I have in my network.
And finally with IP 13,
we have other protocols and other devices here.
So the important point here is to get
all, all those information for this phase,
we are doing a scan in the network for look for the,
the hosts and check the protocol
port in the type of services. Okay?
This is very important because we are discovering all the possibilities that
we have in the host in the the,
in the network to later we will explore all this
possibility to do, uh, uh, all the, the phases for penetration tests. Okay?
We are, we are gathering information, we are planning our, our attack, uh,
how kind of attack we, we gonna do,
how kind of payload for each host or each service.
So this is a very important, uh, step. Okay?
Another important option is a aggressive scan
that we talked before. Okay? So for example,
let me choose, uh,
IP and I'll use the option dash
V to get more information,
verbal mode and use upper A
to say, Hey, netm map, I'm using aggressive scan.
So we saw that the aggressive scan selects some of the most commonly used
options with any map and is provided as a simple alternative to type along
screen or a common line arguments.
And this is the option is very important and you have to do this
attention because this option
can cause them to crash when can lead to undesirable results.
So, uh, like a aggressive scan. So we you do some brutal force, for example,
to get all the formation. So let's see the result here.
Okay, lemme use the, the V option.
This could take some time, any map,
do all the, the, the scans for this host.
Okay? So now first of all,
we saw this was using the N map with the normal
n f four options. And this, the result are a,
a little bit different, uh,
using the big a option for aggressive scan.
So we have the list of the doors,
the port, the state, the service, and the version.
So this is different from here.
Here is we have only the port, the, the protocol,
the state in the service, the same host,
okay? Host. So for this host here,
we have a little bit more informations, for example,
each version, um,
more details about the version of the service that is running here.
We have the service info here, windows,
and we have some informations, uh,
about the device that are hosting these services. Okay?
For example, uh, we have the, the version of the SMB two security.
We have the name of the, the laptop here, okay?
Is a laptop from our lab. Uh, we have the net abuse information.
We have the date time for the, this version here.
So this is, uh, more details about the, the,
the versions available about, about the the services.
And finally,
another option here is to use a C R D R
notation.
A C R D R D R notation consists of a network address and subnet
mask in banner B separated by slash.
So we have this notation here in the map. So
this means this result here is the,
all the hosts, all the ips for the host.
I use uh, dash V to get more information.
But the result here is a hand map. I using, uh,
C R D R R notation.
So I need to do a scan for all the hosts
in my network. So Netm map, you scan,
you start to get information. Here was seven seconds.
So here, let me back here in the, the beginning,
we start a command here, okay?
Netcat start to scan all the hosts in my network
and looked at every host here. He start to do a, a scan.
Okay? This is, this information here, uh,
was only possible because the dash v okay, to get more information.
So the host is down for this host here.
Okay? So look that he net and web, he do,
he he's doing a scan for every host, okay? Every host here
and he finish here. And now
he start to list the ports open here.
For example, this one here for the my gateway,
as we saw before. Okay?
So of ports for each I ip
the, the scan here. And now he start to, uh,
show the summary of the,
the hosts and the port state services are open here
as we saw before. Okay? So is, uh,
another option to scan all the,
the hosts. In this video we saw an introduction about inmap.
In the next video, we'll take a look about banner grabbing.
I hope to see you there.