Ports and services on the Web server.
Web applications are generally served on ports 80 and 443.
But it's not limited to use just these port numbers, port numbers are configurable, so it's not uncommon
to see Web applications served on a non-standard port such as AT&T.
OK, so basically you are ill or an IP address will be provided to you if you start a penetration test.
But sometimes due to your contract, you you may need to run a black box testing approach with nothing.
You wouldn't even have an IP or a URL to get to test.
In both of these scenarios, you would need to identify and then map the target network in some level,
so the first thing to do is to identify the target network with who is.
So we've already done that.
The second thing to do is to map the network.
And that's what we're going to do now.
And we will use county Linux, it's got a great tool in there to help us out and map.
So and map is short for network mapper.
It's a powerful open source network scanning tool perfect for conducting reconnaissance and enumeration.
So here we are going to benefit from and map, so now open up your terminal and Cali and type and map.
You can see there are a few options.
And MAB can perform many tasks.
It can identify live hosts, Skin TCP and UDP, open ports, detect firewalls, get service version
running in remote hosts and even with the use of scripts, find and exploit vulnerabilities.
So why don't we just start with a basic scan?
So at this point, let's assume I was given or I have found the target IP or URL, so I'm going to use
B box IP address and the examples.
Simply type and map one nine two dot one six eight two zero four, dot one three zero and hit enter.
And here is a basic scan.
So Unmap will scan the target IP with its default options.
And the result shows the open ports and corresponding service names running on these ports.
So now let's touch on some of these other parameters to perform a detailed scan.
Now, Unmap has several approaches for scanning open ports.
It sounds raw network packets to several top or UDP ports of the target and check to see if there's
a response.
And if there is depending on the type of response, it will define the port.
As to whether it's open or not and remembering that HTP uses Tsipi for transmitting packets.
And MAP will play with these packets.
And then different skin types come up.
So regular TCP connection between.
Two types is called a three way handshake.
So first.
A sign flag reaches a destination and then it sends the Sinak flags back to the source, then the source
sends back the ACT flag to start the data transmission.
So this is the basic and fully qualified TCP connection, right, so type and map one nine two, not
one six eight two zero four that one three zero dash S.
S.
And he asked, Parameter will do the sign scan on the target.
So that means it and map will not complete the three way handshake.
It's not going to replace the last sign packet with a reset packet.
But the result is not going to be different.
And the first one.
Because the sign scan is the default option for enmasse.
Now, type and map one nine two two one six eight two zero four one three zero T.
And this is a TCP scan, if the S.
T parameters used.
So that means and map completes the three way handshake.
And that way and map can actually connect to the target for.
And then the connection is logged by the server and the result is the same as the previous one.
But it provides a more accurate state of the port.
OK, so you can see the maps are really clever tool at first identifies the live host on the Target
network and then scans the host for open ports.
So now let's type and map one nine two down one six eight two zero four one three zero as in.
And with the flag, as in, you can force and map to check to see if the horse is alive or not.
And then, of course, the opposite is also possible.
Change SRN to pen.
And then this time and Map will not check to see if the host is alive or not.
It will only perform a port scan.
OK, so now let's let's be a little bit more specific about these ports so you can use the P flag to
define a port, no port list or port range for and map to scan.
So here, I'm going to give it port 80 and four for three.
And of course, you can provide service names like HTTP or https.
This time, it will find ports running the services.
So if you want to scan all the ports, just put a dash after the P.
It's going to take a lot longer.
But if you're not looking for a specific port, you can limit the number of ports by using top ports
as a parameter.
It will look for an maps, top 100 ports.
Now, if you only want the open ports, just ahead, the open parameter.
Now, closed port is gone.
Also, you can add a reasoned parameter to display the reason a port is in its particular state.
So until now, we've got open ports and the names of the services, right, so thankfully and MAP can
show the software versions running on the open ports.
And just add the parameter as the two detective versions.
And it might take a little while to run this kind of scan.
And here are the results with their version banners.
So now you can look for these version numbers to see if they have vulnerabilities or not.
And then the last thing that we'll do here is determining the operating system running on the target
host.
So just add the parameter O to the previous command.
And this could also take a little more time.
And Map will analyze the information collected from the open ports and versions and guess the probable
OS.
You can also use and map scripts and also you can compose your own script by using the end map scripting
engine.
So here are some script names that you can use to help you when you're doing penetration tests.
I want to show you how to use them, but simply because I'm going to be using some other tools and techniques
for the same purpose, using scripts is certainly not complicated, and I.
I do advise you to use them.