In this episode of the junior pentester training series, we are going to begin our education with NMAP. And the very first thing that we're going to do is live host discovery. Now NAP, if you've never heard of it before, stands for the network mapper. And this is one of those industry standard tools that pentesters across the board, doesn't matter where you're from or what you do, what level you're at, end mapap is kind of one of those tools that will end up becoming your best friend, especially as you go through network mapping, obviously since we're in network security and of course when you're trying to do any kind of active reconnaissance.
And it even has a lot of scripts internally that will allow you to find information about the operating systems or the services or the endpoints that you're scanning and even find vulnerabilities for them. So this is a really really good tool, very powerful tool. It's free, so you can actually install it pretty much on any machine. If you have Kali Linux installed, it will come pre-installed with Kali Linux and most distributions of Linux will also have it installed on there.
So really, really good tool. really powerful tool, one of my favorites, and it's one of those tools that uh has a graphical interface, but the real hackers, the real ones out there will only end up using the command line version of it. And I think there's even a website version of end mapap. I don't know exactly how functional it is and what you can do with it.
But I do know that there is a version of it that I think is accessible through a website. So, we'll find that out for sure. But for now, we're just going to be talking about live host discovery, specific to NM MAPAP, and we're going to go through the various types of scans that it offers to do live host discovery. The overview of our video today is going to be obviously the intro.
We're going to talk about sub networks, enumerating targets, discovering live hosts, the host discovery using ARP, using ICMP, using TCP and UDP, and then reverse DNS lookup. Then we'll do our summary. We'll do our wrap-up review kind of a thing and that'll be it. You'll be dismissed for the day.
Uh, this room was developed by Stratagos Strategos. Still don't know how to pronounce that. There was a really good comment that came in the comment section that was like, you know, it's pronounced Strategos or like they just spelled it out. And I was like, yeah, it's actually pronounced this way.
And I like I couldn't help but laugh cuz you can read it in either way. So, it's it's Anyways, I thought it was funny. Um, this room is free. This video that we're doing is inside of a free room with Tryh Hackme.
They've been doing a lot of good free rooms inside of the network security section here. So, anybody, as long as you have a username and password, you can get access to the virtual machines, the attack box, all that stuff inside of this room. There are hundreds of free rooms inside of Try Hackme. I highly encourage you to have at least a free user account with them.
And of course, there are going to be timestamps for everything that we talk about in this video today. So if you want to skip around and jump to any specific section, you can look into the description below and you'll be able to find the timestamp for that section. That being said, a quick note from Hackaholics Anonymous and we'll jump into it. If you're serious about your science education and you want access to me on Discord, consider joining Hackaholics Anonymous.
We have four tiers, the supporter, agent, guardian, and master. Each tier gets their own Discord server and early access to content. the agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations, live streams with me every month, plus so much more. And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you will be able to join hackaholics anonymous.
Now, without further ado, let us jump into NMAP live host discovery. There are two key questions that you want to answer when you're targeting a network. The first question is which systems are up? Second is what services are running on those systems and you want a tool that can reliably do that for you repetitively.
Meaning one after another it can reliably deliver those results to you. This specific tool is called NAPAP for me and for many other people in the offensive security world in pentesting and hacking. So the first question about finding live computers is answered in this video. And this is the first in four videos that's dedicated to NMAPAP.
And the second question about discovering running services is answered in the next videos that we're going to be doing right after this one. So the one that we're doing right now is N MAPAP live host discovery. The next video is going to be basic port scans. Then we're going to do advanced port scans.
And then we're going to do N MAP postport scans. So, in this video, we're going to talk about the steps that NM MAPAP carries out to discover the systems that are online before we start port scanning, right? So, you want to see whether or not they're actually online before you start doing everything else. Otherwise, you'll be wasting time and energy.
So, this is crucial because you want to try to do port scans offline or if you try to do port scans on offline systems, you'll be wasting time, right? As I just mentioned. So um we present the different approaches that NAPAP uses to discover these things and it's known as the ARP scan address resolution protocol. The ICMP and of course TCP UDP ping scans.
So the ARP scan uses ARP request the ICMP uses ICMP pings and of course TCP UDP uses packets for TCP and of course UDP ports to determine those live hosts. There are going to be two scanners specifically that we're going to be talking about. the ARP scan and the mass scan and we can explain or we will explain how they actually overlap which parts of NMAP's host discovery and as already mentioned we're going to be using end mapap to discover systems and services uh it's created by Gordon Lion just got kind of as like a backd dooror for you it's either Leon or Lion also known as Fiodor Fodor Fodor uh a network security expert and open-source programmer it was released in 1997 um it's short for network mapper. It's free.
It's open source, released under their GPL license. It's an industry standard. I mean, literally, I said all of these things. There's also the scripting engine that can further its capabilities and it can usually go through the steps that we can see right here.
It can enumerate targets, discover live host, reverse DNS lookup, scan ports, detect versions, detect operating systems, do trace route scripts, and even write the output into a report that you can use later. This is why we love N MAPAP. So some of the questions will require the use of a static site to answer the task questions while the other ones will require the use of the attack box and a target virtual machine. So the very first one for sub networks is the static site that we're going to be using.
So let's do that. Before we actually use it, we need to cover a couple of terms here. So a network segment, okay, also known as a subnet, is a group of computers that are connected using a shared medium. So for example, the medium could be an Ethernet switch or Wi-Fi access point in an IP network.
A sub network is usually the equivalent of one or more of these network segments connected together and configured to use the same router. The network segment refers to a physical connection while a subn network refers to a logical connection. In the following network diagram, the thing that we see down here, we have four network segments or subnets. And generally speaking, your system would be connected to one of these subnets or network segments.
A subnet or simply or subnet network simply known as a subnet has its own IP address range and is connected to a more extensive network via a router and there might be a firewall that enforces security depending on each of the networks. So in this specific network, so let's see if we can kind of look at this a little bit better. Maybe not. So I'll just keep it like this.
So uh we have network A, we have network B, C, and D. So network A are these computers right here. It looks like it has a router. Network B looks like they are data devices.
There's a firewall in here as well. And there's also a router. Oh, so this is actually a router. This is a wireless access point, I should say.
And then network C seems to also have a wireless access point. And then network D has another router, firewall, and several other devices in here as well. So we have a series of networks here. We have the IP address ranges that you can see right here.
So 101100.0/24. Now I don't want to get too deep into this because this is a specific like a networking conversation but you do need to know how to read network uh IP address ranges. So essentially when you see forward slash24 that means the first three octets. So let me kind of zoom in on this for you a little bit.
So the first three octets that let me my keyboard is not working. There we go. These three so the 10.100 are three octets. Each one of them represents octet.
So 8 uh bits I want to say. Um and so what that is is when you see a forward/24 that means 3 * 8 is 24. So the first three are assigned. That's the subnet.
And then the last position right here is what's going to be changing and alternating and creating a variety of IP addresses for this specific subnet right here. This one right here is 102006. And this 16 that you see represents the first two octets. So meaning these two are accounted for.
These represent the subnet or the segment. And then these last two positions will end up giving you a variety of different IP addresses. This one right here can have a maximum of 254 addresses. This one right here can have 254* 254, which is I think like 65,000 something.
So this one obviously gives you a much larger range of IP addresses that you can use. And then we have this one right here which is again another one 103200/24 right here. So this gives us the first three positions. The first three octets end up being the subnet or the segment.
And then finally we have the one up here which is another one that has the first two octets assigned and then the last two octets are assigned or available for IP address assignments. So we see two small network segments and two large network segments and this is all part of a very gigantic network. So it's probably like a an enterprise environment like a corporate environment right. So subnets with 16 which means that the subnet mass can be written as 255 255.
So the first two are taken the last two are open. For 24 it means 255 255 255 which means the first three octets are taken and the last one is open. So we can have about 250 hosts hosts for this one. And then this one can have 65,000 hosts.
So very very very large network. So you might want to refer to task two in the intro to LAN room if you have no idea what this means. Or at the very least go and watch the SCIC 101 playlist on the elements of subnets and networking. or just if you really want to get good at this, go through the CompTIA network plus playlist and you'll get a very good education on this as well as everything else that has to do with networking and it'll make you very proficient with NAPAP because NAP again is the network mapper.
So you want to know as much as you possibly can about a network, the infrastructure of it, the various elements of you know Ethernet versus IP address, the OSI levels, etc., etc. So there's a lot of stuff that is available to you that you should be looking at. Uh or is it OSI or ISO? I want to say it's OSI.
Um so anyways, uh as a part of active recon, we're going to discover more information about a group of hosts or about a subnet. And if if you're connected to the same subnet, you would expect your scanner to rely on address resolution protocol queries because the query itself looks for the MAC address. and a MAC address is on layer two before it actually gets to layer three which ends up being IP addresses. Right?
So the communication over the link layer becomes possible on this layer. However, we can use this to infer that the host is online and revisit the link layer. We're going to be doing that in a couple of minutes. So if you're in network A, which is this piece right here, this one right here with the subnet of uh 10 10100 allowing for the last octet to be available.
So if you're in network A, you can use ARP to discover the devices within that subnet, which is this right here. Suppose you're connected to a subnet different from the subnet of the target system. In that case, all packets generated by your scanner will be routed via the default gateway which is the router to reach the systems on the other subnet. The ARP queries will not be routed and hence cannot cross that subnet router because the ARP queries can only work on your local subnet.
ARP is a link layer protocol and the packets are bound to their individual subnet. So we're going to click on view site to start the network simulator and we'll use this to answer the questions in task 2 4 and five. So here we go. Send a packet with the following from computer 1 to computer 1.
It's going to be an ARP request and the data is going to be computer 6. And we're going to send that packet as we can see right here. How many devices can see that request? Did computer 6 receive it?
Send a packet with the following right here etc etc. So, I'm going to zoom out of my screen a little bit just so we can actually see it in split screen because this type of uh static site that we get actually opens up in split screen like this. So now we can see this this uh network diagram that we see right here and at the bottom we actually have these elements that we can go ahead and mess around with it. So the first question is asking us to go from computer one to computer one using an ARP request and the data is just going to say computer 6.
So right here we have computer one to computer one. We're going to change it to an ARP request and then the data is going to say computer 6. So there we go. We're going to send that packet and I should be going up here just to be able to see it.
