OK, Big Tall is ahead of us, it's time we cover and map now what is a map where and map is shortened
for network map and it's a tool used to pretty much map the network or discover open ports on the target
system that you're scanning.
With those open ports, we can also discovered which services are running on those open ports and AMAP
can go as deep as discovering which version of a service is running on which open port on the target
system now and does have some other options as well.
But as we did mentioned in the previous video, we're here to only discuss the basics of unmap.
And if you'd like to dive deeper into unmap, you can take a look at our cheat sheet or you can also
learn it from the map manual.
We already know how to open the manual.
You just type men and then the tool name and it will open the manual for that tool.
However, we are not going to read it right now, we're more interested in running the help menu of
an map and this will be a shorter version of what are the possibilities with this tool.
As we can see, there are a lot of options that we can run if you'd like to read through them and see
what are the possibilities.
But right now, we're going to perform the very basic scan with a map just to see what output do we
get and what does this do for us?
The very basics scan would be typing the map and then the IP address of our target.
And as we can see, it finished in less than a second and this is the output that we get rescanned our
over spurtle machine and all the output that we get is which ports that our machines have open.
And there are quite a few of them.
So we have the 20 to Port Open, which is running the service of S.H. We got our website, Holsted on
Port 80, since it's running HTP over there.
And as well, we got our website on Port four three, which is running https.
But we do also get some other ports open that are running different services, and that is also why
and MAP is useful.
Perhaps sometimes once you're scanning a website, you will discover other ports that are hosting other
services, even though the website might not have bugs itself.
Maybe the machine hosting the website has other services that are vulnerable to a different attack,
but that is out of the aspect of discourse.
However, you can use and map to determine that, and you will use and map a lot if you perform penetration
testing.
So this very basic scan gave us the output of all of the open ports on the map, and it also gave us
that it found nine hundred and ninety one closed ports.
Now, why is that?
Well, and by default scans, most known thousand ports.
And out of those thousand nine hundred and ninety one were closed while as these nine ports are found
to be opened.
If you want to dive even deeper into these open ports and perhaps you want to discover our version of
a service that is running on this open port, you can run this command and map dash as the and then
the IP address of your target.
In our case, I'm using a can of BBWAA and if I run it, it will take longer to finish than this can.
However, it should also take about a few seconds.
Let's wait for it to finish.
And this is the output that we get right now, you will notice that it's quite larger than the previous
one since besides getting the same output, which is which ports are open, we also get this column
right here that says version.
It gave us the version of each service that it is found on Open Port.
For example, if we take a look at S.H. running on Port 22, we get the exact same version that this
target machine has, as well as we get the exact Apache version that is being hosted on Port Eighty
four HTTP.
And we do see that it does match with the output that we got.
If you remember from our what we have to remember that we got the Padget two point two point fourteen.
Well, and MAP gave us the same results so we can pretty much determine that this is the correct output
and that the target machine is indeed running Apache two point two point fourteen.
We also get the versions for other ports as well.
So this is pretty useful information.
And we can also see that apparently HTP is being served on these ports as well.
So it's not only Port 80, we also have HTP running on Port eighty eight, which is running Apache Tomcat
and we got HTP being served on port eighty eighty one, which is running jete.
Now this is something that we didn't know before.
And now if we go for example, to our Firefox and we try to visit our Auvers Vertonghen one Port Eighty-eight
one, so let's type it right here.
Eight zero eight one.
Wow.
So we do open another Web page.
This is a Web page that we didn't see before, since by default, every browser opens a page on Port
80 since that is the usual HTP port.
If we wanted to, for example, open up Web page on a different port.
We need to manually type it like this.
And we do open another Web page.
Let's see, what else do we get?
So pretty much that would be about it, all of these services version and another thing that I want
to show you that it's possible with a map is to use something called scripts now.
And Map can also try to find vulnerabilities.
It can be used as a vulnerability scanner.
How can we do that?
Well, we can type something like this and map that script.
Then we type one and then the IP address of our target that this will take a little bit longer to finish
because it does perform all the scripts that are used for discovering vulnerabilities.
And while this is running, let me show you this website called and map dot org where you can pretty
much read anything about and map that you like.
You can go to this page and you can also find manual here.
Read all of the available options with MAP, read what it is used for in case you're interested in this.
Awesome.
Let's see if our scan is finishing.
We did get some output right here.
And by the way, you can check out the percentage of your scan by typing up Arrow and it will tell you
at what percentage is État.
So let's wait for it to finish.
OK, and this did last much longer than I thought.
It took quite a few minutes, but it's finally over and here is all the output that we get if we scroll
all the way up.
Let's start from the beginning.
It's going to run the scripts per port so it determines first which ports are open.
Then for each port it runs all of the scripts that are used for discovering vulnerabilities.
As we can see for HTP Port 80, ETRAN First Descript HTP cross domain policy.
Down here, it tells us that the state is vulnerable, so perhaps we found our first vulnerability.
Keep in mind that sometimes and does know to give false positives and will show in just a second why
let's go all the way down.
We got to see SRF script running right here.
It tells us found the following possible sites are fallibilities.
So this is not really one hundred percent just says that it could be possible on these links.
And by the way, if you don't know what these vulnerabilities are, SRF access, don't worry.
Those are all the bugs that we will cover once we get to the bug bounty.
And trust me, we're getting there quick.
Nonetheless, let's just go through this.
Here is the HTP don based access and let's see right here found the following indications of potential
don based access.
That's interesting on this page.
Let's go down here.
We got the Ezekial injection script running.
It found impossible SQL injection queries on these links right here.
This is all the links that we would want to test in a real penetration testing attack down here.
We got HTP stored exercice script and here it says couldn't find any stored vulnerabilities.
And that is false.
I assure you that on the page or on on Wesp we will get certain pages that do have HTP stored access
so you can never fully trust what you get from a certain tool.
That's why we will be discovering all of our bugs manually and not with tools.
So you can scroll all the way down and check out all the other scripts that end up and what are the
results, or if you don't want to run these type of scans, which you use every single script to discover
vulnerabilities, you can, for example, Copiah scripts name, which you can also find in the map dot
org website, you can find all of the scripts that the map has and you can run a single script by typing
and map, dash, dash scripts, then the script name and then your target IP address and it will only
run this one script.
In case you're trying to target just one vulnerability, you can simply just run just one script that
discovers that vulnerability and see what the map will tell you.
Once again, if I'm not mistaken, this is TotEx assets will give us the result that there is no such
thing on the Spurtle machine.
However, we will see later that stored accesses does indeed exist on our wesp virtual machine.
And here is the response.
So this is what we get open ports and on the ports because access is a website vulnerability, it tells
us that it couldn't find any store and access vulnerabilities on both HTP and HTP is OK.
Nonetheless, these are some of the basics of a map and how we can use that map.
Now, I strongly recommend that you dive deeper into this tool and we will be leaving some resources
for you to take a look at in order to learn and map, since it can be useful not only for website penetration
testing, but for penetration testing and ethical hacking in general.
This is one of the most important tools that hackers use.
Nonetheless, as I mentioned, you will have resources where you can learn more about this tool.
And in the next video, right before we get into it, there is one more tool that we need to cover,
which is called McDo see in the next video.