Hello, everyone.
So in this video we are going to see an
amazing software, which is n diff.
This particular tool is used for seeing the
difference in nmaps output.
One of the amazing tool that I constantly use
for my Recon process.
wherein
let's say I have scanned a particular Target and I
have enumerated all the ports as well as
the services which are running one month ago.
Let's say today. There is a exploit which
has come for that particular version of
software, which is running on that particular Target.
I again scan that particular Target and I
do the comparison between both.
The output that I've saved into my computer and
I come to know okay, so they have opened some
New Ports or they have closed some old ports. Also
they have opened some vulnerable New Ports
and they have installed some applications or they have
upgraded or degraded like that so I can
constantly keep a watch.
and monitor
the ports
the services
and if there are any new changes on to
that particular Target server.
So, let's see quickly. How can we achieve that?
So what I have done is on my computer. I have opened
up a port which is Port 80. And also I have
put open a port which is Port 1337.
So let us quickly scan.
our Local Host machine
So I'm making a folder and I'm going
to run all my scans from this folder, which is n diff.
Okay, so I'm going to scan my local
machine using.
Hyphen, f which is fast scan.
hyphen SV to see the output in
Version detection mode hyphen V to see the output
inverse mode and let me save the output in XML
format. Let's say the file name is XML.
Output 1.xml. Okay, let's wait
for this can to complete.
And then what we are going to do is we are going to stop this
particular port.
And we are going to scan again. Our localhost machine save
the output this time as XML output
2.xml and then do a comparison.
I know that doing the comparison by our Naked Eyes
is very different as we will not be able to make out the difference.
That's why we are going to do the comparison
using n-diff.
so
we have run this command and we have got the output. So let's
quickly stop this particular Port from running.
So we are going to stop it as you can see we stopped
it give a keyboard interrupt and now we
are going to
scan again, but we are going to save the
output into a new file, which is
XML output two dot XML this
time.
Okay, this the scan is running and the new
output is being saved into the new file. Once
the scan has been successfully completed. We
are going to do comparison of both the
output of the XML using NF and
we will understand that is and
if able to catch the difference between both the XML formats.
So here we go. We have seen the output.
The scan has successfully completed. Let me
clear the screen and let me start n diff.
So the syntax of using and diff is very
very simple. You just have to type end. If you do
not have to do any installation. It comes free installed with
nmap whenever you do a installation of nmap. This
automatically gets installed.
All right. So the first XML file
The first output file which is XML op1.xml and
the second output XML file.
Then you just have to hit enter and you can see the compad output
over here as you can see over here.
The first is
the end map scan which rain on for 356 as
you can see the time over here and the next is at
four four seven.
All right.
So this two scans the comparison which we
are going to look as you can see there is a difference not show
96 close ports and then 97 close
ports one close Port increase because
we deliberately closed one of
the port that was Port 80 that we started using the
python server.
As we can see the result over here first Port
80 was open and the difference is
actually the port 80 between both of them as
you can see over here. The simple HTTP server
was running then it suddenly stopped.
This is the same between both of them as you can see both
were running fine on Port 88 only.
The difference was Port 80 was found
to be closed into the second output XML.
So this is how you can do comparison of two particular
outputs at two different times. You can
utilize this for your recon purposes as well.
Whenever you are scanning a Target later on after a
month or two month you go back.
You scan it you go back to the first output you
do the comparison and you come to know if they have
applied any changes into their production server.
So I hope you guys understood this and it will be very helpful
for every one of you for your recon for pen
testing as well as bug Bounty. Thank you.