So I wonder if it already sent it. So let me send it one more time. There we go. It sends it.
So you can see that it got sent out, right? And then that's basically it. It didn't leave the router, right? So we saw the blue dots came.
They went to these other ones. They even went to the router, but it didn't leave the router to get to switch two, which would end up being in this subnet that would connect to computer 6, right? So, that was it. So, we'll do it one more time, and then we'll go up here.
You see that the blue dots only go to and then the blue dot never leaves the router. So, it stays within this subnet. So, computers 1, two, and three got it. The switch got it.
The router got it, but the switch number two did not get it. Therefore, this segment did not get it. So how many devices can see that ARP request in this particular case if we're counting the router it would be four. So let's see that is the an answer specifically.
Did computer 6 receive the request? And the answer is no because it didn't even leave from the router to get to the second switch. Now send a packet with this following configuration. Computer 4 to computer 4 ARP request trying to get to computer 6.
Now, computer 4, as we can see, is in this subnet. So, computer 6 should receive that. So, we'll do computer 4 to computer 4, and we're going to send it. And then we can see that computer 6 indeed received it.
And then the computer 6 responded. So, you saw that, right? So, let's do this one more time. We're going to do it.
It sent it. And then computer 6 responds. And now computer 4 receives it, right? So, it's coming from computer 4 to computer 4.
We're trying to connect to computer 6. And then now we actually have something inside of the network log, too. The ARP response is, "Hey, computer 4, I am computer 6." So, that's computer 6 responding. And then this one, it says, "Hey, computer 4, I am computer 6 again." Oh, that's because I sent it twice.
So, that's the reason why. So, computer 4 sent the request and computer 6 actually responded. So, now in this case, it says, "How many devices can see it?" Again, it's four, right? But did computer 6 actually reply to the op request?
In this case, it did reply. So the answer to that would be yes. So excellent. Now we can zoom back in and go into the next piece which is going to be enumerating targets.
Now in the few tasks ago we looked at the various subnets right and we were talking about also the techniques that we can use for scanning them. But before we do that, we need to establish the targets that we actually want to scan. So we can provide a list in general, a range or a subnet in its entirety and say just scan everything inside of this subnet. So the examples of the target target specification would be something like this.
So a list would be you give it the IP address and then you give it this specific element right here and this specific element and it will give all of these things a scan. So technically we have three IP addresses that we're going to be scanning the actual IP that we've assigned this the one that we gave right here. It's going to also scan this website or whatever the IP address would be for this website and then it's going to also scan the IP address for the this website. So we're providing three different uh targets for it to scan.
When you do a range, you say I want you to do 10 11 12 15 220. So it's like 10.11.12. That's the subnet. And then you're going to say I want you to do 15 220.
And it will scan six IP addresses number 15 16 17 1819 and 20. So it includes this as well as everything in between as well as the last one. Right? So that's a range and then you say scan a subnet.
So the IP address and then forward slash30. It'll scan four IP addresses. Now this is kind of tricky. So this is the part that I wanted to make sure that I got uh a good understanding of when I was initially learning this networking and subnets and things like this.
So let's figure out why if we do forward/30 because so far we've done you know we've done forward/16/24 and that's a little bit easier to understand cuz you have an octet right so each one of these represent eight so if we do three of them that would be 24 if we do two of them that would be 16 so what does it mean when we do forward slash of 30 in order to understand this we need to first understand what c is and it stands for classless interdomain routing so interdommain domain meaning inside of the domain and there's no class assigned to it and it's we're routing it. So the forward slash30 in this particular case in this specific uh phrase right here is shorthand for the subnet mask. So that part we already know that this is the subnet mask that we're doing. So you could have a for/16 24 etc.
The part of the IP address that identifies the network is the network portion which is represented by that 30 and the host portion if part is part of the uh IP address that identifies the devices within that network. So the number after the slash indicates the number of bits right used for the network portion. So since an IPv4 address has 32 bits in total, the forward slash30 means 30 bits are already used for the network part and two bits are left for the host part. So 32 total bits minus the 30 network bits will leave us with two host bits.
Now how we calculate the actual number of hosts is since we have two host bits, it's 2 to the power of two. So whatever the uh the total number of IP addresses is the formula for it is it's 2 to the power of n and n is represented by the number of two host bits. So in this case the two is the constant right and so it would be left to the power of two. So 2 to the^ of two would be four.
If we had a subnet of 24 right here right so 32 minus 24 will end us with end up with eight. So it would end up being two to the power of 8 and it will give us let's I think it's like 256 or something like that. So the four IP addresses just to break it down even more. They always have specific roles.
So there would be a network address, a first usable host address, the second usable host address and the broadcast address. Now the first IP address in that range in this range of what's available here, it's usually identifying the network itself and can be assigned to a host. This is also known as the gateway address and it belongs to the router. Then the next one would be the host.
Next one would be another host and then the last one which is typically 255 ends up being the broadcast address meaning it sends out data. So it's the broadcast address and network address are always taking it up. So when we say that there is a total of 256 available, the first one is taken by the gateway. The last one is taken by the broadcast and then anything in between is available for hosts.
So 256 minus one and two will leave us with 254 meaning we have a possible 254 assuming that it was a forward/24 for that subnet. In this case it's for/30. We have a total of 32 bits. So 32 - 30 will leave us with two bits.
2 to the^ of 2 end up being four IP addresses. So out of the four IP addresses in that range, only two are actually usable for assigning two devices. So hopefully this now makes a little bit of sense for you or it makes more sense. Hopefully it makes more sense.
So we can also provide a file as the input for a list of targets. So you can do N map uh lowerase I capital L and then give it a list of hosts inside of a text file. If you want to check the list of hosts that it'll scan, you can use N mapap lowercase S capital L and then give it the targets. And this option will give you a detailed list of the hosts that end MAPAP will scan without actually scanning them.
So NAPAP will attempt a reverse DNS resolution on all the targets to obtain their names. Names might reveal various information to you as the pentester. If you don't want to go to the DNS server, if you don't want NM map to the DNS server, then you can use the lowercase N so that it doesn't resolve names. So, we're going to launch the attack box, which I've already done.
And I'm going to open a terminal and use N map to answer the following question. So, if I scan this, so number one, and I feel like it should be kind of already noticeable for us, right? Cuz it says uh it's giving us a forward/29. So we know if we do 32 minus 29 it's a total of what 3.
So 2 ^ of 3 I want to say is what is that? Eight, right? So what would be the the first one that it would scan? It should be if I'm going to I just want to guess it before I do this.
It should be nine cuz the first one would end up being um the gateway. So I think it would be nine and it's not. So would it be eight? It is eight.
Okay, great. All right, so that makes sense. So that would be the first one that it would scan, right? Because we would have technically 10 10 12 and then we're giving the first 32 bits are already taken or excuse me, the first 29 bits are already taken.
So inside of this whole thing, the first 29 bits are taken, which actually takes into this octed as well. And we're left over with three. So 32 - 9 g uh 32 - 29 gives us 3. 2 ^ of 3 would give us 8.
So that would end up being 10 10 12 and 8. So what I want to do is actually scan it. So I want to actually run end mapap to scan it. So let's open up our split view here and go to the attack box that's right here that's already launched.
And I might need to zoom out to make this functional here. So that's the Oh, there we go. That's the attack box. And then we're going to open this up in a larger screen.
And then we're going to shrink this back down. And then zoom back in here. And so we're going to go ahead and scan this specific network segment. So I'm going to copy this.
Go here. And let's close this out. Close this out. And open our terminal.
And very, very simply, we're just going to do end mapap. And then we're going to paste that address that we had. Press enter. and it starts scanning.
So, scanning uh end map done, eight IP addresses, zero host up, scanned in 00 seconds or whatever, whatever. Um, didn't really give me much, but it did give me the fact that it scanned eight IP addresses. I could do I believe I could do for/v for it to give us a more verbose output. So, there we go.
When we use verbose, it actually gives us the IP addresses that it's scanning. So the very first one that it scanned is 10 10 12 8 and then 9 10 11 12 13 14 15 and that was it and they were all down. So they're not working because obviously it was uh dead. We didn't launch any kind of a virtual machine to do this.
It was just we're trying to figure out what it would scan. So how many IP addresses will end mapap scan if you provide the following range 1010 and then 255 right? Is that 10 * 10 0 255 and then it goes from 101 to 125. So it includes 101 and it includes 125.
So it this doesn't make sense actually cuz this part is kind of confusing to me. This piece right here is confusing to me. So let's actually go over here and let's just do end mapap and see what the result would be cuz that's the piece that's a little bit bit bit interesting. Oh, interesting.
because we're getting for this octed we're actually giving it a range and then for this octed we're also giving it another range. So if I press enter it should be down but it should give us how many that it actually scanned in a couple of seconds so that it'll just calculate it for us. But that's the part that was kind of confusing to me was this piece right here because this is actually for this octed is giving us from 0 to 255 and then from this one is from 101 to 125. So you would end up multiplying that.
You would multiply them together. And interestingly enough, this was actually open. That's interesting. So which one is it?
This is the report for 10 101 131 1119. That one was actually open. And the one above it is also open. Interesting.
So okay, how many it scanned? 6400 IP addresses were scanned and 125 of them were up. So, if we scroll up here, we actually get to see all the ones that were up. So, interestingly enough inside of that range.
I don't know what what uh whose IP range we just scanned cuz I didn't launch any kind of a virtual machine. So, interestingly enough, that actually worked. So, 6400 would end up being our answer and we actually got some results, which is kind of interesting. All right.
So now let's go to discovering those live hosts. So we did enumerating of the target. So now we want to discover the live hosts. All right.
Now we're going to look at the TCP IP layers. And so we have the ARP, ICMP, TCP and UDP. So from the bottom up. So we can see right here, right?
So this is the ISOsi model. And this is typically this is the more modern version. The TCP IP is a more modern version of this. But still in a lot of networking conversations they refer to the OSI model uh more than anything else because it's the seven layer model.
