Hey there. Welcome back to our PowerShell course. In this
module, you'll learn how to enumerate hosts and open ports using
PowerShell. This module is all about finding your next targets
in our red team operations.
The idea here is scanning the network to find live hosts and then
trying to figure out what ports are open on those hosts.
In this way, you can find potential targets for your next attacks.
So, let's take a quick look on what you'll learn in here. First, we'll
discuss about the main network enumeration techniques that we'll be
using. Then we'll have a demo showing you how to implement the host
discovery script with PowerShell, and this will help us to identify
lifesavers on the network.
After that, we'll implement a port scan script, which will be helpful to
detect open ports in the servers we found. And last, we'll use PowerShell
to find open SMB shares in the environment. In this module, we will
continue the Globomantics scenario.
Now that we collected information from our initial access server,
it is time to expand the attack. In here,
we'll enumerate the network to discover other hosts on the network and map our
potential future targets. To perform the network enumeration, we'll use three
really common techniques which are very effective.
First, for host discovery we'll use a ping scan to find the host; for port
scans, we'll use the TCP‑connect probe to verify if the port is open; and
for the SMB shares, we'll be using both WMI and Net List to find open
shares in the network, and of course, all of this using PowerShell. So,
let's get started with our demos.