‫So remember that while performing a penetration test, we should always test the network devices, whether
‫they're vulnerable to attacks, all the ones we've mentioned up until now.
‫Of course, we have to discover the network devices and the services running on them first.
‫So let's see how we discover network devices and their services.
‫And what else we can do to attack these services?
‫Come on, it'll be fun.
‫So as you already know, the first step of a penetration test is always reconnaissance.
‫In other words, gathering the information, so how can we collect information about the network devices?
‫The answer is the same with a reconnaissance of all the other parts of the penetration tests.
‫We can scan the network and find the network devices according to the fingerprints or operating systems
‫of the devices found.
‫For example, if the operating system of a device is Cisco iOS, it's most probably a network device
‫such as a switch or router.
‫Sniffing is another way to collect data about the network devices.
‫You should always especially focus on the clear text services such as Telnet.
‫Now, one of the brilliant ways of reconnaissance is analyzing the documents collected throughout the
‫penetration test in a typical penetration test.
‫You probably find a lot of sensitive information by just looking at the file servers, shared files
‫and email backups or unprotected ASCII files of compromised admin personal computers.
‫So as we were saying before, the most common services open in the network devices are S.H. Telnet http
‫https.
‫And as an MP.
‫And the default ports of these services are enlisted in this line.
‫I want to call your attention to these are the default ports, right, so they don't have to run on
‫the specified port.
‫You can run an SSA service on Port 443 or an HD service on the port.
‫I don't know.
‫Three, two, one, etc. And you can discover more details about the network devices by analyzing these
‫services deeply.
‫Right, and now you have the correct result and discover even more, you should always scan network
‫with OS discovery and version detection options.
‫So if you look at the example in the slide again, you see an in map command and map is a security scanner,
‫which is used to discover hosts and services on a computer network.
‫In the same sample command shown the parameter is used for OAC detection, while as a score V is used
‫for version detection.
‫Great.
‫So just listen to the traffic.
‫We can gather some information about the network devices here, the protocols which use clear text communication
‫are especially important because you can see the payload data transferred between the endpoints.
‫The most important clear text protocols are Telnet.
‫Cisco Discovery Protocol.
‫Spanning tree protocol.
‫Routing protocols.
‫Velan trunking protocol and.
‫Simple Network Management Protocol.
‫So let's scan the router according to the criteria that we talked about up till now.
‫In Cali, I opened a terminal screen, so I'll use the end map to scan the router, but first.
‫Let's go ahead and ping the router to check the network.
‫And it's OK.
‫So in Mab is the command itself.
‫As ever, score is to make it a sin scan, a sin scan is a kind of TCP scan where three way handshake
‫is not completed.
‫Target IP is our router.
‫S Upper Score V is for the version detection of the open ports.
‫Oh, for the operating system detection.
‫Reason is to force and map to tell the reason of its decisions.
‫And P is for the ports.
‫So let's scan, assess each tellement each keeps its GDP and as an imports now hit enter.
‫So that took 15 seconds.
‫It seems the only port open is the Telnet.
‫Here's the post details.
‫It is a Cisco device and one of these series.