It starts from the bottom to the top. So everything starts from the physical layer and the physical device connected to a physical cable that's being drawn from outside or it's you know being drawn from uh your router or from your modem and it's going outside right and then it connects to the the big cables outside etc etc. So from the physical layer it goes to the data link layer and the data link layer is the layer where your ARP protocol works from and then this is where MAC addresses come into play and then it goes from here to the network layer and on the network layer is where IP addresses come into play and then the transport layer. This is both across the board.
Same thing over here. And of course uh when we look at the TCP IP, the equivalent of the first two, the physical and the data link are just known as the link layer in TCP IP. So it covers the ARP, Ethernet, Wi-Fi, DSL, Bluetooth, all of those things are covered in this section. And then where IP addresses come into play would both be on the network layer.
So we have IPv4, IPv6, ICMP, IPSC, etc. And the transport layer on again is the same on both of these. And we have the TCP UDP protocols. And then on OSI you have five, six and seven all being a part of when the data is being presented on the receiving side.
So you have the session that's generated data is now formatted for proper presentation and it's presented through some kind of an application. Let's say the web browser. Okay. All of this is combined into one and it's for the application layer.
And inside of this again we have HTTP or HTTPS. We have SMTP POP 3 which are both related to email. You have IMAP and you have SSH, FTP, SNMP tell and then all of the other protocols that essentially come through a variety of different ports that are presented on the application layer. So TCP and UDP feeds into these various ports and these various protocols.
So you have a bunch of TCP ports, a bunch of UDP ports, and the way that they present data to us and how we use them through our application layer, whether it's email or web browsing or watching a video, etc., whatever it is. So this is just a very like very surface level overview of the OSI model or the TCP IP model. But you need to understand that it starts from the link layer or the physical layers and then it goes to the network layer and then it goes to the transport layer etc. So knowing this right keeping this in mind then we're going to be talking about how scanners can actually use each of these in detail.
So these four protocols specifically the ARP layer uh ARP being that it has the single frame or the single purpose of sending a frame to the broadcast address on the network segment and asking the computer with a specific IP address to respond by providing the MAC address of that computer. So we know by you you know uh address resolution protocol essentially is very similar to what we saw earlier in that one exercise the static website it sends it to everybody right that ARP request is sent to everybody and then all of the computers or the machines on that network segment are going to respond saying that this is my IP address and then after that it'll be stored in the table of the data including all of the MAC addresses and their associated IP addresses And then from that moment on, anytime that another ARP request goes out, it says for this specific IP, I know that it has this MAC address. So I need this specific IP to respond. Okay, so this is all done on the data link layer or the link layer as we can see right here.
Okay, ICMP has many types. So it uses type 8 for ping echoes and type zero for echo replies. And if you want to ping a system on the same subnet, the ARP query should precede the ICMP echo. Again, because it's on the same subnet, so the ARP can just communicate with it.
You don't need to do a ping to the IP address. And then TCP and UDP are transport layers, but for network scanning, a scanner can send a specially crafted packet to the most common TCP or UDP ports. They call it the top thousand, but it doesn't necessarily mean the first thousand in the range of 65,000 plus ports. It doesn't necessarily mean that it's the first thousand.
They're just talking about the top or the most common uh thousand ports to check whether the target will respond. And it's sufficient especially when ICMP echo is blocked. So if we've closed the network simulator, which I did, um but we can click on view site in task two again to display it again. And then we can go through the rest of these things.
So technically, I think I can just still do split view. And it's super zoomed in. So I got to zoom back out again. Um, and now it's inside of the the attack box.
Look at how zoomed in that is. Is my keyboard working? Why is my keyboard not working? So let me see.
There we go. Okay, there we go. So we can zoom out a little bit and then we can go back to the network simulator, which is what we have right here. And so we'll use this to answer the following question.
So first it says, send a packet from computer one to computer 3. So, we know they're already in the same subnet. We're going to do a ping request for the packet type. And what's the type of packet that computer one sent before the ping?
So, I already know that it's an ARP, but let's check it out. So, it's going to go from computer one to computer 3. And we're going to do a ping request and no data needs to be submitted. We're going to send it and we'll see that it sends it, right?
And then computer 3 will actually respond. But then what we can see right here and it's continuing, right? So first it sent the blue packet and then it sent the ping packet. Right?
So if we go look at this down here now in our network communications. So first it sent an ARP request and then the computer responded with a ARP response. Then it sent a ping, right? And then the ping was also done in several packets that were sent or several log items that were sent.
But the first type of packet that was sent, it was the ARP request, right? So first it does the ARP and then after that it does the ping. Now what is the type of packet that computer one received before being able to send the ping? And that was the ARP response.
So how many computers responded to the ping request and that was one because it was just sent to computer 3 and because they're on the same subnet it found it immediately and from there it was able to respond immediately. So now what we're going to do is we're going to send it from computer 2 in the first subnet to computer 5 in the second subnet. And now we're going to do again the same ping request. So I'm going to do this computer 2 up here and it's going to go to computer 5.
And this would work the same way if we chose any of the computers in this subnet to go to this subnet. It would still be the same concept. So now we're going to do a ping request again. We're going to send packet.
Go up here. So it sends it right now. The router responded saying that this is not in my network. So, it's going to send it to this subnet and then computer 5 is going to respond and then the ping is going to go to computer 5.
Computer 5 is going to respond and then from there the ping is going to go to computer 2. So, first there was an ARP, right? There was the blue dots, the ARP request that was sent and then the ARP response came from the router saying that this is not in my situation. It's not in my subnet and then or I guess it's not in this this switch's subnet.
So the router said I need to communicate you. I need to route you to this other subnet. And inside of this subnet computer 5 then responded with a blue dot. So it was another ARP that was respond and then from there it sent the green dot which was representing the ping packet.
So we see it right here ARP packet ping packet. Right? So we saw that. So now it says what's the name of the first device that responded to the first ARP request and that was actually the router that responded.
Right? So, what is the name of the first device that responded to the second ARP request? And that was computer 5 that actually responded. And we're going to send another ping request.
Did it require new ARP request? Now, here's the interesting thing. Same thing, right? Same configuration.
So, we're going to send another one, but they already have communicated with each other. So, you notice it just sends a green dot and they immediately responded back to each other. Because the ARP table has now been built because they sent those blue dots. we now know which MAC addresses belong to which IP addresses.
And then from there, you don't need to redo another ARP request to find the IPs, right? So, it now has that table and it knows that, oh, okay, I need to just send it to the IP address for this computer. So, I'm going to match it up to the MAC address for it. I no longer need to do an ARP request.
So, no, it did not send a new ARP request, right? So it builds those tables unless you clear that ARP table and you just clear it out and start from fresh. It's not going to send any more ARP packets. And the main reason for this is to like make the communication between the networks more efficient and faster, right?
You like if you had to send ARP requests every single time, it would be very inefficient and relatively slow. It's this is all happening in a matter of seconds anyways. So it would just be relatively slower. Anyways, that is our exercise for that one.
And hopefully that was that was kind of fun for you. I I like seeing these types of communications. So, so hopefully that was as fun for you as it is for me because I am very much a nerd and these types of things geek me out. I nerd out over these kinds of things.
So, let's do the end mapap host discovery now. So, going back to the beginning of this video, it's very important to avoid wasting time with port scanning if you don't even know if the host is online. So, if the host is offline, you're literally wasting time and energy and processing power and all of that. So, the first thing is we need to find out what host is actually live.
What hosts are up and running. And there are a few ways that we can do this. When there is no host discovery options, end mapap will follow these specific pro protocols. So when a privileged user, so pseudo user tries to scan targets on a local network, end mapap uses ar request, a privileged user would be root or somebody that's on the pseudo list and can run the command pseudo.
When a privileged user tries to scan those targets outside of the local network, NMAP uses ICMP echo requests, TCP acknowledge or to that that goes to port 80 or TCP synchronized to port 43 and ICMP timestamp request. And when there's an unprivileged user trying to scan the targets outside the local network, it uses the TCP 3-way handshake and it sends a full set. So it sends the SIN, SIN acknowledgement, and acknowledgement, right? So all of those things are actually they need to be completed.
It's a full connect scan that's being done and it goes to ports 80 and port 43 443 excuse me. So by default using a ping scan to find live host and then proceeding to scan live host is what end mapap does. And if you want to use it to discover online host without port scanning the live system you can issue the SN so it doesn't do a port scan and then you just give it the targets. So we'll see what that actually is.
So ARP is possible only if you're on the same subnet at the target system. We already established that on Ethernet 802.3 and Wi-Fi 802.11. These are just standards and you will become very familiar with them if you're not already. These have to do with again networking concepts.
So you need to know the MAC address of any system before you can communicate with it. The MAC address is necessary for the link layer header. The header contains the source MAC address and the destination MAC address. to get the MAC address, the operating system sends the ARP query and the host that replies that to the ARP query is actually up.
So if the host replies, we're assuming that the host is up and running. The ARP query only works if the target is on the same subnet as yourself. So we're being redundant right now by saying this over and over and over again, but it's important for you to understand. ARP only works if it's on your subnet or your segment.
So on the same Ethernet Wi-Fi is what we mean. you should expect to see many ARP queries generated using uh during an end map scan of a local network. If you want to only perform an ARP scan without port scanning, you can then use the PR option and then the SN option. So, it's PR combined with SN and where PR indicates that you only want to do an ARP scan.
The following example shows NAP using ARP for host discovery without any port scanning. So again, N map PRSN the machine IP and then forward/24. So in this particular case, we're doing we have this subnet established. So we're doing the first 24 octets is already established.
So we're only scanning the next one. And so we have pseudo end mapap and then we're doing the ARP and then we're doing uh no port scanning and then we're giving the assignment to it and then it'll just do and see whether or not these things are up, right? And so it tells you this host is up, this host is up, this is up, this is up, etc. So the attack box had the IP address and it used ARP request to discover the live host on the same subnet and it scan works.
The ARP scan actually works. As you can see, this is what it kind of looks like. If we wanted to look at what the dialogue would be between the two endpoints. So you have the requesttor being this.
It sends the ARP request and then this replies and the host is up. That's it. We don't do anything else. There's no back and forth.
If you did a TCP, we would send one, this would reply and then we would send another one. That would be the full TCP connect scan. So, if we look at the package generated using a tool like TCP dump or Wireshark, we will see network traffic similar to the figure below. And in the figure below, Wireshark displays the source MAC address, destination MAC address, protocol, and query related to each request.
