‫One of the very first steps in any network reconnaissance mission is to reduce a set of IP ranges into
‫a list of active or interesting hosts.
‫Scanning every port of every single IP address is slow and usually unnecessary in no port scan option.
‫Using an option which was known as S.P. in previous releases, you tell and map not to do a port scan
‫after host discovery and only print out the available hosts that responded to the host discovery probes.
‫This scan type is often known as a ping scan.
‫Systems administrators often find this option valuable as well.
‫It can easily be used to count available machines on a network or monitor server availability.
‫This is often called a ping suite and is more reliable than pinging the broadcast address because many
‫hosts do not reply to broadcast queries.
‫The default host discovery done with S.N. is executed by a privileged user it sends.
‫An ICMP echo request.
‫TCP syn packet to Port 443.
‫TCP X-Pac at the Port 80.
‫And an ICMP time request by default.
‫When executed by an unprivileged user, only sin packets are sent using a connect call the ports 80
‫and 443 on the target when a privileged user tries to scan targets on a local ethernet network, our
‫requests are used unless send IP were specified.
‫Let's perform the first and map scans of the course using Ping Scan, also known as no port scan and
‫map, is embedded in collie and defined in the path so you can run and map from anywhere just by typing
‫and map in a terminal screen.
‫When you type in map and hit enter, you get the help page of the map.
‫You can also look at the man page by typing men and map to learn more.
‫Let's build an and map command to perform a ping scan.
‫After the command itself and map, I first had the parameter to define the scan type as ping scan.
‫Note that the order of the parameters is not important and in.
‫Now, enter the only mandatory parameter IP address here, INR one seven two one six nine nine eight
‫zero slash two four network gurus already know what it is.
‫Keeping it very simple, it means the IP addresses between one seven two one six nine nine zero and
‫one seven two eight one six nine nine two five five.
‫That's enough.
‫Hit, enter and run the command.
‫And the results are in.
‫These are the hosts which are up, that means these are the systems that responded to our request.
‫Remember, from the previous slide, our requests are ICMP Echo Sin for Port 443, CQC Report 80 and
‫ICMP timestamp requests.
‫If the user is privileged, the IP addresses or the domain names of the systems are spread across a
‫line.
‫In most cases, we want to see the IP addresses of the host as a list to use and further scans.
‫So what can we do to see only the IP addresses of the live systems?
‫Well, we're going to use the power of the Linux Command Shell.
‫First, let's clear some lines of the result, which do not contain IP addresses, so we'll only have
‫the lines of IP addresses to be able to do this.
‫I'll use grep command with pipe.
‫Copy a static part of the IP lines, for example, and map scan and give it as a parameter of grep command.
‫Let me give you a little tip here if you're using a mouse.
‫Select a string in the terminal screen and press the middle button of the mouse to copy and paste the
‫selected part.
‫Now, we only have the lines which contain the IP addresses.
‫But wait a second, we have a domain name of a host.
‫Let's get rid of the domain name and see only the IP address of it.
‫And then map command and dash and parameter to avoid the name resolution.
‫So a map will display only the IP address.
‫Now we have the lines with IP addresses.
‫Now the second step is to clear the words in the lines to have only the IP addresses.
‫To do this will use a cut command of the Linux shell.
‫Type cut.
‫Delimiter here is the space character, give it with the D parameter.
‫IP is the.
‫Fifth field of the line, give it with F parameter.
‫Now we have the IP list of the live hosts.