Hey everybody welcome to the first video in the active reconnaissance phase.
Now we're going to go over Here's Port scanning so Port scanning in a nutshell allows you to scan for
services that are listening to the outside world on a particular machine that connect through a file
or a named pipe to a particular service that's running internally on the system now a key word of warning
when you go into port scans ports can be very loud.
They can be very obvious and depending on what you're doing they could take down a network.
So if you're scanning through an uplink port or to a different site over a VPN or even just across the
same network you need to be wary that you can't just generate mass amounts of traffic at any given time
because it may take down certain networking equipment or hosts in general maybe the host itself doesn't
have enough processing to handle a scan request that you're sending it.
Now most enterprise environments you shouldn't have to worry about a single host failing but more on
a network device that's already under load failing.
Now what I want to get you to understand is scans are almost required when you're when you're dealing
with the house you need to scan it in one way shape or form.
So there's a few options that you can use to scan a little bit more for stealthily.
And we're going to go over some tips and tricks on how to do scanning with and map which is a very popular
port scanning tool as well as how to perform different types of scans so and map on our Kelly machine.
We just open up term on the map has a lot of options.
So there's just a ton of options and we're not going to definitely not gonna make it through any Fourth
of these.
What I want you to understand is with any map you have a few different options that you can do.
You can scan something specifically on a specific port or you can let it by default scan the first 1000
ports or you could scan a network range an entire range of networks of hosts for multiple things.
Now you can even use a map to find out which hosts are alive.
So just finding out you can scan a whole large range hasn't shown right here.
We can use the slash notation or site or notation for us to be able to find out what ranges we want
to scan and then that will tell us what hosts are in there.
Now by default if you just ran it with a range it would then search through that range find all live
hosts and do a standard port scan of one to a thousand.
But what I want to show you first is some of the some of the flags.
So actually before we get that let's just start off from the very beginning.
If we do and map and then a host right.
So 1 2 1 6 say 1 that one is my router at this point.
So running this issues a scan and it goes ahead and does the first few thousand ports.
So what we hear is we see fifty three for domain for DNS is the open port 80 is open which is what I'd
expect this is I have a web interface 548 six thirty one five thousand eighty two hundred and twenty
thousand five.
Now it even tells you that this it thinks based on this MAC address that is a net gear which is correct
it is a net gear router.
So when you scan a host in this case if we scanned got to it should be the the Mac.
We're not going to find any ports open.
However it identifies it as Apple and sometimes it can do this based on the MAC address.
Sometimes it does it based on how the responses so the windowing parameters in the TTP socket when it's
created.
Windows has a certain setting that it uses by default that Linux does that Windows does.
And they each have their own different settings so based on that it can help identify which which host
it is.
And again you can fake that you can make a Windows machine when scanned by N map.
Think it's a Linux machine.
You can do this and there's admins out there that do have this on by default.
And it's just a matter of tweaking some registry settings.
So what I want you to know is that running the standard you're just hitting some base ports it's not
very intensive.
Now you can get much more intensive as far as like banner grab the particular domains or the particular
ports you can go pretty far into this.
So first thing I want to show you guys is if we do map dash as t now this by default is the exact same
scan without the dash SD So dash S T is for TTP Connect which does a full three way handshake when it
connects to each port.
And that can take some time depending on how many ports you're going through or how many hosts you're
scanning in this case or scanning one host.
But this is the common way.
It sends a it sends a three way handshake it performs it's the whole handshake and then if it completes
it's done.
If it runs if it returns a thin packet it knows it completed.
But if it returns a if it doesn't return it back.
Let's say when.
When it first won the handshake first sets off.
It's not going to assume the ports open now.
There's a few other ones such as dash s s with capital S now.
This is a sin scam so similar to the three way handshake.
But it does not complete the whole handshake.
It stops before it finishes and leaves it open.
So running this again we can see reasonable the same amount of time but it also provides the same info
which is what we expect and there is also a fin scan which just sends the fin packet and depending on
if the packet.
If the port is open the packet is ignored since since the session is closed but if it responds with
a rest packet we know that it is indeed open so if we let that go ahead and go perfect so we get the
same results.
Now you can take any of these will do.
S T so you could take any of these and fragment the scan.
So what it will do is it will use a different combination of the packets and combine them or fragment
them out into smaller.
This makes detection a little bit more difficult when it comes to detecting the scan.
However it's not foolproof.
It can still be seen if you're blasting it out to the entire network of the whole range on its own.
So this is done with a dash F and again we see we get the same results which is exactly what we expect.
Now we can do a UDP scan with a dash you.
So what this is going do is that we've been doing P the first time time so this is going to actually
run a UDP scan which I'm not going to do in this particular video because it takes it takes quite a
bit longer to go through a UDP scan.
