Everybody and welcome to next.
In this video and me going over a tool called Sparta now Sparta is a very unique tool in that it not
only will go out and scan a particular host or a network range but it will also act upon the information
that it finds so I want to do is I'm gonna launch this from Cali.
So on a terminal you can just type in Sparta and what's gonna happen is going to load up a tool that
looks like this.
Now there's a few options there scan and brute forcing.
So this.
This will use underlying tools such as Hydra or Medusa to actually go ahead and try to brute force a
particular port protocol that you want.
So this is a very useful because it provides a UI on top of some of the difficult to understand command
line options that some of the tools themselves actually have.
But we'll focus on scan for now so to add a host to Sparta.
So we're gonna click in this left side here vs. click click here to add host to scope and then we're
gonna put an address or network and so I'm going put in a single address wanting to 1 6 8 1 to go ahead
add this the scope and what this is gonna do is it's gonna start kicking off and map scan in different
stages.
So it's going to do increasingly more deeper scans until it completes once it completes it will then
provide a little bit more information.
So we're going to go over that in a second.
I'm gonna get back to you guys once this completes.
So now that this is completed we can see it found a few ports found port 81 which is running a simple
python HDP server 137 which has the net bios for Mac OS X Seventeen seventeen thousand five hundred
four DV LSP and four thousand nine hundred one hundred and eighty three.
And it does not understand what that port is.
So we'll take a look at each one.
So if we look up at the top first we've got services which list our services scripts which is empty
at the current moment informations.
This is just basic information about if it figured out what the operating system was it would show up
here.
This is some notes section for you to type the notes in because you are able to save this all this data
together.
But what's important here is that we can see port 80 almost found as a web service or an HDTV service
and it got it went ahead and ran NICTA.
Now in this case it found a few common directories which we'd expect.
So and it also reached an error limit which is again that's fine but it ran NICTA completely on its
own and it went ahead and grabbed a screenshot of the web page so it went to the web page itself and
grabbed the screenshots.
Is a good idea to kind of find out what what's on it.
But Nick doesn't just do this you can take this a step further.
So if you right click on this line it gives you a few options you can open it would tell that net cat
you can send it to the brute so if you had a authentication page you can send it over there open it
in the browser take another screenshot run what web which tells us tries to grab the banner and tell
us to identify what Web site or web service it is we can run specific and map scripts if we want to
we can rerun Nick toe Web site or door buster which is a similar to Darby that we were using before
and we can just grab the banner directly.
So if we go ahead and run we'll just do grab better so if we go over here it says Open unknown because
it never made a web request.
So in this case banner grabbing it just grabbed whatever it was open on the socket which is nothing
by default on a web service.
So let's go to what web and what that's going to do is you can see it loading down here that it ran
and finished and we can see here it is an HP server for simple HDP on Python two point seven.
That's perfect.
That gives us a better idea of what we're working with here and what we can do here is if it doesn't
quite know and there's no tool specifically for the service or name under this name column here it's
just going to give you these basic options.
So in this case this is a unique one for net bios.
And if we look at this one we don't see anything.
This is just our basic input here.
This is for us to where we would search up that port search of that name and see if it makes sense based
on the target we can see this is Apple Mac.
So maybe this port is used for something on Mac specifically.
So we can search that up and identify what it is and then run the corresponding tool.
Now on a port that it does not recognize which is forty nine thousand probably is going to have some
sort of recognizable port on it or service with it.
So if we right click it you're going to see a large amount of options here.
It is basically saying you can do whatever you want.
These are most of the tools that it supports.
So it might be worth connecting to it with net cat as an example.
So if we wanted to here and we did connect with net cat here's Nick
open with us.
So we're going to open with net cat 0.
Looks like it didn't find the terminal.
That's fine.
Anyway so it gives us a lot of options to work with.
And what we can do is we can technically go open this up with net cat on our own.
It's currently set up.
Ben S H which it couldn't find right away which is fine.
This is this is a beta tool.
How.
However it's pretty useful.
So if we go ahead and roll this over here so I can get the port.
So if we do a net CAD 1 2 1 6 8 1 2 on poor.
Four thousand nine hundred eighty three cool.
So we can type in some some guy to here test.
But at some long
help log in nothing.
So we'd have to google up a little bit on what what this port is on our target of for an example.
However what I want to stress out here is that this tool might have a lot of options and it might be
good when you're in a time sensitive engagement.
However it's not the only tool you should use.
So what I don't want you to do is open up this tool and then if you can't find whatever information
you're looking for would just as tool call it a day you're going to want to look at things manually.
There is a difference between running automated tools and checking things yourself and we'll have a
whole video on that specifically but I don't want you to rely on single tools in this particular case.
This is a powerful tool.
It does give you a lot of options but it has its bugs as well.
So for example like the net cat that should have opened up a net cat session with the exact command
that we just ran.
However it failed so just because it failed doesn't mean that the servers or target on the other end
failed to connect or anything like that.
It just failed because of the configuration of Sparta on this particular machine.
So be careful with this.
It is in beta.
Just keep that in mind but play around with this a little bit pointed at your at your local router at
home and one that you own.
And give it a try.
See what see what kind of pops up and you might be surprised if you have SS H for an example you might
see.
SS h here and then you can just send it to the brute force and try to force the the route.
Admin page or the route log in just to kind of see what you have or if you have a web UI.
Chances are there's off behind it and if you left a default it probably has the default credentials
for the router.
So if you sent it to the brute force or it might actually already find it it might test the default
credentials first or it might might be something you want to test on your own which is more of a manual
test which will be over and later but play around with it get familiar with it.
It is a nice tool to run quickly if you if you're running.
Like I said running out of time just run it in the background while you're looking at things on their
own maybe on a different box or why you're running another map scan to get the initial port.
You already have this guy running in the background.
Just play around with it and see how it works.