Hi, and welcome back to section three Netcat Penetration Test. In this video,
we're going to talk about banner grabbing.
With netcat Be is simply the ability to connect the
basic network services and collect information that they display.
The term stems from grabbing the information displayed from services
when that connection is first made.
Usually the name of the service and the version install out.
A useful feature of Net CAT is ability to connect our service in attempt to
identify version information by triggering our response from the service
banner. And this can be applied to many different services.
A service is application that runs in the background waiting for someone or
something, use it.
And in Linux and Microsoft Windows has a lot of service price style,
for example, S s H and ACHE two web server.
Here we have some default ports or some protocols and sub,
for example, for H T P, the, the Port 80 F T p, SS,
s h for pop and Map and S M T P.
Those are the default ports for those services.
Here in my Linux Carlins environment,
we take some examples of bunny wrapping using net cap.
Let's, let me open a terminal.
So first of all,
the objective of graphing is to access the, uh,
a service to get more information that we can,
okay? For example, let's connect with the, uh,
Microsoft Web server. So NCAT
dash V for the information.
Microsoft, the, the host and the port.
So look at now we are open connection for the,
this,
a i p here for those host for this part here
is a, a http, uh, web server, and the connection is open.
Okay? So it's okay.
We don't have a lot of information with this connection.
So let me close this connection here and we can use some,
some options to get more details about this disconnect.
So when we are connecting with this, the web server,
the web server is waiting for some request.
So we can use some messengers.
And all these messengers has a, a, a format. Okay?
Here we are talking about the, the headers.
We have some formalization for this message.
And the header is the beginning of our request are all our response.
So when the device and, uh,
server are talking are exchanging messengers,
we have to follow some, some protocols. So in this case,
we can use beginning of a protocol. We can use, uh,
ahead to get more information about the server, for example.
And we can use our option here. So I will print, uh,
I will compose ahead and use as input
from my connection from Net cat. So format is like this.
I'm using this information here. I'm composing, uh,
the beginning of a header here.
I'm saying what the, the verb, what's the,
the beginning of my head with a head. Okay.
Could be a post or a get, for example. So my option here is head,
I'm, uh, specializing the version of the http, okay?
The protocol that we are using to connect with the web server.
I'm specifying the host, host in our case here.
It's not local host, it's Microsoft
on the same here.
So this is the, the character to, to break line. Okay?
So I'm formatting my header.
So it's head http host.
Am I using this option here? I use the pipe
character here,
the pipe that mean that all information that that we have in the left will be,
uh, input for the common poll for the common on the right. Okay?
So this here will be, uh,
input from my comment here.
Okay? So let's try, okay,
look at now I have more information than before. Okay?
Now I have, uh, open connection.
This is a response from the server. Okay? The,
the communication works like this.
I have a request for the server and the server really respond.
Okay? Will send me a messenger. And so this is a format for the response,
H t p response. So the version,
the number here to 2000 and it's okay, is a,
a good response from the server. I have the type of the,
the response is a is a content type a text. We have, uh,
a tag here. We have, uh, information about the server
DyNet stores. This is a cloud, uh, platform service.
We have information through connection here. So keep alive.
That's mean that H T P is a stateless protocol, but, uh,
with some formation,
some we can stabilize a's like a fake connection,
but it's not a true connection. But, uh, uh, it's a kind of connection, okay?
And the, the time. So with this option here,
I was able to get more information about my server. So this is, uh,
uh, what grabbing really is,
is to get more little information from here, from that to compose all my,
my scan, my collection of information. Okay?
So now we can move to the other example.
As we saw before, we have some, some services, okay?
And the point here is to get more details about this.
So continuing the http server in Linux,
we have the full http server called Apache.
So let's verify, for example,
my Apache is if my Apache is running or not.
So I will verify, I verify the service.
I'll get a detail, uh, status of Apache. So my Apache is disabled right now.
So let me start it. Okay.
So now I have Apache service web server running.
And let me connect me this Apache to verify if I'm able to
get more details about the version, for example, of the service.
So I will execute a net, get, uh, connection,
get to verify if it's open or not.
In this time, I was able to get to connect with the Apache.
I can use another, uh, option that we saw in the last video about the dash Z.
Only to verify is, is a scan, okay? To verify,
see if he's open or not. If I remove the Z,
I'm connect with the service. Okay? If I use the Z dash z,
I'm, I'm not connect. I'm not connect. I'm only to get the, the status.
So here,
I'll use the same option that I use it to connect and to access more information
about the Microsoft web server.
So I use this format here, but now I will change the host.
I'll use local host
from my net CAT connection, common
and in my, uh, header, okay?
Apache is h p web server. So I use the same, uh,
option here. I use, I will send a message, a request. My request would be
not, I get from some resource, but to get only the head,
that's mean the beginning of the messenger. So
this was a bad format. This is our response from the server.
But this is the information here. I'm able to get
a version of this Apache web server. So this is bunny grabbing.
I'm getting all the detail, could be big information on, uh, uh,
a little information.
But I was able now to get the version of this Apache running
in this service. And for next example,
lets me connect to the SS s H service, uh, here, my Linux,
my current, my current Linux environment.
So let me verify if the A S S
S H is connected, no is disabled.
So let me start it, this service, okay,
now let me, okay,
now my service A S S H service is running. Okay?
And I'll connect
with this service is is local host,
and I used the port 22 dash
Z. So now I'm able to see that it's open.
That's mean that this service is, is run. Okay?
Here we have two jobs to get this information or doing a
netcat like this or checking a status. Okay?
And now I will connect,
I'll connect the s ss h service to try to get more
information about this. It's local.
My host is local host and the, the,
the port for s s h H 22.
Now I'm connected in this port and I here is,
I was able to see the version of these services.
Okay? So I'm getting information and composing all the, the,
the information list that I have for the next step to planning all
my penetration task, the thread model, for example,
or the payload or how the,
or which tool I can use to explore more information about the sales.
In this video, we saw how we can do bundle grabbing using netcat.
The next video, we'll take a look in sniffing packet in Netcat.
Hope to see you there.