The source address is the MAC address of the attack box while the destination is the broadcast address as we don't know the MAC address of the target. However, we see the targets IP address which appears in the info column and we can see that we are requesting MAC MAC addresses of all the IP addresses of the subnet starting with and the host with the IP address that we're asking about will send an ARP reply with its MAC address and that's how we know that it's online. So you see it, right? The broadcast address is sending everything.
Hey, who has this? Who has this? Who has this? Who has this?
Who has this? And then it says, tell this one, right? So whoever has this, tell this. So it's sending all of those requests out just because it wants to know what the responses are and which MAC address belongs to which IP address, right?
and the source MAC address. You can see right here, this is the source MAC address that's broadcasting these ARP queries to all of these different destinations trying to build its table of MAC address IP address combinations. To talk about these things or talking about these things, we should mention that a scanner built around ARP queries is also known as ARP scan. It has a lot of options to customize it and you can go to their wiki for detailed information.
One popular choice would be the local net or simply arpscan-l and it'll send queries to all the valid IP addresses on your local network. Moreover, if your system has more than one interface and you're interested in discovering the live host on one of those interfaces, you can specify using the capital I. So for instance, pseudo arpscan capital i and then you give it the interface name and then you do the -l so that it knows that it's doing it on the local network and it'll send queries for all the valid IP addresses on the eth0 interface. It's not installed on our attack box but it can be installed using apt package installer using apt install arpscan.
So in this example we're using ARP scan and since we ran this at a time frame close to the previous one we did uh or two codes to the previous one that we did right here we obtained the same three live targets. So pseudo arps scan etc. And then again it gave us the three live targets starting da da da and then it said these are the IP addresses for these MAC addresses. Four packets received zero were dropped.
This is assuming that this was actually done right and that's basically it. That's all we got. So the command arcs scan will generate many ARP queries that we can see using wireshark etc. And then you can see that the packet capture for arcs scan and end mapap yield similar traffic patterns.
Same MAC address. So let's not zooming in. So same MAC address sending broadcast ARP protocol. Who has this?
Who has this? Who has this? Right? And then there was an announcement for this.
This is what I'm trying to do here. Who has this? Who has this? Who has this?
So this is what it's basically doing, right? Same thing. The concept is that we're trying to achieve the same result here. It's just it can be done with two different tools and it'll essentially yield the same type of traffic generation.
So we're going to go again look at the network simulator and we're going to be sending broadcast ARP request packets with the following options. Computer one to computer one, ARP request and data. Try all possible eight devices other than computer one in network two. So computer or in the network computer 2 computer 3 computer 4 5 6 D and D.
How many devices are you able to discover using ARP requests? I'm just going to take a guess here and I'm going to say three. That is the answer cuz it it only has that many devices inside of its network. So it's sending it from computer one to computer one.
That's the thing. It's like it's communicating to its own subnet. So that was I mean we'll do it. I'll still do it, but I just know that there were three devices inside of that subnet.
So it's like that's literally the only response that we should be getting. So uh let's zoom back out and then go to the split view here. And we're now going to do from computer one, right? From computer one to computer one ARP request.
And then we're just going to try to connect to all the different ones. So we're going to do the first thing, right? So ARP request and then I'll do like computer 3, right? So let's do computer 3.
And if I press enter, it doesn't work. So I have to actually press this button. So it sends the packet, right? It's trying to communicate to computer 3.
Computer 3 will actually reply. That's the ARP request. Now, if I do computer 5, which is outside of that subnet, it's trying to communicate to this computer right here. Right?
It's not going to work because I'm only doing an ARP request. I'm not doing a ping. The ping will travel across the MAC addresses and it will use the IP addresses to establish that connection. It's not going to work if I do anything else.
Right? So the only response that we will actually generate would be from computer 2. So let's do computer 2, right? Computer 3.
So it'll send it. Computer 2 is going to respond. There you go. And then we're also going to send it to the router because the router is technically there as well.
or not the router I think it's the switch excuse me so the switch will send it and data in what ARP request and the data needs to be in a valid device it says oh switch one excuse me so it needs to be switch one so send it and it'll send it and there you go so switch one didn't it didn't even reply right and so then we can do router come on I can't spell for some reason and so there we We go. It sent it. And the router should actually reply. So there we go.
So we got three replies, right? We have a total of three replies cuz we're not sending it to our own computer one. So we're going to send it to computer 2, computer 3. Switch one didn't reply and the router did reply.
So now we have three replies that were generated. And that was what I guesstimated, which I mean it was like a very educated guess, but yes, it was technically still a guess. Okay, so let's now talk about the host discovery using ICMP. As we established, ICMP does the ping, right?
So ICMP sends out a ping echo and it requests a reply via ping. So we can ping every IP on a target network and see who would actually respond. Um although this would be the most straightforward approach, it's not always reliable. Many firewalls block the ICMP reco uh echo, excuse me.
New versions of Microsoft Windows are configured to block it by default. Remember that the ARP query will precede that ping. So to use that request to discover the live host, we can do the dash PE. So remember the SN if you don't want to do a port scan.
So we could just do PE to just discover the live hosts using the ICMP echo. So this is what it would do, right? So this is the command. Oh, I'm super zoomed in.
So this is the command nm mapap pesn if you don't want to do a port scan and then you just do it. So it'll send the echo request and it'll get some kind of echo reply. If it does get the echo reply then we can estimate that it's up. If it's been filtered through a firewall it won't be up or if it's actually turned off or disconnected from the network it also won't be up.
So in the example below, we we scan the target subnet using that specific command and it'll send IPMP ICMP echo packets to every address on the subnet. We expect live host to reply. However, it's wise to remember that many firewalls block it. So the output below shows the result of scanning the virtual machines class C subnet using pseudo end mapap.
And so class C is just another thing that they're dropping in to let you know that it's this type of a subnet, meaning that the first three octets have been determined to be the subnet itself, the network segment. And then the last octet is available. So that's a class C. If there was 16 right here, that would be a class B.
And then if it was eight, that's basically an internet service provider and it's a class A. and they have like I think like millions if not it's probably like in the tens of millions of IP addresses that are available. So let's see if we can kind of zoom out of this to make it a little bit more legible here but it doesn't seem to be the case. So I'm just going to actually do this.
There we go. So now we have a little bit of a better view for us. So this is what it would look like. You do pseudo nmap pesn and then you give it the octet or the subnet that you want to scan and it'll do it.
So host is up. post is up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up up all of them are up and then it gave us the MAC address of course that we sent out and that's pretty much it. We just did ping requests that were sent out, but it also replied with the individual MAC addresses for all of them as well. And it just told us, right, it's up, right?
So, it shows that the eight hosts are up. Moreover, it shows that their MAC addresses. So, generally speaking, we don't expect to learn MAC addresses of the targets unless they are on the same subnet as our system. And it indicates that NMAP didn't need to send the ICMP packets as it confirmed that these hosts are up based on the ARP responses.
So again, remember those blue dots, the ARP ARP responses or ARP requests sent out first. And if they're up and if they actually reply, it doesn't need to do the ping because it just knows that they're up and they are on the same subnet is what we can also conclude with this because if it doesn't do a ping and it gets the MAC addresses and it tells you that it's up, you can assume that it's on the same subnet. So we can repeat it. Now we're going to scan from a system that belongs to a different subnet.
And now you get to see something different. It says the report for this IP address is up. And so now it's measuring everything in IP addresses instead of MAC addresses. So if we see something like this in fire wire wire, excuse me.
Uh we can see that we have more uh we have one source IP address on a different subnet than the destination and then sending echo requests to the all the addresses in the subnet to see it. So you can see the source is the same IP. The destination is different IPs. They're on the same subnet, but they're different IPs.
The protocol is no longer ARP. It's ICMP because it's actually sending a ping. And then the info says ping request, and they're all requests that are being sent out because it's going from the same source to different destinations. Now ultimately when we keep measuring it and then we would end up seeing all the replies that came in you would see that the the source would be these IP addresses and the destination would be this singular IP address and all of these would end up being replies instead of requests.
So because the ICMP echo requests tend to be blocked you might also consider the timestamp or the ICMP address mask to tell if a system is online. The end map uses timestamps on ACMP type 13 to check whether it will get a timestamp reply which is would be the type 14 and adding the PP option tells NAPAP to use the timestamp request and we can see that right here. So you're doing PP no port scan and you're sending a time stamp request. You get a time stamp reply and if you do that means that it's up.
So this is what it looks like over here. Same thing right? get the IP address and it's up but basically the command has changed pseudo and map ppsn and then you give it the target. So we can see again that we have the same source going to a variety of different destinations ICMP the timestamp request is now inside of the info and these are all requests because these are all going from the same IP to the same destination.
Once these people started replying then we would get timestamp replies. So end mapap uses address mask queries. So type 17 and checks whether it gets an address mask reply which would be type 18 and it can be done with the -pm. So very similar except now we're just doing -pm instead of pp.
And again we're not doing any port scans. And so we run it and this is what it would look like in this particular case. Now it says end mapap is done. 256 IP addresses, zero hosts that are up.
So based on early scans, we know that at least eight of them are up, but this one returned nothing. And the reason is that the target system or a firewall on the target system is blocking this type of ICMP packet. Therefore, it's essential to learn multiple approaches to achieve the same result. So we already know, right?
We knew that there were eight targets that were up, eight hosts that are actually up. But because we're now doing this other type of scan, we actually get blocked by the firewall. So it's always important to understand and always important to try different approaches just to make sure that you actually are getting the information that you need. So even though we didn't get a reply and we couldn't figure it out, we know that this ICMP address mass request to every valid IP and waited for a reply was actually sent.
So we can see again address mask request was actually sent to all of the other uh target addresses. We just didn't get to see them. So each one of them was sent twice as we can see in the screenshot. And we can see what is it?
It goes 1 2 3 4 5 and it goes all the way to 10 and then 1 2 3 4 5. So it's sending it twice because it didn't get the response that it wanted. So what's the option required to tell Nap to use ICMP timestamp to discover the host? And that was the - PPP I want to say.
And oh, it's not. It's not. Oh, I got uh I got kicked out. If it does unauthorized, that means I got kicked out, which is always so weird.
