Hello everybody and welcome back.
And in this story we will continue with some of the other options that our map allows us and you might
be asking why are we covering all these options for that map.
Well basically it is a really important tool and knowing all these options will make you at least 50
percent better in penetration testing since scanning is a really important part of performing an penetration
test so let us right here just open up our terminal.
Let me make it this big and in the other terminal right here
I will open up the commands at once can no commands at 60.
Where are we right.
All of the map commands that we cover in this particular editorial.
So that is just up here on CNN map.
And the first thing we want to check out is the minus key and the command.
Now we can find it right here or.
For example let's say you can't find a specific command in these bunch of the commands.
You can just type here and map and then grep minus p and just find your minus minus pen and to show
us not like that they did not want that to happen.
We just Oh yes.
And Matthew does this help Rep. Pete Van your boy doesn't that only
Yeah.
Never mind.
For some reason that worked yesterday but doesn't want to work now so it doesn't really matter.
Just find the command right here let me just find it.
It should be minus capital P and then and here it is treat all hosts as online ski post discovery.
Now this is an important comment.
You might be asking why.
Well some of the posts that you scan on the network can appear to be off line.
So for example if you know a specific course must be running and is online but let's say you scan it
right here and it says that it is offline.
Now this small laptop so it will say that it is online.
The moment.
I've had some scans that basically said that my machine that I was scanning which was right next to
me and which was connected to the Internet and to the network and running basically said that the host
was down and every time I specified the minus p an option it basically skips the whole discovery and
the as it says treats all hosts on the network as if they were online which will perform the scan and
it will give you the results without it without whose discovery.
So let's say for example I scan this IP address which I don't have anything wrong on it so it will say
that the host is down as you can see right here zero hosts up.
This will be the same output for the machine that is running but it is blocking the ping requests or
it is showing other machines that it's off line.
So in that case which specified the minus pen option and then you specify the IP address and it will
show as if it is online.
Now in my case it won't show since I don't have anything there so let me just can my laptop.
Once again I just typed here and map minus pen.
And then one night to that 168 that one that eight.
And it will skip the whole discovery and it will basically automatically say that my host is up and
running and it will scan for its open ports.
Now let me just see it has finished around 22 percent.
You might notice that the scan is going a little bit slower
so we won't be waiting for that to finish.
There is no point or we can just leave it right here.
Perhaps it finishes while I type it right here.
So minus pen and then the IP address basically the IP address of any machine that you're scanning or
any website that you're scanning of course trying not to scan the websites that you do not have permission
on.
You can always use the scan me the DOT and map dot org which we have permission to scan by and map.
Well you can basically just use the methods point the political machine that we installed or you can
install basically any other virtual machine that you will use in order to scan and and attack now since
I can't really run matters collectable.
It gives me some error.
I downloaded another machine to show you how to install and I will show you why we will use it.
Basically we will use it extensively in the website penetration testing part.
I'm not really sure if Matt supportable has always in it installed I doubt.
So you can check out if it has that and then you don't need to install this little machine as well but
if it doesn't you should install this virtual machine as it is vulnerable and it is used for that penetration
testing.
So we will cover some of the attacks on the Web sites using this machine.
But let us see right here.
As you can see the D scan has finished and it treated our hosts was up and it discovered an open port.
It all scaled back.
The MAC address.
It is a useful command if you know that the host is running and it is showing that it is offline.
You just type your minus pen and you will have your host scanned now.
The next option I want to show you which I didn't show you before.
If we type your map would be a minus as Steve's comment.
If we go up here and find the minus as you can see that it is basically our fault DCP scan let me just
find it.
Right here we have the ESU as an SS.
Here it is.
We can see a bunch of these options.
We will only cover first these three basically but for now let's just cover the SD which if you look
brighter here it is basically a connection now connection.
It means that the it performs the full three way handshake in order to scan the target.
Now as we talked before the DCP connection requires three way handshake.
So let me just open up a pin so I can show you better.
For example let's say you have a P.C. right here
and you have another P.C. right here.
So basically just laptops
since I'm not really sure how to drop pieces that is just this is P.C. a and this is PCV.
Let's say the PCV is your target and you scan from the computer.
