Hello everybody and welcome back to the last part of the map scanning tutorials.
Now in this tutorial we will download some of our own scripts and we will run them against our target
in order to discover some deep vulnerabilities it might have.
Now once you finish this tutorial right here you will know more than 80 percent of people that use and
map.
And it is really essential for you to get this to a right.
So you can perform your scans at the best so first of all let us change the directory to the end map
scripts directories.
So it is user share and map scripts.
If you type your unless we have here a bunch of scripts and mostly is read here which is CV e 2015 and
then some number are certain vulnerabilities that were discovered in the age of this number.
So basically this one was from 2017.
This one was from 2000 thousand fifteen and so on and so on.
But we want to discover all of the vulnerabilities that could occur in a certain target.
So for that we want to download some of our own scripts.
So just open up Firefox and opened up a new tab and just typed here folks can get up once it loads up
the page and we want to click on the first link which will later lead us to the UK repository for this
script.
So just click here on the first thing.
And here we are on the github repository of this and my portability scanner as you can see right here
we have the usage which we will cover after we download this script.
Now in order to download this hour we show you in the previous videos you just copy the link right here
and we will use the it uh program that we already installed.
Let me just change my directory and it's not there.
Kick this in the road.
So let's put it.
Let's let's just delete these two files from previous videos.
We do not need them anymore and we what do we want to type here.
Get clone and then we paste the link that we copy and then we add dot to get
now.
It will take some time to download this.
And once it finishes we will have our script installed on our calendars machine
I believe it will finish here.
Here it is.
And if we type here unless we can see the full scan is right here as a directory in order to go to it
we just type here see the old scan and we can see a bunch of files that eat that we got with it.
But this isn't the only program I want to install right now we want to install another script so open
up your Firefox once again add a second tab and just type here and map all nurse.
And then once again type here get her so it will once again lead you to this page and you just want
to click here on the first link which is from the github Web site.
The procedure is same such as crop copy the link of the page go to your directory.
So it can just go on directory back and make sure we're in the same directory where was.
Can Just take your kid clone paste your link right here and add dot kids to it it will also download
the direct and the script into our directory and we will be good to go so as we can see this one has
finished faster than the previous one so right now we should have both of them both of these scripts
in our directory as we can see right here we have we'll scan and we also have map owners no let us make
directories and map scripts
in order to put them both into that directory.
So we will have them like this right here.
So let me just move foreskin into unmapped scripts of self-interest and move to the and that all nurse
into any scripts and right here we should only have the map scripts file and if we change our directory
to it we'll have our both scripts right here.
So now that we downloaded it and now we can run them.
So in order to run them we use the same command that we used in the previous video.
So and map there's this script and right here instead of typing the equals sign which we would which
we would use in order to specify one script we want to remove the equal sign and just put his case and
just appear both can and and map Warner's as we can see right here with specified two scripts instead
of one and it will use both of them in order to discover the vulnerabilities.
So after this we want to add minus speed in order to discover the Virgin of the services running on
open ports.
And right here we want to also add the IP address of the target.
So let me just check once again.
What was the IP address of this target.
It was not Windows 7.
So here with type 1 Let's do that 168.
That one that's seven.
And we let this run.
So let me just enlarge this.
This could take some time but not too long.
It should finish relatively fast and it will print out punch of equal abilities that it found on this
target.
Now I know that this target is vulnerable since it is made portable in order for us to test it and we
can see that we got the different output from previous scans.
So here we have open ports and these vulnerabilities as it says right here.
If you see no findings it means it didn't find any vulnerabilities on this specific port and basically
uses a bunch of these Web sites in order to scan for different abilities.
And if you scroll up we can see that the on the DCP open port which is running Apache.
It found a bunch of abilities right here now you can test these scripts on your own machine in order
to find out if your P.C. has of vulnerabilities but basically even mine has some of the more abilities
that go up to five sometimes seven point five.