I don't understand how I get kicked out. I'm literally here. I haven't logged out. So, why would I get kicked out?
So, let me I'll refresh it and I'll log back in. Okay, so here we go. Let's try that again. So, we'll do - PP.
Press enter. And there it is. Okay, so the time stamp and then what's the option required to tell it to use the address mask and what was the option for address mask? PM.
There we go. So the PM I'm guessing it stands for mask. So PM and that would what? Oh, I put it in the wrong one.
Excuse me. So this one is PM and echo would be P E. And that's the one for that. Okay, great.
So now we can move on to host discovery using TCP and UDP. Now this one in particular, this specific section, it is a little bit more involved than what we're going to be getting in this just little task that we have over here. So we're going to do an overview, but then as we go through the rest of the end map videos, we're going to go deeper into this. So there's something called a sin ping or a sin scan, I guess we can say.
So, we would send a packet with a synchronized flag that's been set and it would go to port 80 by default and we'll wait for a response. The open port will send an SIN acknowledgement. If it's closed, it would send the reset packet. So, we can only check whether we will get any response to infer whether it's actually up.
That's pretty much it. We're not going to get much information about the individual ports. Right? If you get a full TCP 3-way handshake, right?
So, this is what a full connect scan will be done. And if you don't set any kind of flags, by default, end mapap will do a full connect scan. So, TCP 3-way handshake sends a synchronize request. So, it'll send a synchronized packet.
The server will respond with the acknowledgement. Okay, I acknowledge that you want to synchronize with me. And then the client will say, okay, I acknowledge your acknowledgement. And then this is the completed handshake.
And when we do this, we receive a lot more information about this target server or the target host, whatever it is, than we normally would if we just sent a regular SIN scan. So if you want to use the SIN ping, you can do the PS or you can do the S. Uh, actually technically, so the SIN ping is not a SIN scan. I should be uh I should be clear about that.
So my apologies for that. So if we do a capital PS followed by the port number range or list or whatever. So for example PS21 will just scan the port 21. 21 to 25 will scan all of them.
Right? So 80 443 and 8080 will just scan these three. So you need to use the uh the pseudo command in order to do this because this is technically one of the stealthier scans that's done because we're not doing a full three-way handshake. So because of that that fact we are going to need uh privileged uh permissions.
We need to use higher admin or root privileges to be able to pull it pull it off. Therefore it needs to be either root or pseudoers or or excuse me pseudo uh or you need to be like an admin if you're running it on a Windows machine. Unprivileged users have no choice but to complete that three-way handshake. So this is again when you use those specific flags and you don't want to do a port scan, you just send the SIN packet, it responds with the acknowledgement and then we close it by sending the reset packet so that it doesn't establish that full connection and it's quieter.
If we establish a full connection, it's much louder when it comes down to intrusion detection systems. So we want to be quiet, especially when we're trying to be stealthy and we don't want to get detected. So we're going to run this again to scan the target VM subnet. As we can see in the output, we would get the host is up responses based on whatever the query was, whatever the command was.
So if we look at what we get to see inside of Wireshark, we'll see that we didn't specify any TCP ports. So in that scan, it just used the common port. So for example, port 80 and any service that was listening on it was expected to reply. So you can see that it's coming from 6 61429.
Uh it doesn't really zoom in here. So let me just manually zoom in here. So it's coming from our source IP going to these various destination IPs. It's automatically just trying to uh connect to port 80 which is the default that it tries to connect to.
And all of these packets that are being sent are the sin packets that are being sent. Right? So same series, you can see that it's all the same series of IPs that are trying to be connected to and it's just sending these multiple packets because it wants to establish at least that initial are you up conversation. Then we have the acknowledgement ping.
So first we talked about the sin ping and then we would do the acknowledgement ping. So this sends a packet with the act flag set and you would be again running NMAP as a privileged user. If you do it with no privileges, then it'll just again try to do a full TCP 3-way handshake. So, by default, port 80 is going to be used.
But again, we can just assign the ports that we would want for it to be scanned. And this is what it would look like. It would just send the acknowledgement. And then this thing will just send a reset.
And this is a this is kind of where we conclude whether or not it's open or closed. is like it's not the most definitive type of a response that we would get because the target will respond with the RST flag set because when we send with an act it's not a part of any kind of ongoing connection. So the response is determining whether or not it's up but it's kind of hard to see whether or not it's up but end mapap will just determine that it's up. So you send it with the flag set, the PA flag set for ping acknowledge and then it just responds.
And this part is kind, it was always confusing to me because it's saying right here, where is it? It says it's either open or closed. So the TCP port is either open or closed. So end mapap just assumes that it's up if it doesn't reply with closed or if it doesn't find out that it actually is closed.
It'll just assume that it's up. And so this is similar, right? Same source, various destinations going to port 80. Just the only difference that we can see right here is that instead of a sin flag, it's all act flags that have been set.
And then we have the UDP ping. So the UDP to discover if the host is online. Contrary to the sin ping, sending a UDP to an open port is not expected to lead to any kind of a reply. If we send a packet to a closed UDP port, we expect to get an ICMP port unreachable packet.
So if we don't receive the port unreachable packet, we assume that it's up and running, right? So So So uh in the following figure, we see that a UDP packet was sent. So this is what we get, right? It was sent.
UDP port is open. We get this one is sent. UDP packet is sent and it replies type three or whatever. So UDP port is closed.
This leads to ICMP destination being unreachable. Right? So the syntax would be the -pu for ping the UDP. And again this is what we would get over here in this particular case.
If we inspect the packets that have been sent, we can see that it's sending the UDP to the UDP ports and they're most likely closed. The image below shows that it uses uncommon UDP port to trigger an ICMP destination unreachable. So we can see this right here and it really doesn't show us much. It's just showing that it's being sent to the common UDP port and or the uncommon UDP port which is 40125.
It's like a very uncommon UDP port. And that's basically it. And then we have mass scan. A different tool.
It uses a similar approach to discover the available system to finish this network scan quickly. It's quite aggressive and the syntax is very similar, but being that it's aggressive, we can expect that it's going to be louder and more, you know, triggering more alerts on the intrusion detection. So, mass scan, machine IP, port 443, 84, etc., etc. Top ports like the top 100 ports, etc.
It's not installed on the attack box, but it can be installed using the package manager AP. And depending on the distribution of Linux that you're using, your package manager might be different. So, it's not always apt. It could be yum, it could be, I think, dnp something like that.
There are a few different package managers. It just depends on the distribution of Linux that you're using. So, which TCP ping scan does not require a privileged account. And this is the TCP um I guess I'm am I doing like the full thing because it's going to be the the TCP connect scan.
That's the full one that we're using. So which TCP ping scan does not require a privileged account. This feels wrong. Uh it says TCP ping scan does not require a privileged account and the answer is TCP sin ping.
However, uh if we go read through this documentation again, this is like this is the piece that I'm like, okay, what's happening? So, what does it say? It says the uh the privileged users can send TCP send packets and don't need to complete the three-way handshake even if the port is open. Unprivileged users have no choice but to complete the three-way handshake.
And this is what I find kind of confusing about this because uh with all of it with everything that we just talked about TCP send ping we can send it by default wait for a response da da da close port which is all in this case we only care d and that's basically like there's nothing else that it gives us over here and it I don't know when you say that it requires privileged users and they don't need to complete the three-way handshake in order for this to work it you're implying that it requires pseudo users. It requires privileged users, but the answer or the question phrasing is that it does not require privileged account. So, that part is kind of confusing to me. I guess this this was like something that I didn't I wasn't sure whether or not would be the answer, but I guess that's the answer.
So, which TCP ping scan requires a privileged account? So all of them all of the ones that we just talked about would require a ping uh privileged account. So if we do let's say an act ping that would be yeah what option do you need to add to end mapap to run a TCP sin ping scan on the tnet port. So it would be dashp uh s and then tn net port would be 21 or 23 excuse me there we go.
So 21 is FTP, 23 would be Tnet. All right. So let's talk about using reverse DNS lookup. NAPAP's default is to use reverse DNS online hosts because the host names can reveal a lot and this can be very helpful.
So if you don't want to send these types of queries, you would use the dash N to skip to skip the name, right? So N for name or you can do N for numerical. Whichever one helps you remember that. You don't necessarily need to remember all of this stuff.
You can always refer to the manual to figure it out. But that I try to kind of like connect something to it so I can remember it. So by default, NAPAP will look up online host. However, you can use the option -ash r capital R to query the DNS server even for offline hosts.
And if you want to use a specific DNS server, you can add the DNS server and then or the DNS servers option with the actual DNS server uh assigned to it. and you'd be able to do it. So, uh this was very very short little section that we have. So, it says we want N mapap to issue a reverse DNS lookup for all the possible hosts on a subnet hoping to get some insights from the names.
What option should we add? So, we want to issue a reverse DNS lookup and we want to do it. So, this can be helpful. However, if you don't want to send such DNS queries, you would use this.
So to query the DNS server for all the possible hosts on a subnet. So let's try to do - r and there it is. Okay, great. Cool.
That's it. And we are now going to do a quick review. So we went through a lot. Uh we've looked at ARP, ICMP, TCPN, UDP, and how they can detect live host by going through this video.
Any response from a host is an indication that it's online unless it's like an offline kind of a response or I don't know a dead uh response. Um below is a quick summary. So this is what we have. So we have the ARP scan that you can do with this command.
ICMP echo scan timestamp all of these things. This is basically what we just covered so far. And if you want to do SN, you just want to make sure so that you uh if you don't want to do port scanning, you would do SN is essentially it. So omitting the SN will make N MAPAP actually default to port scanning.
And then what it'll do is if you don't specify the ports that you want it to scan, it'll scan the most popular thousand, the top 1,00 ports. So dash N would be no DNS lookup, - R is reverse DNS lookup, and SN is host discovery only without doing any kind of a port scan. So that's basically it. And again, this is one of the free rooms that's available.
So you can go through this to establish your own notes or if you want to come here and look at all these commands to save them for yourself in a file. I highly recommend it. Or you can always just launch the attack box and from there do the manual of end map. Go look at man end mapap and then look at all the different options.
