‫So a few years ago, we saw how we identify which ports are scanned now and input management.
‫We'll see how we identify which systems are scanned.
‫OK, go to Carly and open a terminal window.
‫First, I'll prepare an end map query and because I'll play with the destination apps.
‫It will be the last parameter of my query.
‫And map is the command itself.
‫And to close the name resolution, a case penned to close Ping as upper case as first since scan now
‫to keep it simple.
‫Let's scan just the top three sports.
‫Now is the time to identify the destination systems.
‫Up to now, we learned to scan a single IP.
‫And we learned how to scan an entire sea block that zero through 24.
‫OK, so what are the other ways of identifying target systems?
‫You can select a range of any part of the IP address in the slide, the third and the fourth parts of
‫the IP address is given as ranges.
‫That means End Map will scan IPS from one nine two to one six eight eight one zero two one nine two
‫one six eight two five five two five five.
‫I'd like to keep the rain small.
‫I'll only define a range for the fourth part of the destination address from 100 to 150.
‫There's only one machine between one seven two one six nine nine one zero zero and one seven two one
‫six nine nine point one five zero.
‫You can scan more than one IP block in a single query example, and the slide scans two ranges.
‫The first ranges between one nine two point one six eight one zero and one nine two point one six eight
‫one two five five.
‫And the second range is between 10.0 Dot 0.0 and 10.0 got 255 Dot 255.
‫Since I don't have a second network, all my colleagues, I continue with a third example.
‫The third example is a combination of defining a range and a single number.
‫For example, you can scan the is between 100 and one for zero IP, two zero six and the IP between
‫two to zero and two three zero.
‫So here are the results and Map found a machine from the range of 100 through one four zero.
‫The machine with IP two, zero six.
‫And another machine from the range of two to zero through two three zero.
‫Another way to define the target systems is to give and map the IP addresses in a fire.
‫And a typical penetration test or ethical hacking, you will scan a network a lot of times first you
‫find the hosts.
‫It doesn't make sense to scan the entire network again and again you'll see huge networks.
‫So if you scan the entire network each time, the pen test will take a lot longer than you think.
‫Let's open a second terminal screen and find the host of our IP block using Ping Scan, as we learned
‫before.
‫Now clarify the output to have only the IP addresses of live hosts.
‫GREP command to get only the rows containing IP addresses.
‫And cut command to get only the IP addresses from Arroyo.
‫Now we can redirect the output into a text file to re-use the list and following queries.
‫But first, let me close a name resolution now put a greater than character and give a file name to
‫write the result.
‫IP list that text.
‫We're not interested in the first two IP addresses, so let's edit the file and delete them.
‫I use Nano Text Editor to edit the file.
‫In nano use control K to delete a line.
‫Use Control X to exit nano press.
‫Y to save changes and hit enter to save on the same file type cat.
‫IP list text to look at the file again.
‫Now we have four IP addresses in the file.
‫Let's create a new map query, and this time let's give the destination systems in a file IP list.
‫And here are the results of the four systems which are listed in the AP list that file.
‫So let's talk about the output management in a map now up to now we've run a lot of map queries and
‫got the results on the terminal screen.
‫This is the default output behavior called interactive output, and it is sent to standard output study
‫out in a penetration test.
‫We should say the results of the queries to be able to analyze them later on, hopefully, and map as
‫its own output management skills.
‫So let's have a look.
‫There are three major outputs saving formats and then map.
‫Normal output, which is similar to interactive output.
‫That's what you see on the screen up to now, except that it displays less run time information and
‫morning since it is expected to be analyzed after the scan completes rather than interactively.
‫Graspable output, which includes most information for target host on a single line, so you can use
‫it to collect the information you want using the excellent grip command, we've already seen a few examples
‫of grab command in this course.
‫Maximal output is one of the most important output takes, as it can be converted to your mill easily
‫passed by programs such as in graphical user interfaces or imported into databases.
‫There is one more magic parameter which is oh uppercase a to let you generate the output in all formats.
‫Now let's see the map output management in action.
‫Go to college and open a terminal screen.
‫Prepare an end map query for this example.
‫I want to prepare a skin scan.
‫Now we're ready for output management options.
‫First, I want to generate the XML output using oh uppercase x parameter o uppercase x parameter needs
‫the output file name.
‫You can give the file name with a full path if you don't specify a path, just as in this example,
‫the file is created in the current folder.
‫Be careful.
‫000X, OGE and Olwen parameters require the full file name.
‫So if you want the file to have an extension such as got XML, you should specify it here it enter to
‫run the command.
‫To see the generated file.
‫Here it is.
‫And use the less command to see the content of the file, so it's typical XML file with tags.
‫Here's a host tag, starts and ends.
‫All the results about a host is listed between the start tag and the end tag, IP address and ports
‫and of course, the scan result.
‫Here is another host tag in the scan results of the second host as well.
‫Rescue to quit.
‫Less command.
‫Now, let's call back our map query with the up down arrow keys of the keyboard.
‫Now I want to generate all types of outputs.
‫Type o upper case A.
‫And the base name of the files.
‫Be careful.
‫Oh, upper case.
‫A parameter requires the base file name of the files, not the full names of a file, and it'll put
‫the file extensions itself.
‫Let's look at the content of that Ben Map file using the less Linux command.
‫This is almost the same as you'll see on the screen.
‫Now let's look at the grapple output.
‫Here there are two lines for each host.
‫One to show the status of the host.
‫And another one to show the port scan results.