-: Information gathering is one of the most important steps
when it comes to hacking or penetration testing.
If you think of it,
you can't really gain access to a system,
if you don't have enough information about it.
So for example,
let's say you're connected to a network and one of the
devices connected to this network is your target.
Now for you to hack into that target,
first, you need to discover all of the connected clients
to this network,
get their Mac address,
their IP address.
And then from there,
try to maybe gather more information or run some attacks in
order to gain access to your target.
Now,
there are a number of programs that will do this for you.
Examples are Net Discover and EnMap,
which do this job really, really well.
So in this lecture, we'll start with the simpler one,
which is Net Discover and see how to use it to quickly map
the network we're connected to.
And in the next lecture,
I'm going to show you how to use EnMap,
to gather detailed information about all of the clients
connected to the same network.
So I have my Cali terminal in here.
And if I do, ifconfig,
you'll see, I have ETA zero,
it has an IP address.
And like I said,
this is the virtual interface created by virtual box,
when we set the Cali machine to use an ad network.
Now,
I also said that this knot network behaves exactly like an
ethernet network.
And as far as the Cali machine is concerned,
it thinks that it is connected to our real wired network.
And as you can see in here it's telling me that wired
connected.
Now I have my virtual windows machine right here.
It is configured to use the same Nat network as the Cali
machine.
Remember, we're still in the network hacking section.
So both you and the target machine need to be connected to
the same network.
So as far as these two computers are concerned,
they think that they are connected to the same network.
So what I want to do right now is use Net Discover and see
how we can use it to discover all devices connected to the
same network.
Now,
the method that I'm going to show you will work exactly the
same,
whether you're using it against a virtual network like I'm
doing right now or against real network.
And even if your target is a wifi or a wireless network.
So all you have to do is type the name of the program,
which is net discover and then type dash R
or to specify an IP range to search for.
This needs to be arranged that can be accessed by you.
So right now you can see that my IP is 10 0 2 16,
and I can only access IPS on the same sub-net.
So IP is on the same, sub-net start at 10 0 2 0.
And they would end at 10 0 2 2 5 4,
because 2, 5, 4 is the last IP that a client can have.
So my range is going to be 10, zero, two one,
and I want to search for clients that might have an IP of
10 0 2 1, 10 0 2 2, 10 0 2 3,
all the way up to 10 0 2, 25, 4.
So instead of manually typing all of these IPS,
I can just type over 24 and net discover will automatically
know that I'm trying to search for all of the IPS that start
at 10 0 2 1 and end 10 0 2, 25, 4.
So this is a way of specifying an IP range for the whole
subnet.
So if I hit enter now,
you'll see that net discover will show me all the IPS of the
devices connected to the same network and note that the
first three parts of the IPS are always the same because
they are on the same sub-net.
And I also have the Mac addresses of these clients and Net
Discovers also attempting to guess the device vendor.
Now, if I press Q, this will quit the program.
And right now we have a list of all the connected clients to
the same network.
Now, like I said,
you can also use this method to discover clients connected
to the same wifi network.
The only thing is right now, if I do, ifconfig,
you can see that my Cali machine does not have a wireless
adapter, it's not connected to a wifi network.
And like I said before,
you cannot access the built in wireless card from a virtual
machine.
Therefore,
if you want to do this or run any of the wireless attacks
that we're going to see in the future against a real
computer and a real wireless network,
you're going to need to use a wireless adapter.
Now I'm going to include links in the description that will
help you pick a good adopter that works with Cali Linux.
But right now I actually have one and I'm just going to
connect it and use it just to prove to you.
If things work on the virtual machines,
connected to the virtual network,
they will work exactly the same against a real network with
real machines.
So I'm going to connect my adapter now.
And if I do, if config, it's still not showing up,
let's see if it shows up now.
Perfect. As you can see,
I have an adapter now called LAN zero.
And what I'm going to do is I need to connect this adapter
to a wifi network first,
before I can discover all the connected clients to this
network.
So I'm going to go to my network manager.
I'm going to click in here and you want to click on select
network, as you can see automatically.
Now it's actually connected to a network. But,
in your case,
you'd want to select the network and click on connect,
and then it'll ask you for the password.
So now I'm actually connected. And you'll see if I do,
ifconfig again, right now, LAN zero has
an IP address.
So this means that it is connected to a network.
And this means that we can use it now with net discover.
So again,
I'm going to use the exact same command that I used before,
just to show you and prove to you that if this works against
virtual machines, it'll work against real machines.
And the only difference is going to be the IP.
So I'm going to remove this IP.
And as you can see right now, my IP is
1 9 2 1 6 8 1 8.
So therefore the range that I'm going to look for is going
to start at 1 9 2 1 6 8 8 1 1.
And I'm going to leave the over 24 here,
because this will tell Net Discover
that I want to start at 1 9 2 1 6 8 1 1 and finish at
1 9 2 1 6 8 2 5 4.
So if I hit enter now,
as you can see,
it's discovering all the connected clients,
all their IP addresses all their Mac addresses,
and it's guessing the manufacturer.
And you can see it's also discovering some Apple devices
here. So as you can see,
it's working perfectly using the exact same command.
Now, I only did this just to show you that if things work
against virtual machines and I guess virtual networks,
then they will work against real machines because these
virtual machines and virtual networks are modeled over real
machines. And as far as the machines are concerned,
they actually think they are real computers and real
machines.