Hello everybody and welcome to this section on and map.
I'm actually recording this in 2020 so the video you're going to see here shortly is from 20 19.
We've had a little bit of issues with the command that I show which is net discover on how to find your
IP address of the key objects machine to actually begin scanning this machine.
So I'm going to show you a couple of alternatives and then I'm going to let the video play as it was
before.
And you'll have several options on how to find your capture machine and hopefully find the IP address.
So at this captors log in page we can cheat just a little bit.
So what I'm going to do is I'm actually going to give you a log in here and just go ahead and type John
as the log in and I'm going to show you the password before I delete it.
The password is going to be two cows too just like that t w o c o w s two with the T and A C capitalized.
So go ahead and type in John and then two cows two and you can see we are now logged in as John Archaeopteryx.
Now this machine is very very old.
So the typical I have config or IPA or any of those do not work on this machine.
However we can do a quick ping for example to anything we want we could say 8 8 8 8 8.
It could be an internal IP address.
It doesn't have to be an IP address that resolves Well we could say ping and as we ping I'm going to
take control see here you can see that we see ping from 1 9 2 1 6 8 4 53.
That's my IP address.
Now the IP address you're going to see here in the video shortly is going to change.
However as of right now the IP address I'm seeing for CAP tricks is for dot 53.
Now we also use net discover but there's actually a cool tool we can utilize as well.
Now if we come into the network you can see that I have a IP address of 1 9 2 1 6 8 4 dot 51 for myself.
Now there is a tool built into Kelly Linux that is called ARP scan and you could do a syntax of a dash
L with that hit enter and it's going to pull off an ARP scan as well which is what net Discover is doing
what we need to be looking for.
And you could see this is kind of my home network.
What we need to be looking for is VM where you can see VMware is sitting here at 1 9 2 1 6 8 forward
at fifty.
The only one to be on the lookout for is possibly yourself which we're at fifty one.
I don't see in this list it didn't pick us up so I could see one or two 168 453 VM where should be the
only one that's running or using virtual box or something like that.
It should show up here.
So kind of identify either this way or you can come in and identify it through the key object log in
itself.
Of course you can use net discover as shown in the video.
So without further ado let's go ahead and go into the video on scanning with and map.
OK so now we have key objects up and running.
We need to determine where it actually is and then we can do a little bit of scanning.
So what we're gonna do is we're gonna go up into our applications and open our terminal.
I'm just gonna make this a little bit bigger and we're going to run a tool called Net discover.
So before we can do that we need to type in I have config and identify your IP address and it's going
to go ahead and copy this first three octet here and we're going to run it discover so net Discover
is going to look like this we're gonna say net discover we're gonna do a dash are for range we're going
to paste in this and do a dot zero slash twenty four.
So what are we doing.
We are going to be using ARP to detect all the machines on the network.
So you should be familiar with our from the Linux lessons and from the networking lessons.
So we're going to attempt to use ARB to address anything on the network and we're sweeping the entire
subnet of soft 24 something go ahead and enter and in a second here.
Our machines just start popping up and it does.
So remember our host was at 1 thirty nine.
This host here at 134 is likely our culprit.
So you should only have two machines in network because we're only running two.
You can ignore dot 1 2 and 2 5 4.
We are only focusing on the one that looks similar to ours which is 1 9 2 1 6 8 57 1 34.
So now we know our machine address.
We can start attacking it somewhere.
Go ahead and hit control see which is going to kill this session here and then hey control alt to clear
my screen.
All right.
So I'm going to open up a notepad and we'll just store this away for a rainy day.
We need to first talk about what we're going to be doing here.
So remember before when we ran our teepee three way handshake we had something like sin sin AK and AK
Right.
And we had to say sin act like this to combine.
So we've got three parts.
We've got the part where we reach out to a port and we say hey port are you open.
And the port says yeah I'm open.
Let's go ahead and make that connection.
And then we go ahead and connect to it.
So what we're going to be doing is we're going to be using a tool called n map and map stands for network
mapper.
Now what network mapper is going to go out and do its is going to scan for open ports and services.
Now this scanning is going to take place and it's going to identify these open ports with something
similar to this three way handshake.
So we're just going to modify it a little bit.
Now what the process that we're doing is called stealth scanning and it used to be written out like
this.
Now it's just done by default and we'll get to the switches here in a second.
Don't worry about that just we're going to be running stealth scanning and now this stealth scanning
used to be stealthy right.
That's why they called it stealth scanning because it used to be undetectable nowadays very detectable
if you run and map in a network that has good security you're going to get picked up although being
a pen tester I would say and that probably doesn't get picked up in 80 percent of the assessments that
I run.
So don't expect clients to be running good security but just know that even though it says stealth it's
not stealthy at all.
So this stealth scanning why was it stealthy why was it called this.
Well if we go back to the three way handshake what the stealth scan does is it does the sin it says
hey I want to connect to you in the open port if it's open we'll say yeah I want to make that connection
back with your friend.
