Information gathering is one of the most important steps when it comes to hiking or penetration testing.
If you think of it you can't really gained access to a system if you don't have enough information about
it.
So for example let's say you're connected to a network and one of the devices connected to this network
is your target now for you to hack into that target.
First you need to discover all of the connected clients to this network get their MAC address their
IP address and then from there try to maybe gather more information or answer my tags in order to gain
access to your target.
Now there are a number of programs that'll do this for you.
Examples are net discover and end map which do this job really really well.
So in this lecture we'll start with the simpler one which is a Discover and see how to use it to quickly
map the network were connected to and end the next lecture.
I'm going to show you how to use and map to gather detailed information about all of the clients connected
to the same network.
So I have my calleigh Terminal and year and if I do if config you'll see I have zero.
It has an IP address and like I said this is the virtual interface created by birchell box.
When we set the kyley machine to use an our network.
Now I also said that this network behaves exactly like either network and as far as the Miss Eunice
concerned it thinks that it is connected to our real wired network and as you can see here is tell me
that wired connected.
Now I have my virtual windows machine right here.
It is configured to use the same nadda network as the kyley machine.
Remember we're still in the where a kiking section.
So both you and the target machine need to be connected to the same network.
So as far as these two computers are concerned they think that they are connected to the same network.
So what I want to do right now is use that discover and see how we can use it to discover all devices
connected to the same network.
Now the method that I'm going to show you will work exactly the same whether you use it against a virtual
network like I'm doing right now or I guess the real network.
And even if your target is a wife or a wireless network.
So all you have to do is throw the name of the program which is net this cover and then they'd dash
are to specify an IP range to Syria for this needs to be arranged.
That can be accessed by you.
So right now you can see that my IP is 10 0 to 16 and I can only access IP is on the same subnet.
So I pees on the same subnet.
Start out in zero to zero.
And they would end at 10 0 2 2 5 4 because 2 5 4 is the last IP that a client can have.
So my range is going to be 10 0 to 1 and they won a search for clients that might have an IP of days
or a one dizzier or two two days or two or three.
All the way up to 10 0 2 2 5 4.
So instead of manually type in all of these eyepiece I can just type over a 24 hour net.
This cover will automatically know that I'm trying to search for all of the IP is that's doubt out there
as you are to wine and end at in 0 2 2 5 4.
So this is a way of specifying an IP range for the whole subnet.
So if I hit enter now.
You'll see that this cover will show me all the I piece of the device is connected to the same network
and note that the first three part of the IP is are always the same because they are on the same sub
Nat and I also have the MAC addresses of these clients.
NET discoverer's also attempted to guess the device vendor.
Now if I press Q This will quit the program.
Right now we have a list of all the connected clients to this same network.
No like I said You can also use this method to discover a client's connected to the same wife I network.
The only thing is right now if I do if config you can see that my candy machine does not have a wireless
adapter it's not connected to a wife I network.
And like I said before you cannot access the built in a wireless card from a virtual machine.
Therefore if you want to do this or run any of the wireless attacks that we're going to see in the future
against a real computer and a real wireless network you're going to need to use a wireless adapter.
Now I'm going to include links in the description that'll help you pick a good adapter that works with
khalila next.
Well right now I actually have one and I'm just going to connect it and use it just to prove to you
if things work on the virtual machines connected to the virtual network they will work exactly the same
against a real network with real machines.
So I'm going to connect my adapter now.
And if I do if quod Fig.
It's still much lower now.
So I'm going to connected from my devices U.S. B and Italy can't be adapt her name.
And let's see if that shows up now.
Perfect.
As you can see I have an adapter now called Lines 0.
And well I'm going to do is I need to Kinect this adapter to a wife I network froze before I can discover
all the connected clients to this network.
So I'm going to go to my network manager.
I'm going to click in here and you click on select network and as you can see automatically now is actually
connected to a network.
What in your case you'd want to select a network and click on kanag and then athel asked you for the
password.
So now I'm actually connected and you'll see if I do if conflict again right now lines 0 hires an IP
address.
So this means that it is connected to a network and this means that we can use it now with net this
cover.
So again I'm going to use the exact same command that I use before just to show you and prove to you
that if this works against virtual machine as it'll work against real machines and the only difference
is going to be the IP.
So I'm gonna remove this IP and as you can see right now my IP is 1 9 2 1 6 8 1 8.
So therefore the range that I'm going to look for is going to start at 1 9 2 5 6 8 1 1 and I'm going
to leave the over 24 here because this will tell net this cover that I want to start at 1 9 2 6 8 1
1 and finish at 1 9 2 1 6 8 2 5 4.
So if I hit enter now.
No this did not warrant and I know why.
In order for this to work you actually have to disable the night network so that to disable the network
or going to go on devices were going to go on network and were going to air uncheck the Kinect network
adapter.
So now was done with this.
If we just run the exact same command again.
As you can see it's this covering all the connected clients all their IP addresses all their MAC addresses.
It's guessing the manufacturer and you can see it's also this covering some Apple devices here.
So as you can see it's working perfectly using the exact same command.
Now why do you do this just to show you that if things were against virtual machine years and guest
virtual networks then they will work against three elmis she IMs because these virtual machines and
virtual networks are modelled on very old machines.
And as far as the machines are concerned they actually think they are real.
Computers and real machines.