-: Now, in the previous lecture we had a quick look on Zenmap
and how it can be used to gather information.
So in this lecture we'll build up on that,
and the main scan that I wanna show you right now
is the quick scan plus.
This scan takes the quick scan one step further.
So first of all it'll be slower,
but it's going to show us even more information.
So first we're gonna be able to see the operating system
running on the discovered devices.
We will also be able to see the device type,
whether it's a phone or a laptop or a router,
and we'll be able to discover the program,
and the program version running on the discovered ports.
So before for example,
we were able to discover port 80 is open,
but we didn't know what program is running on this port
or what version of this program.
Getting the exact program version is really helpful
when we get to the gaining access section,
and you'll see then how we can use that
to exploit vulnerable services
and gain full control over the computers
that have these services installed.
Now straight away when you look at the results,
you'll se that we got much more information
than all of the scans we ran so far.
So the first thing you'll notice is the icons
beside the IPs of the discovered devices.
These icons represent the operating system
running on these devices.
So right now we have the operating system
for all of the connected devices,
and now it's shown us the programs running
on each of the discovered ports
and the versions of these programs.
So for example if we look at the 191.168.1.12,
the Apple device,
on the last scan we knew that port 22 open
and we knew that SSH is running on it,
but we didn't know what version of SSH was running.
Right now we can see that it's running open SSH version 6.1,
so we can go on Google and look for exploits
and vulnerabilities in this specific version,
and we might actually find something.
We'll actually talk more about that
in the "gaining access" section.
Now if you look at the device type,
you can see that it's a media device; it's a phone.
So before we knew this is an Apple device
but we didn't know whether it's a tablet,
a phone, or a MacBook.
Right now we know that it is a phone.
It's also discovering that it's running
Apple iOS four, five or six.
Now it's actually running a newer version of iOS,
I'm not entirely sure, I think nine or 10,
but still, it's close enough it's getting me.
It's telling me it's an Apple.
It's telling me that it's a phone, it's running iOS.
So this is really really good.
Now if we go to the next device here, the 192.168.1.20.
This is a Linux device and when we run the quick scan
we are able to identify port 80 and port 49152 open,
but again, we didn't know the program running
or the service version running on this port.
So right now we know it's a Apache httpd 2.2.22,
it's running on Ubuntu so again
now we have the operating system,
the exact version of the service running
so we can go and look for weaknesses and exploits
in this specific version.
And this port, we didn't even know
what service was running on it.
Right now we know it's a UPnP service
and the server is MediaTomb UPnP.
We have the exact version again
so again we can go ahead and look for exploits
in these specific versions,
and if we discover any we'll be able
to gain full control on this computer.
Again if we go down to the 192.168.1.22 machine we can see
that it's running a Microsoft HTTPAPI, on port 5357.
You can also browse by the services.
So from here on the left if you click on services
you'll be able to categorize the discovered clients
based on the services.
So if we click on http we'll see all the clients
that have a http service running.
If you click on ssh we can see the Apple device here.
It's the only device that has a ssh service running.
So let me actually show you a quick and fun example.
If we go back here to the hosts
and go back to the apple device, the 192.168.1.12.
As we see and as I said we know it's a phone,
we know it's an Apple phone,
we know that it has an ssh service installed on it
running on port 22, and we know that ssh is a service
that allows you to remotely execute system commands
on the computer that has the ssh service installed.
Now obviously before you can use this service
you have to use a username and a password.
Once you authenticate it will allow you to execute
system commands remotely on that computer or on that phone.
Now by default iOS devices do not have an ssh server.
Usually when you jailbreak the phone or the device
it will automatically install an ssh server
and the password for that server
is set to "alpine", by default.
That's A-L-P-I-N-E.
Now since we know that this is an iPhone
and it has port 22 open with open ssh server,
we know that that this phone has been jailbroken.
Now since the phone is jailbroken,
we know the password to log into ssh is "alpine"
unless the user changed it.
Now most users do not even know about this,
and even the ones that know about this,
like myself, are too lazy to change it.
So it's always worth a try if you discover
a phone like this in the same network.
It's always worth a try to go and try
to connect to it with the default password.
So I'm just gonna go to my terminal
and I'm gonna try to connect to this phone using ssh.
So I'm gonna type "ssh root",
which is the username for the admin in Linux,
"@192.168.1.12". This is the IP of the phone.
I'm gonna hit enter.
It's asking me if I should trust this connection,
I'm gonna say yes, and now it's asking me for the password.
And like I said, when the phone is jailbroken
the password is set to "alpine".
So I'm gonna type A-L-P-I-N-E.
I'm gonna hit enter.
And as you can see, I logged in as root.
So right now I have the highest privileges on the phone
and I can do whatever I want on the system.
And now we can use system commands
to completely control the phone.
Now this is a little bit ahead of time,
we are still in the "network hacking" section,
so don't worry too much about this,
we'll talk more about it in the "gaining access" section,
but it's just a quick example that I wanted to show you
of how powerful information gathering is,
because we literally did not exploit anything right here,
we just relied on the information we gathered
and we were able to hack an iPhone
that is connected to the same network as us.
Now like I said Nmap is a huge tool.
I highly recommend you go ahead
and try the other profiles in here,
and like I said, once done with the course,
I think the Nmap book would be a really really good read.
We'll also use Nmap much more in the
"gaining access" section and we'll see how we can use
this information to gain full control over the computers
using code execution vulnerabilities and so on.
But in this lecture I just wanted to give you
a quick overview and we'll build up on this
as we go through the course.