Obviously you can download it on your own computer and go look at all the different options. So there are so many different ways that you can find it. You can always Google what the end map manual looks like. There are a lot of different ways to do it.
And this is one of the tools that in pen testing you're going to use almost every ca like all the time. If you're doing pens testing against a network, against a host, against a subnet, a device, anything that's digital and it's not a physical pentest, you are most likely going to use end mapap. Like guaranteed. I don't know anybody who doesn't.
Like seriously, I really don't. And it's one of those tools that is so profound, so functional, and there are so many ways that you can use it for so many different purposes that you want to get good at this. So, if this is your first time being introduced to NM MAPAP, stick around and watch the rest of the series as we go ahead and build the the rest of these videos out. And I promise you, you will not be disappointed.
This will be something that you will be very, very happy that you went through and you will use NMAP. I'm telling you, you're going to use end mapap as you go into your pen testing journey, your ethical hacking journey. So, we're going to click submit and we are good with this one. And I got to close down the machines that we got and we'll do a quick little wrap-up.
If you got value out of this video and if you want to get more videos like this one, then I encourage you to like, subscribe, and turn on the notification bell so that you get notified the next time that a video comes out on this channel on this pathway, the junior pentester playlist that we're building out. And if you're more interested in getting more pentest stuff, then there's also the CompTIA Pentest Plus playlist that I'm also building out. And new episodes for this one drops out. It drops every single Friday, right?
So every Friday there's going to be a new episode coming for the CompTIA Pentest Plus until we finish that up and then we have a completed playlist for that and then from there we'll just move on and we'll build more playlists with more cool content. Network Plus is already done. We talked a lot about networking today and this is a comprehensive playlist training series for CompTIA Network Plus. People have used it to pass their exams so it's legit and you'll get a lot of value out of it.
Uh this is exclusive to Aolix Anonymous. We have Security Plus that's already done. We have Linux plus that's already done and of course sciC 101 and if you haven't gone through that then I encourage you to go through that as well. It's really really strong for foundations.
Then we have the members only section. We have sock level one level two security engineering the posts that go public on the post section of our channel and then you can always go to this little search button and search for something in particular to find more information about that specific topic. So, if you have any questions or comments, drop them in the comment section below. Otherwise, make sure that you like, subscribe, and turn on notification bell so that you get notified the next time that a video comes out on this channel on this pathway.
It's your boy Hank Hackers and it Hank Hacks Hackers, your favorite networking system attacker/protector. If no one else loves you, Hank loves you. Love, peace, and chicken grease. And I'll see you in the next video later.
In episode 25 of the junior pentester training series, we are going to continue with our network security module and we're going to learn more about NAP. And in this particular video, we're going to be talking about the basic port scanning capabilities of NAPAP and how we're going to do the NMAP TCP connect scan, the TCP SIN port scan, and of course UDP port scans. And this is all available through the Tryh Hackme platform. And this specific room, as you can see right here, uh, is going to obviously provide the introduction for us.
We have TCP, UDP ports, TCP flags. These are just kind of explanation portions just so you understand what they look like and what you're looking for when you do your scans. And then we have three virtual machines that have been assigned to us that we're going to use to get the connect scan, the SIN scan, and the UDP scan completed. And then from there, we will talk about fine-tuning and scope performance.
And of course, the summary and final thoughts. and all of that good stuff and then you will be dismissed for the day. And so the room is again available through the Tryh Hackme platform. It was created by Stratagos or Strategos.
Still don't know exactly how to pronounce their username, but shout out to that person for creating this room for us so that we can use it. This is a subscriberonly room that's available in Try HackMe, meaning you actually do need a paid membership. However, if you have NAPAP installed on your own computer or if you have Kali Linux, which I love, and we're going to be using a Linux machine that has N Map installed on it, you can then just go ahead and run along with me as we go ahead and do these scans, and then you'll be able to practice NAPAP on your own computer. So, this isn't necessarily mean that you need to have uh try hackme.
I will say that when you do your end mapap scanning, just do it against your own cell phone or your own, you know, other computer. I have multiple computers inside my studio. So, uh, do it against your other computers or do it against your cell phone or another machine that you have. Don't do it against somebody that hasn't give you permission to do it.
And this is the reason why I use Try Hackme or services like Tryh Hackmely because the fact that they provide these virtual machines for us to scan without getting into legal trouble because again it is a felony and it's a it's a big issue if you do this without permission. So just wanted to give you that full disclosure. But apart from that, it should be a pretty straightforward video today. It should be a pretty straightforward episode and hopefully you will get a lot of value out of it.
A quick shout out from Hackaholics Anonymous and we'll dive deep into the contents. If you're serious about your SCIC education and you want access to me on Discord, consider joining Hackaholics Anonymous. We have four tiers, the supporter, agent, guardian, and master. Each tier gets their own Discord server and early access to content.
The agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations, live streams with me every month, plus so much more. And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you will be able to join hackaholics anonymous. Now, without further ado, let's jump into the end map basic port scans. Okay, so this episode is the second in the end map series.
So, we did the live host discovery in the very last episode. Basic port scans is what we're going to be doing today. Then the next video is going to be advanced port scans and then the postport scans. So in the previous video, the one that we did right before this one, we have covered the focusing on online systems, right?
And now we're going to have three steps in this particular process, which is the enumeration of the targets, discovering live hosts, and of course reverse DNS lookup. So this is what the full thing looks like here. I'm kind of zoomed in on the screen, but enumerating target, discovering live host, and reverse DNS is basically what we talked about previously. So now we're going to go into actually scanning ports.
So the next series of steps would be the port scan for TCP connect port and then we have another one for the SIN port scan and then we have the UDP port scan. So you have TCP connect and SIN which are essentially scan types and then we have the UDP port scanner which is essentially a different protocol on the transport layer that we will be using to try to find open ports. So we are going to discuss the different options to specify the ports that we want to scan, the actual rate of the scan, and of course the number of parallel probes that should be sent out that will make the scan go a little bit faster for you and all of that stuff will be discussed in addition to actually doing these types of scans that we have. Sorry, I kind of went off the screen here.
So we're going to launch the attack box, which I've already done. The virtual machine is also launched. The very first target machine is also launched. So we should be ready by the time that we actually get to that portion of it.
And now let's dive into the difference between TCP and UDP ports. Okay. So here's the read through. In the same sense that an IP address specifies a host on a network among many others, a TCP port or a UDP port is used to identify a network service that's running on that host.
So a server provides the network service and it adheres to a specific protocol. An example would be the time for example responding to DNS inquiries or serving web pages. A port is usually linked to a service using that specific port number. So for instance HTTP would bind to the TCP port 80.
This is a default port for HTTP communications via TCP. If HTTP supports SSL or TLS, which is the secure version of HTTP, then it would be on port 443, and it converts it into HTTPS, which is what you see right here. So, in conjunction to these ports, port 80 and 443 are the default ports of HTTP and HTTPS. However, the web server admin might choose other port numbers if necessary because it's pretty well known in the networking world that 80 and 443 are relative to HTTP and the secure version of it.
So maybe the network admin or the web server admin wants to be more secure, so they change it from the default ports into a different port. So no more than one service can listen on any TCP or UDP port on the same IP address at least. Right? So we have 65,000 plus ports that are available on every single IP address.
And so if you have, you know, more than 65,000 services running in your uh company, then maybe you should use multiple IP addresses. But pretty much on any given IP address, you have a 65,650 something like that. It's I know it's more than 65,000. That's that much.
which I know for sure and they're a combination of TCP and UDP ports. So at the risk of oversimplification, we can classify the ports in two states. You have open ports that indicate that there's some service listening on the port and then you have a closed port that indicates there's no service listening on the port. Now this is again an oversimplification.
There are uh filtered ports, right? So if they're behind a firewall, it could be open, but the firewall might be blocking the packets. Therefore, NAPAP considers the following six states. It has open, it has closed, it has filtered, unfiltered, open filtered and closed filtered.
So open is the services listening on the specified port. Closed indicates that there's no services listening on the port although the port is accessible, right? So it's closed, but it is accessible. By accessible, we mean that it's reachable and is not blocked by a firewall or other security appliance, right?
So if you see closed, it's accessible. It's just there's nothing listening on it, right? Filtered means that Nap can't determine if the port is open or closed because the port is not accessible. So it's usually due to a firewall typically preventing NAP from reaching that port and the packets may be blocked from reaching the port.
Alternatively, the response are blocked from reaching NMAP's host, which essentially says that it's filtered. If we see filtered, it typically means that it is open, but it's sitting behind a firewall. It's not the case all the time, but that's kind of what it means. Unfiltered means that NAPAP can't determine if it's open or closed, although the port is accessible.
This state is encountered when using the act scan, also known as unders uh what is it lowercase s uppercase a. And then we have the open filtered and closed filtered. So open filtered means that N MAPAP can't determine whether the port is open or filtered. Closed filtered means that NAPAP can't determine whether it's closed or filtered.
Right? So these are the six states. For the most part I have seen these three pretty much all the time. Um unfiltered I really don't see.
Open filtered or closed filtered I rarely see but I usually do see open closed and filtered pretty much all the time. So which service uses UDP port 53 by default? And I just know this off top of my head. And so that would be DNS as long as my keyboard works.
There we go. So DNS. Which service uses? 22 by default.
That would be SSH. And how many port states does N MAPAP consider? Six total port states. And which port state is the most interesting to discover as a pentester?
And of course that would be the open port state. Now when you see things like this, the 53 by default or 22 or whatever it is, these are things that I have seen so many times that I know what they are off top of my head. But it wasn't like that at the very beginning. I you know studied networking.
I even launched a networking course CompTIA network plus that's available on this uh pl on this channel. So you can go ahead and check that out. And it's like a really good it gives you a good overview introduction but then it also goes into the deeper and more advanced topics behind networking. and it has practical videos and a bunch of other stuff as well.
So, uh for for your intensive purposes, uh you can always find cheat sheets of the most commonly used ports and you can find out what services are running on those ports and you can just Google them. There are so many free ones that are available and I highly highly recommend them. So, if you don't know what these ports are off top of your head, it would be something that you should consider studying because it would help you become a better security professional, a better hacking professional, so on and so forth. But anytime that you do a scan, if you see that a port is open and you don't know what it is, you can always just Google it and then based on that, you can continue the rest of your reconnaissance.