But I want to I want to keep this video pretty short.
So just understand that you want to do a TCB scan and a UDP scan because there's some services that
only run on UDP that are not on TCB and you might find that your way into the machine is over UDP and
not TCB.
So make sure you scandal now there is a last scan which is called a xmas scan which is a dash s x and
what this does is it works similar to how the TCB connect does in terms of the found open or closed
ports but it sets the bits in the packet for push thin and urgent.
And this can sometimes bypass firewall rules or filters put in the firewall.
The reason it's called xmas is because it's supposed to light the packet up like a Christmas tree.
So it's a very obvious packet.
However unless a firewall specifically looking for it it might just let it right there.
So we can do a dash X just go let that run.
There we go get our same results which is exactly what we expect.
Now there's a few things you can do when working with scans.
We all we did was it and map assumes.
So if we run that one more time and map assumes that port fifty three is domain port 80 is TCB it's
making an assumption it's not actually going to the port and checking whether it's an actual web service
or not.
So to do that you would want to change this from an S x to an SUV.
So s v allows it to actually go and banner grab or go and connect to the port and see what response
comes back and based on the response that it gets back it will then go ahead and check to see whether
it knows what it is and if it's not exactly sure what it is.
It'll just provide some aspect of the banner to the.
To the screen for you.
Go ahead and run that.
Now this can take a tad bit longer depending on what ports actually showed is open and what didn't.
So a quick thing is if you're running and map and you see that there is a it's just sitting here you
can hit enter or space and it'll give you a progress report on where it's currently sitting.
So we can see it's at eighty five point seventy one percent.
However I'm gonna have to stop the scan.
In my case because I have the router setup so if it starts getting banner grabs it starts dropping the
host or dropping the packets.
So in this case the scam will never actually complete but if you go ahead and test this out on years
with a default based router you haven't messed with the security settings too much you should be able
to get your result perfectly fine so I'm gonna leave that alone.
But that will then in turn tell me maybe what HDP server I happen to be running.
So there's also another aspect where you can do is a dash O capital.
So what this is going to do is it's going to try to help identify the operating system so you can see
here it assumed it was net gear based on the Mac address and the device type is general purpose or just
fine but it's running Linux two point six and it's guessing this detail two point six nineteen to two
point six three six.
It's guessing this based on a large parameters of the type of packet that's being set.
So the same thing goes if I do dash to and that is going to be an Apple device.
So again we can just let this finish on its own and then that'll show us.
OK.
So it could not too many fingerprints match this helps to give a specific OS details which is what I'd
expect.
However you can see the Mac address assumes that it's an apple device.
So this can give you a generally good idea on what you're trying to look for so you could try to figure
out whether your exploit is going to work.
Maybe it needs to be OS specific.
Now there is another option that can take that takes in as V and dash 0 so it can take both of those
commands and combine them together because it's a pretty common structure to 1 know what the banners
are and what the Alesci is.
So they can they set this into a dash a.
Now this takes significantly longer to run.
So I'm not going to run it here.
However just note that dash a is just the equivalent of dash SUV and dash which does give you the port.
It does the standard s t which as a guess it's essentially equivalent to this.
So it's doing a T C P scan it's doing a TCB connect scan so the full handshake checking the operating
system and doing the banner grabbing now there's a few ways that you can.
You can save ports or save your scans right.
So if you go ahead and send this back to our default output.
Right.
So if we want to save the standard and map scan output which is essentially what we're doing here we
have two options.
We can just pipe this to a file and just call it scan.
Right.
So we can do that fine cat scan see we can get our scan that way or we can do is we can use the built
in one dash O N for N map and we'll do we'll just overwrite it scan and we do a CAT scan and we get
the same thing.
However we get a beginning and an end that wasn't there before.
Let's clear this.
So there's a few other options that we can use that maybe we want X AML so we can just do X a name that
is scan as well.
So if we do Cat scan we then get X AML but this is much more information so this is going to tell us
what ports it actually went besides to check the parameters that it went to check.
And the information around it which is great sometimes we need X AML depending on what tool you're using
between all of the people on the team to help you.
To help you keep track of findings and ports that are open because sometimes it's good to have a community
effort on an engagement.
So in some places people might want to be to have reparable format so we can do this with a dash G.
And again what we're just overwrite scan will do their CAT scan.
So what this does this gives us a grapple outcome.
So most people will use this as a an input for another application if they're using Python there's an
end map module that directly interfaces with that.
So that allows that has its own built in parser and it will do all the passing for you but if you need
to do it by hand on another module normally the grep is going to be your go to so there's also a dash
a which we can do on the same command a scan without any output but what it does is you can see it dumps
in the grep file the end map.