But mostly these aren't so dangerous.
These that are low numbers.
This is basically a mark for the vulnerabilities.
So if it is 1.0 it is a really small vulnerability but it is still there.
And it is ten point 0.
It is basically an easy exploited vulnerability.
So if you just find something like this you need to update your device as soon as possible or in this
case the in this case attach it to since it is found on the port 80.
Let us just see if there is anything else and we can see also also on the sage port it found some optical
abilities which are so highly rated but they are still there.
And also once you find something like this you can basically just copy this link right here which will
lead you to a page in Firefox if you paste it you just open a new tab and paste the link from the vulnerability
and it will open up the page where it will describe in greater details the possibility that he discovered.
So here we can see the mark which extend the access complexity is low the confidentiality is complete
and the integrity is complete and the availability is complete
in the description.
You can check out what the vulnerabilities which in this case its model are crew in 32 in something
something something let us just not read all these numbers when running on Windows does not ensure that
request processing is complete before calling is AP unload for is a pitot yellow module which allows
remote attackers to execute arbitrary code where unspecified vectors related to a crafted request a
reset packet and often call it pointers.
Now this is basically of an ability.
And if you wanted to for example exploit it could basically just copy the name of the invulnerability
which in our case is this one.
So just copy and you can just go onto the Google paste that vulnerability and tax your exploit and hope
that you will find something or someone that already has written and exploit for this vulnerability
so we can just try to find it.
We know that is it is we can click on any link for example and try to find if anyone has written any
exploit for this now.
We do not want to go right here.
There probably is something but we won't really spend so much time trying to find it I will just check
out some of the links right here.
I agree.
Whatever.
Let's go so available exploits so we can just check here available exploits
and we have the module name for the Matus point program that we share and still covered.
So we won't be showing it right now but it's basically an auxiliary module which allows us to scan the
vulnerability that we just discovered in the method point framework
now we can also try to find the vulnerability with the name of the vulnerability itself but not like
this.
Let's like this Apache emote is a key exploit.
You can try to find something.
Let us check right here and here we found something which is basically c++ program that probably exploits
this vulnerability.
So here it is.
You could just copy this entire program and just paste it into C++ file compile that file and run it
and you would exploit the vulnerability of course you will need to change some of these certain things
right here for example ports IP addresses and so on.
But if you wanted to you could do that not really sure what it would give you but I believe it will
give you a reverse shell.
I'm not really sure what this vulnerability is.
So we want exploiting.
We won't be exploiting it right now since it requires an auxiliary module from the maximal framework
for now on.
We'll just leave it on here where we have all of these scans completed and you can also try to research
all these other vulnerabilities and see if there are any exploits written for them that you can use
but we will cover the exploitation in some of the future lectures from now on we just wanted to see
how we can scan the target for certain abilities and we did that.
So that's about it for this.
Now before I close this lecture and close the end of lecture there I just want to show you that there
is another tool that you can use if you want to.
It is basically almost the same as a map and it is almost the same called which is a map.
Now the map is basically also a scanner the different.
The difference is basically in just one letter.
It has some of the different syntax for the scanning part but if you want to you can check it out.
I won't be covering it since we covered a bigger tool which is an map and more useful tool.
You can cut it you can check out some of these options by yourself and you can use this as well if you
want to but that would be it for these materials if you learn all this stuff that we covered in previous
videos you will be having some of the intermediate to advance knowledge of the map.
Now maybe in the inland section we will learn how to write our own map scripts which will even more
post your knowledge about it.
So in the next video I will show you how to install the oh expert to machine that we will use for the
penetration testing.
It doesn't take that long.
It basically takes a few minutes might be taking longer to download since it is around I believe one
point five gigabytes or something like that.
But once you download it it will take only a few minutes to install and then we will start with penetration
testing which will be a longer section since there is a lot to cover and I hope I see you in the next
lecture and take care.