Okay, so let's talk about TCP flags. to be able to understand the different types of port scans that are available, we need to first understand what a TCP header is and we need to review the portion of the TCP header that is relevant to this and that's actually the first 24 bytes of a TCP header. So the figure that we have below right here is going to show us uh the TCP header as defined in the RFC 793 and RFC 793 is basically a code. So this is what is this?
We have the data tracker uh data tracker.f.org and then they have this uh this document that's available for us that essentially outlines this thing for us and it's an internet standard. So the RFC stands for let's see if we can find the acronym here um for transmission control protocol is TCP of course RFC let's see I can just probably Google this and I can just do this right here and then we'll search Google for it to see what it stands for transmission control protocol RFC what does RFC stand for uh it's the internet standards however uh I'm just trying to find out what RFC stands for bro so let's see let's we might actually have to do it what does RFC FC stand for there we go for in networking we'll even get more specific with that so it stands for request for comments oh my god really seriously dude so it stands for request for comments RFC's are a series of documents published by the internet engineering task force and other standard bodies that describe protocols concepts and methods related to internet and yada yada yada okay so RFC 793 is basically an internet standard that has to do with transmission control protocol and it's a request for comments I guess something that people can add their stuff to. So anyways, um this figure may look sophisticated, but it's pretty simple to understand. In the first row, we have the source TCP port number and the destination port number, which is this piece right here.
So source port and destination port. So where it's coming from, where it's going, that's basically what it is. We can see that the port number is allocated 16 by 16 bits, which is two bytes. So this line, let me see if I can kind of zoom out of this so you can see the full thing.
So you see it goes from zero and it goes all the way to the end right here. And this is 32. So we have 32 bits in total. And so 32 bits each uh each bite is 8 bits.
So if you have two bytes that means it's 16 bits. So the source port is 16 bits and the destination port is 16 bits. So you can see that right here. Then we have a sequence number and an acknowledgement number.
So we can see the port number is allocated da da in the second and third rows we have the sequence and the acknowledgement number. Each row has 32 bits or four bytes that are allocated to it with six rows totaling making up 24 bytes that are available. So we have 1 2 3 4 5 6 7 this is actually seven row. Uh so I guess not counting the ports at the top we should have 1 2 3 4 5 6 technically I guess.
I don't know if that's what they meant but that's basically what it is. And then at the very very bottom, you can also see this piece right here. It's kind of harder to see, but it says byte 0, by one, bite two, and bite three. So it starts with the index position zero, which is typically what it's done in coding and networking.
So you can use it essentially the same way. If you're familiar with coding, uh you can hopefully just decipher that. But really, it's not really complicated. It's just instead of starting at one, it starts at zero.
So bte zero would be index position one or index position zero I guess but technically it's the first position and then you have one two and three and each bite is eight bits as you can see that's pretty much it right that's all you need so what we need to focus on are the flags that end mapap can set or unset and we've highlighted the TCP flags in red which are the these pieces right here so notice that they are assigned one bit each so if the URG flag or The urgent flag has been set. That means there's been one bit that has been assigned to it. You have the acknowledgement flag, the push flag, the reset flag, the sin flag, and the FIN flag that have been set. Right?
So if you set the flag, it means that you're setting the value to one. From left to right, you have these. The urgent flag indicates that the urgent pointer filed is significant. The urgent pointer indicates that the incoming data is urgent and that a TCP segment with the URK flag is processed immediately without consideration of having to wait on a previously sent TCP segment.
So, as the name implies, it's urgent. Process it before you do anything else. Right? That's what we're telling the network.
The act flag also known as acknowledgement indicates that the acknowledgement number is significant if it's if it is used to acknowledge the receipt of or it is excuse me not if it is it is used to acknowledge the receipt of a TCP segment. Push flag asks the TCP to pass the data to the application promptly. The reset flag is used to reset the connection or basically end the connection. Another device like a firewall might send it to tear a TCP connection down.
This is also used when the data is sent to a host and there is no service on the receiving end to answer. The synchronize flag is used to initiate the TCP 3-way handshake and synchronize sequence numbers with other hosts. The sequence number should be sent randomly during the TCP connection establishment. And then the FIN flag is when the sender has no more data to send.
So it's finished, right? you're finished sending data basically. So what three letters represent the reset flag? That would be the RST.
Which flag needs to be set when you initiate a TCP connection. The first packet of the three-way handshake. And that is the synchronize flag that we need to set. So let's now do the connect scan.
So now we're actually going to do a scan with end mapap and we're going to try to establish the connect scan. The connect scan works by completing the three-way handshake. Okay, so this is what the three-way handshake looks like. So you have the sin flag, the synchronized flag that's sent first.
It's sent from the client, which is you in this case, and it's being sent to the server. Okay, the server will respond with an acknowledgement. It says, I acknowledge your synchronization. So sin and act are both set.
So the first one that's sent just has the sin flag sent. The next one that comes back has sin and an acknowledgement both set. And then finally the client will send another one saying final acknowledgement. Great.
And once this one is sent and received on this end, we now have a completed three-way handshake and the TCP connection has been established. So when the TCP connection is established the it's the loudest uh type of scan that we do with NMAP. However, or and I should say not necessarily however. It's like it is the loudest one, meaning that it shows up on network scanning and network monitoring devices because we're literally establishing a full connection with the end server and the agent is going to be end map.
So, they're going to be alerted and it's a very loud scan and uh the reason why we do this is because this is the most informative scan that we can do. So, if we do a TCP connect scan and we actually establish a connection with the server, with the host that we're trying to connect to, we're going to get as much information as we possibly can using end mapap. So, it is the loudest. It's also the most informative.
And so, if we do something that's quiet, so for example, doing a stealth scan, then we're not going to get as much information, right? So that's the the key element of doing a full connect scan versus just doing a stealth scan. The stealth scan will tell you, okay, I think these ports are open, it's not as reliable. A TCP connect scan, it's already established a full connection.
So when it tells you ports are open or s something is filtered or whatever, that's the most reliable information that you can get. Right? So uh we're interested in learning whether the TCP port is open, not establishing an actual connection. Hence the connection is torn as soon as the state is confirmed by sending a reset acknowledgement and you can choose to run a TCP connect scan using the lowercase S uppercase T.
So this is what it will look like right? So when you do lowercase S uppercase T sin is sent acknowledgement are received acknowledgement is sent and at the same time the reset acknowledgement is sent just to tear down the connection so that we're not fully connected to this thing or stay connected to it because again it's just too loud. But even in this case it's still going to be loud. So let's just be very clear about that.
when you receive the SIN acknowledgement and you complete your connection to it, you are doing the loud loudest type of scan that's available. So, if you're not a privileged user, pseudo or root, a TCP connect scan is the only possible option that you can use to discover TCP ports because when you do a sin or like a stealth scan just by itself, you need to have root permissions or admin privileges to be able to do that kind of a scan. So, this is what Wireshark will actually show us when we have a packet capture window. We see that end MAPAP is sending TCP packets with a SIN flag sent to these various ports.
By default, N MAP will attempt to connect to the thousand most common ports unless you uh declare otherwise. A closed TCP port responds to a SIN packet with an RST acknowledgement and to indicate that it's not open. This pattern will repeat for all of the closed ports as we attempt to initiate the three-way handshake. So, we can see this right here.
So, let's zoom out a little bit. So, we can see this right here, right? So these are the source IP addresses which is essentially us right and we're sending all of these SIN you see these SIN packets that you see right here we're sending all of them from one of our ports to these other most common ports so you have 443 143 256 888 445 etc etc port 80 which is HTTP right so it's sending all of these requests for synchronization to all of these destination ports and then the 25227 IP that you see right here it starts responding right so when you See reset acknowledgement that means that this is closed right? So reset acknowledgement from 443 means 443 is closed.
256 is closed. 8885900 these are all closed. Right? And if you see that it receives is the port right here.
So from the destination right now it or from this initial host that we're trying to connect to. Now it's the source meaning that it's communicating back to us and it's saying that port 143 is actually open because it's saying synchronization is acknowledged. You see that? And then now we send another packet back to it.
And then it's a final acknowledgement packet and again it's on port 143. So we are now establishing the connection on port 143. We have a full connection established and the three-way handshake has been completed. Right.
So 143 is open. It replied with send acknowledgement. Nmap completed the three-way handshake by sending the final acknowledgement. And it shows all the packets exchanged between the host and the target on port 143.
You can actually filter your connections as you can see right here by looking for that specific IP address of your destination host or the target host. And we're just looking for port 143. And then it only shows the packets for that. So you can see sin was sent, sin was acknowledged, acknowledgement was sent, and then the reset was sent to tear that conversation down, to tear that connection down.
So to illustrate what this actually looks like, this is what the terminal command line would be. Nmap st and then we would connect to the target host in this case and then from there it will respond to us. So it says, you know, 22 is open, 25 is open, 80, 111,143, 9993995. These are all open and it even gives you its best guess on the service right so secure shell uh SMTP which is for email that's used HTTP which is for uh you know internet connection or web browsing uh RPC bind IMAP IMAP sop 3s pop 3 is pop 3S is also used for email so typically SMTP and POP 3 are usually together so anyways these are just the open ports that are available the states as you can These are all open states.
And then we have the services that are assigned to them. And then you can just go further and do all these different types of scans that we'll talk about later to get even more information about each one of these open ports and what type of services and versions are running, so on and so forth. So we can use the capital F, so - capital F to enable fast mode and decrease the number of scan ports from the thousand most common to the 100 most common. And if we use the dash r, you can also do that to scan the ports in consecutive order instead of random order.
And it's useful when testing whether ports open in a consistent manner. For instance, when a target boots up, we just want to see if the port is connecting in a consistent uh consecutive order. So what we're going to do now is we're going to launch the VM, which I've already done, and we're going to run this scan on the virtual machine. and a new service has been installed on this VM since our last scan as shown in the terminal window above.
So since this scan basically we're trying to see what the new service is and what the port number is assigned to it and what's end mapaps guess about the newly installed service. So let me just open this up in a split view and it will open it up in a full screen right here to make it a little bit easier for us. And what we're going to run is essentially an ST scan against this IP address inside of the terminal. So let's go ahead and open up the terminal.