Now in order to if and when you use the minus as the option so minus as t option it basically performs
a three way handshake scan with the DCP which is basically ascending bit set called sin
then the other machine is sending us the bits that called Sin EQ which is basically same as sin
in order for you to learn more about this and to know what I'm talking about right here.
You should read more about the DCP and UDP scans and DCP and UDP connections.
I talked briefly about it in the previous tutorials but you might need to know a little bit more in
order to understand how these scans work.
So that it is not that complicated.
And then the scan finishes with only EQ I don't have work to write it but this that is basically the
three way handshake.
So it is seen Sinek.
And then once again ask why is it called three ways a handshake because it is consistent from three
parts.
As you can see right here seen Sinek and then once again ask just ask So the mine safety option in a
map performs all of these three and therefore it can be detected on the target machine as you perform
the full connection on the system but it is also more accurate option for scanning since if you were
to complete only the sin it won't be able to gather as much information and as accurate information
as you would be able together with the four DCP through a handshake
for if you want your target to not be able to detect you you shouldn't be using the minus as these things.
It is very detectable.
As I said since you used the faulty DCP handshake.
So let me just type here and map my necessity and then we can just type here.
The 182 that 168 138 and it will basically give us the same output as this option right here.
But here you specified it to use the full three way handshake
and this is the option that would give you the most accurate and precise results.
So let me just see here it is.
It finished with the same result as the previous scan.
So we have one DCP open port so let me just write it right here and that minus SD.
When I get to that 168 138.
So we covered the full DCP connection scan now.
The next thing I want to basically cover is the minus SS scan.
So let me just open up here minus SS is only the first part of the minus SD let me just explain that
a little bit better.
As you can see T minus SD is a full connect and the minus SS is the DCP only seen bits set.
So basically in order for us to scan we will only be sending this first part of the three way handshake
that's why it is specified as minus SS the capital S stands for sin right here.
Now the thing about since scanning is it isn't detectable on the target host.
So this is a you can use that option in order to prevent the target from protecting your scan because
it won't really complete the handshake but it is less accurate and it can also be detected by your IBS.
Now we will talk in the next story on how to avoid the IP detection how to avoid some of the defenses
that could be implemented into your rather.
For example in order to block uh or send uh false information onto your end maps can so let us perform
the SS scan here for the base we type here and map minus SS and then the IP address of our laptop or
basically any machine or website that you're scanning
this is a little bit taking a little longer than the minus as these can probably because it takes a
lot long time in order for it to get them the same information that get there while using the full DCP
handshakes can
so we will wait for this to finish in order to see what the results are.
And if they are the same as D minus SD option.
So while this is running I will just type here minus SS 192 at 168.
That one that 8 now while this is 45 percent OK.
All this is doing let's recap so minus be an option as we said is used when the hosts appear down you
might assess the option is a three way handshake DCP connection to the host and it is detectable and
more accurate in minus SS scan performed.
The only first part of the three way handshake which is the second part it is not detectable on the
host.
It is less accurate and it can be detected by your IBS so as we can see the scan has finished and it
gave us the same output as T minus SD scan which is good.
We have one open port and we have the service running on it.
So let us just type here once again and map.
There is one more option I want to show you.
Before we finish this trial which is the minus as you option if we go right here you can see the minus
as you option is basically only UDP scan all of these three options.
Well basically all of these five right here perform the DCP scan or basically a part of DCP scan as
well as some of these right here.
And if you specify the minus as you option it will only perform UDP scan now as we talked before UDP
his connection less and we won't have any confirmation that the packets arrived at our target.
It is not consisted of three way handshake or basically it is not consisted of any handshake we simply
with UDP just send packets to the other hosts and hope that they go get there intact and whole.
So let let's just right here use the UDP scan so we specify it the minus as you option you Stansberry
the P and we type here our IP address lets see how long this will take as we can see it won't finish
that first.
This is also a slower scan.
So let that just write it right here.
So we can see which ones we covered
and my advice would be to use minus as to when it doesn't really matter it the tax you and if you are
performing a penetration test for example where the target shouldn't be able to detect you.
You can use T minus SS can or you can use some of the scans that are some of the options for scans that
will show you in the next material in order to make your scan even less detectable.
So let me just see where this is set at 62 percent so I will cut editorial right here and I will show
you the output of this command in the next one as well as some of the other options that we will cover.
So I hope you enjoyed this lecture and I hope I see you in the next one by.