And what's going to happen is we're just going to say you know what.
I'm just kidding I'm going to send over this reset flag.
So this asked me why.
Well that means we don't actually establish a connection.
So like when you go out to a Web site and you go to Google and Google loads well guess what you establish
that connection you establish that three way handshake.
What we're doing is we're going out and we're saying hey I want to establish connection.
The port reveals to us that yes I am open for connection and then we're gonna say just kidding.
Let's not make that connection because we never established that connection.
Then it was technically stealthy.
So that's why we're going out we're doing we're never making connections these ports.
But this is how we're identifying them as open.
So we're going to use a tool and we're going to use a tool like this.
We're going to say and map and we're going to say something along the lines of dash T for Dash Pete
Ash dash a.
Now you have no idea what this means and I don't expect you to.
I'm going to walk you through these and what we're doing here is we're saying hey and map I have a choice
and speed in that choice and speed can be between a one in a five one's really slow and fives really
fast.
Now the default for me has always been for and I'm teaching you my preference.
It's always been four.
OK.
And we utilize this in I think five five.
OK but five kind of fast maybe you're going to miss something maybe it gets caught.
The slower the better in terms of detection.
But in the instance that we're gonna be running it through this course we're going to use for any time
you do like a bold hub or something like a hack the box which you're going to see here in a few videos
you're going to run T4.
Just because you're not worried about this detection not worry about anything.
So T4 is a speed purpose.
Now dash P dash.
Well this stands for I want to scan all ports OK.
We could say something like dash P or we could just have dash P left off completely.
Now if we leave off dash P completely it's going to scan what are known as the top 1000 ports the top
1000 ports are your most common ports.
So think of like Port 80 port for 4 3 1 3 9 4 4 or 5 all the ports that we covered in the networking
section.
Going to show up again here.
But there are sixty five thousand five hundred and thirty five ports out there.
We want to scan every single one of those because what if for example there is a service running on
Port forty seven thousand seven hundred well that's not a common top 1000 port if we don't scan all
ports then we're going to miss that port.
And that could be something incredibly valuable to us.
Right.
So I always scan like this dash P dash.
You can also do things like scans Pacific ports you could say like 4 4 3 or say you under the skin just
for web servers you could do 80 for 4 3 something like that.
Or you can mix in so you want to scan for DNS as well you can add in fifty three etc. You can scan for
specifics if we're going to get into that in a little bit later video on why we might do it this way.
But for now for the beginner lesson dash P dash we're gonna scan everything.
And lastly we've got this dash a in here so dash a stands for everything I want to scan all of it.
I want you to tell me I want you to tell me the version information the operating system information
anything you can tell me fingerprinting etc..
Now this may all be confusing.
It's gonna make a lot more sense when you see a scan.
I'm going to go ahead and open up a new tab and what I want you to do.
Let's go ahead and I'm going to blow this up for us.
And what I want you to do is I want you to go ahead and start running the scan while we wait to go ahead
and copy this here.
And the last thing we're gonna do is we're gonna put in our IP address and that's how it knows where
to scan.
We're just gonna hit enter on that and now we're scanning so from here what we're gonna do is we're
going to take this.
And I want to run an app again with a dash dash help and I want to talk through some of these settings
in here so that you understand fully what we're doing now dash help is always great.
As I said before man pages are good as well.
But let's talk about some things here.
So we've got this host discovery section which we're really not going to use in this course but this
is good for say a dash.
And so you want to do a pink sweep of the network.
Well you can do a pink scan right where you just sweep an entire subnet a slash 24 for example and see
what's up.
Very quick a dash pen maybe the host isn't acting like it's online but you know it's there for sure.
You can say dash pen and you say hey I want to leave all the hosts or treat all the hosts as if they're
all online even if they're not responding to my ping requests or anything.
So make yourself familiar with this kind of stuff.
This is interesting and we'll cover a lot of this as we go in the course.
But just for the first walkthrough while we're scanning I think this is super important.
Now scan techniques.
This dash as SS comes back into play.
TCT sin is what it's called but it's also known as the stealth scan.
There's all these other types of scans.
You're not going to need them.
There's only maybe one scan out of all these that may be useful but you're not going to need them through
this course and you're probably never use anything but the SS and the s you.
Ninety nine percent of the time.
So for the scope of this course that's what we're going to focus on now.
The SS We've talked about connection oriented protocols we talked about TCB.
Well guess what.
There's also UDP and there's sixty five thousand five hundred thirty five ports over there as well that
we have to scan now UDP is a connection less protocol.
So what we're going to do when we scan it.
Let's go back to this scan.
We're going gonna do when we scan it is we're going to actually do that SEIU in here and I'll copy this
syntax and just move it over so it looks a little cleaner.
We're gonna say something like
we can put it anywhere we want big.