So the dash O.G. the dash 0 and the dash 0 x so with dash if you needed just dump this and save the
data you're OK.
You shouldn't have any problems.
So and map comes with something called the Map scripting engine or an S E.
Now this is specifically useful when you're wanting to test out certain things on a port.
So this is kind of just extending the port scanning capabilities to be searching for specific issues
or a range of issues.
So a good way to do this let's say we wanted to look at port 80 on a particular host.
Right.
So and map dash P for the port.
We'll just do 80 do 80 for the port and then we'll do our 1 2 1 6 8 1 1 leave.
This should work.
So we'll do three dash dash script equals and then whatever the script you want.
So in this case we're gonna do DDP and put a star at the end so it uses any age DP module.
So go and run that misspelled and that
and we'll let that run just for a second OK.
So one script undergoing scan this is probably going to fail based on the router settings that I have.
Yes it will.
So again we use the dash dash dash script equals to look for specific Toronto specific scripts.
Now what I want to show you guys is in our current directory of users share and map scripts which should
be on any of your Kallie machines.
Alas dash l we can see that there is a large variety of different things that we want to see here.
So if we want to look at SBN brute forcing we can look at that or stunned information or SSL Heartbleed.
If we if we suspect that that's gonna be a problem we can even brute force SS H sockets A.P. SMB which
is always a good one.
There's SMB enumeration.
So if you start running into an SMB port on a host you can enumerate some group some domains some users.
If the settings are mis configured.
So there is a lot of options you can have here even showed on has an API script that lets allows it
to call to certain exploits specifically are even in here.
So it's a good idea to double check and keep a look in here just just so you never know when you're
going to find something on the machine or the you never know when you're in a find a specific port and
that specific port might be the let's say.
So maybe you want to run this VNS brute force and map script just to kind of see what outcome comes
out of it.
Now again there's who is as an example.
So it's always a good thing to double check get familiar with this.
You're gonna find yourself using specific scripts to speed up the process when discovering certain things.
Now the last thing I want to show you guys is how to run a full network scan.
So if we do a map we'll just do the standard or even type it out just for simplicity's sake and then
24.
So this is the current network that I'm on.
Yours will vary so you can do an if config on this machine if you've configured it on.
If you didn't configured on bridge then you'll need to actually configure it to be able to start scanning
your local network and not the one inside of a virtual box.
So if we go ahead and run this it will go ahead and run and it will check if every IP is alive.
And then with the IP that are alive it will run that same and map scan that we saw above.
So we can see here it's 50 percent done.
You can see this in the TCB connect scan.
So as soon as it's done running the scan it will then start processing the results and then actually
testing the ports.
So we're gonna be back once this is done all right.
Now if this is completed it took a tick a little bit about five minutes or so.
So we could see if we scroll up here.
This is our region scan we've seen I check the status a few times we see our one dot one which we saw
before which is that gear looks like one dot to had no no ports open which is what I'd expect five had
no ports open which I expect as well.
Looks like one dot six is Amazon technology which makes sense.
That is the Alexa that I have in the kitchen and one dot seven looks to be another apple which based
on the ports looks like a phone which is what I'd expect in 10 and 20.
All have zero ports open which is again what I expect on my network.
So you might actually find when running through this that you find something on your network that you
don't expect to be there which is a good thing you might want to investigate if you're at home.
Now this is just a very light introduction to and map.
I've written tutorials before on that specifically so I've basically put up the full contents of those
other tutorials below the video.
So you'll find a little bit more detailed information below that you can follow and try out at home
as well.
Now keep in mind this can be used to scan Web sites on the Internet as well but I would highly recommend
against it unless you have a signed documentation.
You know all the approvals that you need to be able to scan the target.
This is we are now an active reconnaissance and a port scan is the quickest way to get a letter you
don't want to your house.
So go ahead and test this out locally on your local network first.
Again you can find this out by doing if config and you can see I'm on one dot 20 which is perfect so
you can see it here.
I didn't have any ports open which makes sense.
So why not 20 so I took it as based on the subject mask and the broadcast address.
I can assume on a slash 24.
So I wanted 2 1 6 8 1 0 slash 24.
Yours is probably going to be a slash 24 unless you've made some custom configurations.
And if you have done that then you should already know what range you're supposed to be scanning.
So go ahead scan this locally if you're at home.
Don't scan this at an employer's on an employer's network just on your own personal network that you
own and you have control over and go ahead and test out some of the different NFC scripts.
And if you want to take it a step further look at how they're built with Lua and tried to build your
own NFC script do something specific to a port maybe just make a simple web request as an example.
It's a good way to get familiar with how you can extend things to be more custom for your particular
environment.