[MUSIC PLAYING]
Host Discovery with Nmap.
In this video, we're going to be taking a look at how
to discover systems or hosts on a network
that you are connected to.
So again, we're now going to assume that you're performing
a pen test on an internal network,
and your first order of business is to discover all the devices
on that network.
How can this be done?
This can be done through the use of Nmap.
More specifically, we're going to be taking a look at how
to perform a ping sweep or a ping scan with Nmap
in order to discover the active or the hosts that are currently
on the target network that you're currently connected to.
So I'll be demonstrating this or I'll
be performing this on my own local network
via my Kali Linux virtual machine.
You can also do this on your own local network just
to try and see if you can discover
devices that are connected to your local network.
And yeah, so I'm just going to switch over to my Kali Linux
VM, and we can get started.
All right, so I'm currently on my Kali Linux VM.
And my first objective is to identify my current IP
address, which I can do by typing in the command ip
a s or ipa a.
And you can see under the interface, ethernet zero.
In your case, it might be different.
My IP address is 192.168.2.190.
But this also provides me with the subnet of the network
that I'm currently on.
And you can see it also provides you
with the netmask of the network here.
So we can perform an Nmap ping scan on all of the IP addresses
within this particular subnet.
So before we do that, I'm just going to open up
the manpages for Nmap.
If you're not familiar with Nmap,
Nmap stands for Network Mapper.
It is an open source tool used for network exploration
and security auditing.
And it was designed to rapidly scan large networks.
And it really is the Swiss Army knife
when it comes down to identifying
devices or hosts on a network, performing port scans.
Also performing service enumeration,
et cetera, et cetera.
So the option we are looking for right now
or that we're going to be using is the sn option.
Let me see if I can find it here.
The sn option is the no port scan option.
So this option tells Nmap not to perform a port scan.
Because remember, we're trying to identify the list of systems
on this network before we start individually targeting
them or performing a port scan on them.
So this will only print out the available hosts that responded
to the host discovery probes.
And this is an often known or often referred
to as a ping scan or a ping sweep.
The way this works is it'll essentially-- the sn option
consists of an ICMP echo request, a TCP SYN.
A SYN packet is sent to port 443.
A TCP ACK packet is sent to port 80.
And an ICMP timestamp request by default.
When executed by an unprivileged user,
only SYN packets are sent using the connect call.
So we need to run this with the sudo command,
because it requires root privileges.
So in order to do this, I'm going to say sudo nmap and sn.
And based on your own network, you need to specify the subnet.
So in my case, the subnet is 192.168.2.0/24.
Solid enter.
This will take a couple of seconds.
There we are.
So it's discovered three devices on my local network.
So firstly, we have my router or my default gateway.
So you can see that this is the IP address of my router.
It's a Xiaomi router.
It also provides me with the MAC address.
In this case, it doesn't provide me
with the MAC address of the router,
but it actually resolves the name to the manufacturer.
And then we have--
yeah, it actually provides it--
it actually provides that here.
So Xiaomi Electronics.
So that's the MAC address there.
We then have the second system, which has
an IP address of 192.168.2.2.
And the MAC address tells us that the motherboard
is essentially manufactured by ASRock.
This is my Windows workstation.
And then this is the IP address of the Kali Linux
system or my Kali Linux system.
So it scanned 256 IP addresses.
And only three devices are up.
So as a penetration tester, this is something
that you should always be doing.
You should always try and discover devices on the network
that you're targeting.
You can then copy all of these IPs.
And you can then move on to the next phase, which
is performing a port scan on each of them
in order to identify services running on the target.
And then of course, you can move on to exploitation.
Now when performing host discovery,
you can also perform a host discovery using
a tool called netdiscover.
So by just typing netdiscover here,
it doesn't look like it's installed.
So I'll need to get it installed.
So sudo apt-get install netdiscover.
And I'll just use the y option to get it installed.
Netdiscover works by sending ARP requests, which essentially
resolve MAC addresses to IP addresses and vice versa.
Or vice versa, if you will.
So we can use netdiscover.
And we can specify the interface.
So ethernet zero.
And then the network range or the subnet, so 192.168.2.0/24.
In this case, it looks like that's not working.
Do we need to run it with sudo?
There we are.
So now it's working.
You can see now it's going to discover-- it essentially
discovers the same devices we were
able to discover with Nmap.
This is just another tool that you can use.
But the technique that is used to discover
devices that are currently on the local network
are different.
In this case, netdiscover utilizes ARP requests.
So fairly simple to understand.
All right.
So that concludes the practical demonstration side
of this video.
OK, so now that we've identified the IP addresses of systems
on a local network, we can now move on
to performing port scanning with Nmap.
So we're going to take a look at how
to use Nmap to identify open ports and the services that are
running on these open ports.
And we'll also be taking a look at the different types of Nmap
scans that can be run based on the target
that you're trying to perform the port scan on.
So I'll be seeing you in the next video.