Hello everybody and welcome back to the.
Part Three tutorial of a map.
Now we will cover some of the more advanced scans that we will use in order to figure out for example
depression or process running on a particular open port.
So let's just type here once again and map in order to see our available options and let us for example
try to detect the operating system running on my vendor's machine.
Now as in the previous video the IP address of my windows machine is 192 that 168 that one that for
so we will find here the option for the operating system which is I believe minus.
Oh here we go.
Says enable always detection.
Now you can add some of these specific options as it says right here or says scan limit.
Limit those detection to promising targets or a guess or is more aggressively.
So we will just type here.
The basic math which is just minus.
Oh so here we just type here and map minus 0 and then the 182 that 168 that one for which is my window
stat machine.
Now we can press the upper arrow in order to see how long it will take.
And it should finish any second right now and we can see right here.
These are the open ports the MAC address right here.
Warning always results may be unreliable because we could not find at least one open and one closed
port device type general purpose.
And it is just saying right here running.
Just guessing Microsoft Windows XP.
Now as you can see this is wrong right here.
I am not running the XP.
I am running Windows 10.
So this scan can be wrong and sometimes it doesn't get 100 percent every time you scan it.
Now it does gets most of the time.
But as we can see right here it didn't get it right now.
Now we can see the that it keeps us some of the other options as well such as aggressive always guesses
which is Microsoft Windows XP XP to Microsoft Windows Server or Microsoft Windows in 2008.
We can see that none of this is true so this scan didn't work for us.
Let me just clear right here but let us just try to for example scan the operating system of my own
Linux machine which is on my laptop.
The IP address of my laptop is ninety 92 that on 68 that on the 15th.
Let's just paste that right here
here.
Yes we forgot to specify the minus 0 which stands for the operating system scan.
So let's just see right here.
And as we can see it says it is running Linux which is correct.
So basically it will just print to the open ports the MAC address and the guess of the operating system
that the target is running.
Now you can also do as we can see right here we can try to candy.
Can we talk about that.
OK.
Or we can also try to scan the metals printable.
So basically once you open limitless collectible since you don't have it open right now just type here
in the command line.
Once you logged in with the user name and password MSF admin and NSF admin just type there I have config
and basically find out what the IP addresses on the methods potable and just use it from your clinic's
machine in the net and scan.
So right here let me just check out the site name once again since I was can this one which is copied
it will type here and map minus 0 and then we paste the site name.
Well let's find out what operating system is running on that Web site
now since this is not in my local network.
This will take longer to finish as you notice right here but not too long.
It should finish any second right now.
But that is just wait for this to finish so we can see our output and the scan has finished.
This can mean that and that org.
We also got all these ports open which we also saw in the previous videos and we got the operating system
and it says just guessing Linux.
Now it is probably running Linux but we cannot that with 100 percent since I don't own that machine
and I don't know what type of Linux does it have as it says right here aggressive always guesses.
Linux 4.0 for 89 percent now let's see some of the other options.
We can also use instead of the operating system we can cover the minus as sweet as we can see it is
the service and version detection as we probe open ports to determine service version info.
There are also some of the other options right here for the SB for the S3 option but we go for now on
just use D minus XP.
So let me scan once again my Windows 10 machine so minus Asli will also type here D minus 40 verbosity
and we will take you 190 to that 168 that one that for which is the IP address of my windows time machine.
Now as I said before you can either scan their website candidate and talk your host machine or your
methods portable in order to check out the output of this again.
So let us see right here.
It prints us the open port as we remember those are these three and hopefully it will print out the
version of these services running there.
And as we can see it does.
And right here we have on the open port Microsoft the S which is the service the version is Microsoft
Windows 7 minus 10 Microsoft the s workgroup workgroup diversion for the Net bias minus 5 percent is
Microsoft Windows.
Net bias minus a percent so as we previously saw the we can't even get some of the information from
the bullshit scan as we saw in the previous scan the operating system scan it said For my window 10
machine that it was XP and right here when we kept the invasion we can see Microsoft Windows 7 minus
10 Microsoft.
So basically we can notice from that that some of the operating system scans are not really correct.
And you can use the common sense which says Well most of the people today don't even use Windows XP
since you since it is basically an open machine.
So now that we checked out the version of services running on my windows hosts let's check out the service
and versions running on this can meet and map dot org.
So we will type once again minus a suite for scanning the versions and then the name of the website
as you may have noticed the map can take the website name and the IP address as well.
Doesn't just have to be the IP address.
We can also type here the domain name as you can see and it will work properly so let's just see what
percentage is this currently it doesn't want to show us.
But it should be over soon
and scan has finished for these can mean that and up the talk and we can see that only the open ports
got the version which is normal since in the filter ports they have probably a firewall that is blocking
our packets in order to find out what version they're running so we can see on open ports which is 22
and 80 which is for the SSA which we can see the diversion they're running is open a say six six point
six point one two one two.
And on the 80 DCP open port we can see the Apache two point four point seven on the open to so as we
did in previous video if you for example wanted to write that into a file just type here two arrows
and then results topped the same.
Now we won't be doing that since I already showed you how to do that.
We can cover one more option in this tutorial which will be D minus a option as we can see it basically
does multiple things such as enable or is detection vision detection script scanning and Trace throughout.
So this will and this will enable the detection to also print out the vision of the services and it
will also scan for some of the scripts and we can see right here if we type here and map minus three
minus capital eight and then scan me and map the org we can see if the results from this can will differ
from the result of the previous scan now this game can take a little bit longer since it is scanning
for the for multiple stuff instead of just a single star such as for example the operating system scan.
This is scanning operating system and version and script and trace right.
So it will take a little bit longer as we can see it is discovering ports at the moment.
And now the scanning services basically determining what version are they running.
And now it is ignition code detection as we can see right here.
Try one trade too OK.
It should be finishing soon enough.
It says that the only 37 percent has finished
OK it should finish right here.
Yeah it's finished.
So with you can see that this print printed out a bunch of the options.
For example here under the DCP SS each port we see the SSA Jakosky which is right here I think that
in the previous in the previous scan we even saw the 25 DCP port which is checkout doesn't even matter.
I can't remember it.
It was probably there and under the open SDP Apache port we can also see the version and also here under
the port 80 which is the Apache P two point four point seven a one two we can see these supported methods
on the website which are options get set post.
Now these are this is the information that we didn't really see in any of the previous scans so let
me just check out what else we have here as well as the.
So here we have the standard always detection which is Linux four point four on the eighty nine percent.
And here we have the trace right now Chris Stroud is basically the path that my vector machine took
in order to connect to the end map so we can see that we are familiar with the first ip address that
it took which is my router.
So basically it is normal to have your writer router as a first starting point in the trace route and
then it proceeded to other DNS servers in order to find out the IP address on the end map.
So Trace rank can be useful sometimes mostly in troubleshooting but it can be used for other things
as well.
We can see that the end may have finished one IP address in seventy four seconds which is pretty good.
Most of the map scans can take a lot longer.
Even a few hours so from now on we will just finish that story right here and I will see you in the
end map for tutorial in the next lecture.
Now I hope you're having a great day and take care.