The order doesn't matter but we can say something like dash as you to scan for UDP and the one little
change that I make here to change is actually I take off the dash a.
And I do a dash P dash.
Why do I do a dash P I should say why do I do this.
I do this because UDP takes for ever to scan absolutely forever to scan because it is a connection protocol.
It does not have that instant response time.
So when we scan UDP typically we scan the top 1000.
That is my recommendation to you.
Or else you will be sitting here waiting for hours upon hours for a scan to finish.
See now our scan over here is already finished.
If I were to run this UDP with the same thing it will take forever going back into this before we get
into the scan you can see here that we can specify dash P of Port.
That's going to be very common for us.
But here's where I really want to get into we're doing a dash s v a dash SC a dash o here all with the
dash a.
OK.
So we're probing open ports for service information.
We could say dash SD and we can say dash I see you could pick these you know one or the other a mixture
of some of these but we could also do script scanning which we'll get into script scanning here and
a little bit as well.
But we can do OS detection where it goes out and tries to define an operating system and you're going
to see all this with our scan.
But when we use dash a it does it all for us.
So why why not use dash.
So you can see it does OS detection version detection script scanning and trace route.
Now there's one caveat to dash a we're going to talk about this in another video and a thought process
it is much faster to remove the dash a and scan a dash P dash typically that'll come back much much
much faster than what you can do is you can define the open port.
So say there's Port 20 to port 80.
OK.
Just go through this.
You can specify those ports specifically.
You could say dash P like we did an example earlier with 80 and 443 and then do a dash around those.
Now that will this scan only these specific ports with all instead of going out to every single port
in attempting to do all on every single port.
It's just a little bit faster.
Now if your wheels are spinning and you're thinking about it maybe even you can script this right.
You can script something to say hey end map I want to take I want to take these ports from a basic scan
anything that you pull back and I'm going to go ahead and I'm going to run a new scan on it with a dash
a only specifying the ports that we found back at your wheels spinning this is where scripting becomes
important.
If you want an improvement on speed.
For me personally I've never ever done that.
I don't think for me personally that it's made much of a difference.
I just let my scans run as they run and I work on other things while scans are running.
There's plenty of time to do other things while you're doing your scanning.
So in typically another thing to note is typically we're doing scanning when we're doing our O.S. as
So if we start up a client assessment one of the first things I'm going to do is probably kick off a
NASA scan or an end map scan.
And while I'm doing that I'm going to go look for those breech credentials or I'm going to look for
that juicy information on Google or social media where I can find it and utilize that time.
While this is scanning or else I'll just be sitting on my hands doing nothing while these wait.
So we're going to take this information now and we're going to start reviewing it.
So we have here our scan results and you can see the scan results come back.
And the first thing we notice are open ports.
That's what we're want to look at.
We want to look at these open ports and we want to look at what's running on these open ports.
So we see here that what's running on Port 22 is SS age.
OK.
On top of that it's got a version here for us.
So open SS H two point nine P to and then we see Apaches running on port 80.
We've also got Apache running on port four for three and we've got this RPG bind in one thirty nine.
Now remember from the networking lesson these kind of always play together.
So we've got SMB open basically samba shares.
And what we can do is first step is usually enumeration once we see this we take the scan and we scroll
down a little bit as well and we can look at some things and see OK.
There's no OS information.
It found Linux here two point four point x.
And it's most likely pulling that down from from the the Apache.
It's probably a best guess because it's running red hat that it's running Linux and taking a stab at
it here.
Or may have actually determined that from sort of header or some other location.
A lot of times this isn't so sure as it's saying it is here.
A lot of times we'll give you a percentage so the OS is not always definitive as it is here.
So we've got the OS which could be useful for us later when we do enumeration and you'll see how that
comes into play.
What I want you to take in right now is that so far we've got a scan result back and that scan has gone
out and it has looked for open ports doing that modified stealth handshake.
So it says Cin Sinek reset.
Aristide doing that.
It's found a few open ports now it is our job to look up the information that we are seeing on these
open ports and try to find exploits on them.
So that's what we're going to do.
And I'm going to cover in the next video we're going to go kind of step by step and I'll talk through
the methodology and why I attack certain ports first what ports those are how we can enumerate those
ports and then we'll enumerate everything.
Get all the details down.
Once we have all the details down we're going move into the section of exploitation.
It's gonna get really fun and we'll exploit this machine in multiple ways.
So from here just take apart or take that away from the lesson that you've officially successfully scan
this machine.
I encourage you to maybe go back and take notes or to go back and scan it again.
Get the syntax down in your head.
Keep typing this out.
Remember it.
This is the one thing you're probably gonna type up more than anything else.
And then also go through and look at the different types of options you have there.
If there's one that interests you just run it against the machine.
Play around with it.
This is your lab time.
Make the most of it.
So for now that's it.
In the next video we're going to start enumerating these ports.
So I will catch you over in the next video.