We'll drag it to the left a little bit so I can kind of zoom in on this a little bit easier and move around a little bit easier. So here we go. So we're going to do end mapap ST and then we're going to paste the IP address that we want to scan. Press enter.
It runs very quickly. So what do we have? We have 22, 25, 80, 110, 111. I think it's 110 actually cuz 110 was missing.
So, it's POP 3, which is the unsecured, unencrypted version of POP 3s. So, I believe it's 110. So, let's go ahead and look at the results here. Yeah.
So, 110 is missing. So, we can go over here. The port is 110, not one, not There you go. 110.
And then the answer, the best guess here is POP 3. and on port 110. This is the default port for POP 3, which is the post office protocol that's used for email. So now we can move on to the next one actually.
So before we do this, I need to start the next machine. So I'm going to terminate this machine and we're going to go ahead and start this machine so that it loads while we read through the instructions here. The sin scan is also known as the stealth scan. So when we do the sin scan, we're essentially doing the opposite of what a full connect scan would do.
We're trying to be stealthy. We're trying to not make a lot of noise in the network monitoring logs. So it doesn't complete the three-way handshake. Instead, it tears down the connection as soon as it receives a response from the server.
So you just send the SIN flag, the SIN packet, right? And because we didn't establish the full TCP connection, this decreases the chances of a scan being logged. And we can select the scan by using the lowercase S uppercase S option. And so this is what it looks like, right?
So SIN flag is sent. The server responds with the acknowledgement, but then we immediately send a reset flag and we tear down the connection. We don't send that final uh acknowledgement to complete our three-way handshake. Therefore, there is no final there's no official connection that's established and so it's not as loud.
Right? So, this is the screenshot that shows the sin scan. So, again, SIN packets are sent out and then this is our IP address. This is the destination IP.
The destination IP then starts responding to us. And so, on this one, it sends the reset. So, we know that this is a closed port. Then on port 25, it actually sends a sin acknowledgement and immediately we respond back with a reset flag to close that connection.
And essentially the same thing goes on for port 80 as well. So it responds saying that port 80 is open, right? So it says I I acknowledge your connection. So if it says sin acknowledged, that means that port 80 is open or port 25 is open.
It's just that we never send that final acknowledgement to do the the the official connection, right? So the difference would be this specific screenshot that we see right here. So in the upper half of it, we can see the full connect scan using ST. In the lower half, we'll see the SS, right?
So this is what the screenshot looks like. This part right here is the full connect scan. So it sends a sin, we send the sin, they send sin acknowledgement, we send acknowledgement, and then we send reset. On this one, we send the sin, they send sin acknowledgement, and we immediately send the reset.
So there is no full connection that gets established. So it's the default scan mode when running end mapap as a privileged user. So you have to use pseudo to be able to run it. And it's a very reliable choice because it again it will respond with the sin acknowledgement to imply that it is open.
It's just that we don't get as much information about our target as we want to. So everything that we found with the TCP connect scanned uh can be found except we just did not establish a full TCP connection. So this is what we see right here. Uh same thing 225 80 110 11143.
These are the things that were open for this specific IP address. This is the new IP address that I just launched. So, what we're going to do now is we're going to run a sin scan against that IP address and we're going to try to see what the new port is uh that has been opened and what the service name would be for that one. So, I'm going to just copy this IP address right here and we're going to go back to our end map instance in our terminal here and we're going to run it again.
And so it's going to be lowercase S, uppercase S, and then we're going to paste the IP. Press enter. It'll run. There you go.
So 22 25 80 110 111143 da da da da. This is the new one. So 6667 and IRC would be the best guess here. So and then the best guess is IRC.
There you go. And just like that, you were able to run a SIN scan, a synchronized scan just by itself. You didn't establish a full TCP connection. So now, in order to pull the next one off, we're going to terminate this virtual machine and we're going to move to the UDP one and we're going to start that.
So let's read through the UDP connection. UDP is actually a connectionless protocol. So, I should have probably said it that way, but um TCP is usually the protocol that's used when you want to do an official connection to a destination and then you want to make sure that everything is delivered and you receive everything. So, for example, let's say file transfer that you're doing between uh an uh a cloud drive, right?
Let's say Google Drive. So, you're trying to transfer a file to Google Drive. you need a TCP connection to that specific domain on the port that's being used to transfer that file because you want every bit of that file to be transferred to the Google Drive. UDP doesn't require a full connection.
So UDP is used for music streaming or for video streaming and things like that. So you will sometimes receive um messages or not messages I should say data that's not full. So for example when you connect to Netflix sometimes or YouTube or something like that it's going to be via the UDP and then you'll see pixelated images right before the connection is fully established and you're receiving all of the data in its entirety for the first 5 to 10 seconds or something like that. you might receive a low quality image until it establishes a stronger connection even though it's connectionless.
It gets like a a stronger connection to the UDP port and so the images now become a little bit more fine-tuned and higher quality but it doesn't require a full connection because it doesn't really matter. It's just a video, right? It's not it's not that big of a deal. And in that same spirit, in that same breath, we can say that TCP is slower, UDP is faster, which is why you need UDP for video streaming because it would be it would take too long for the file to become available, for the stream to become available if you were using TCP because it requires that full connection.
UDP doesn't require a full connection. Therefore, it starts streaming right away and it ends up being faster, right? So, that's kind of like my overview of this for you. So UDP is a connectionless protocol.
It does not require any handshake for connection establishment. We can't guarantee that a service is listening on a UDP port and it would respond to our packets. However, if a UDP packet is sent to a closed port, an ICMP, so internet control messaging protocol, an ICMP port unreachable error type 3 code 3 is returned and you can select UDP using SU. Moreover, you can combine it with another type of TCP scan.
So this is what it looks like. Basically, it sends a UDP packet. That's it. There's no response.
There's no uh there's nothing that we receive from the server. So, if the UDP port is open, no response is expected from it. If the UDP port is closed, then we will get a response saying that the port is unreachable. So, that's how we conclude that it's closed.
If we don't get a response, we conclude that oh, it's open because it didn't explicitly tell us that it was closed. So as shown in the figure below, we can expect to get an ICMP packet destination unreachable if the port is unreachable. Right? So we send a UDP, it sends the ICMP type 3 code 3 UDP port is closed because it's the destination is unreachable.
That's how we determine whether or not it's open or closed. So in this capture we can see that every closed port will generate the ICMP packet. So these are this is us on the first column. This is them.
We're sending UDP packets. We're sending them to all these different UDP ports and then the ones that are actually closed, they respond with destination unreachable, right? Very, very simple, really straightforward. So using the scan would require pseudo again and then you would do su.
And interestingly enough, I didn't use pseudo in this one when we were doing the SS and it still worked for me. So it implies that I'm already logged in as a pseudo user. So just keep that piece in mind because usually it won't work. It will respond that you need to use pseudo to be able to run it.
So this is just automatically implying that I am a pseudo user. So um what is it? Uh we learned that port 111 was open. So uh running the UDP scan against Linux.
Um we learned that 111 was open. NAP cannot determine whether UDP port 68 is open or filtered. So if we do the SU scan right here, we can see open filtered for this 68 UDP 111 did return to be open. Right?
So we're going to now run a UDP scan and we're going to do the fast mode right here with the capital F and then we're going to do verbose to get a verbose response to see the results of the various port scans as we run it. So usually I actually recommend running the -v at the very least just so you can get the status of end mapap as it's working. Otherwise it'll just return whatever ports are open or closed. So in this particular case we will do the su the f and the v and we're going to connect to this specific IP which is the new machine that we launched.
So let's go here and let's zoom in and then we're going to clear the screen and we'll I'll do pseudo end map. Let's see if it's going to work. So, su-f. And I'm going to paste the IP address here.
Let's see if it'll ask me for a password. It doesn't. I'm already I'm a I'm an admin. That's basically what it says.
So, notice how because we used uh -v, notice how it's actually showing the results for everything that it's doing, right? So, from 0 to 50, 50 to 100, max increases to five, 6, 7, etc., etc. So, it just keeps going and it's going to scan whatever we need it to until it gives the response that we're looking for, that final response that we're looking for with all of the open ports or the ports that might be open filtered or unreachable, etc. So, I'm going to let this thing finish.
It's approximately 44% done as you can see right here. And once it's finished, we will come back and view the results. Okay, so it's done. And notice that before it gave me the final report right here, it actually started saying discovered open port 111 53 things like that.
Right? So it actually tells you what it discovers as it goes. So we have three ports that are open right now or actually two are fully open and one of them is open filtered as you can see right here. So the question asks us what it says um what is the UDP port that is now open based on these.
So 68 1111 and so what do we have? We have 53 is the new one. So 53 would be the port that is now open. And what's the service name according to end mapap and it's domain, right?
Cuz 53 is the DNS. So domain would be the service name. And there we go. So we are officially done with that.
And now we can talk about fine-tuning. So let's say you don't want to scan the top 1,000 or the top 100. Let's say you want to scan a specific list of ports, the ports that are of most interest to you. You want to find out what services are running on all of those ports and um what versions of services that are running or what versions of machines are running etc.
So if you were to do something called the SA scan, the the SA scan scans for everything, right? So let's actually go into N mapaps manual or I guess I should do man N map MAPAP. So that's the first one. So if we were to look at the manual for N MAPAP, we'll get an options list.
If we scroll down far enough, we'll get to see all of the various options that are available if we wanted to use N MAPAP. So let's scroll down a little bit. Under option summary, you get to see all of these things, right? So these are all of the option summaries.
So specifying targets or host types of discovery. And then you can do scan techniques and port specifications etc etc. Now when we go down here you have the service version detection which is done by SV. Hopefully you can see that.
So let me zoom in a little bit more. Uh service detection is done by lowercase S uppercase V. And then if we go over up here I wonder if it's under these things or where is it? Is it SA?
It's either SA or dash A. I think it's like dash capital A. I want to say uh OS detection is - O and then if we go to let's see miscellaneous dash A. Okay, there we go.
It's dash capital A. And when you do this, it does OS detection, version detection, script scanning, trace route, and a bunch of other things. So, it's literally going to do all of the options. And this is going to take a very long time if you just by default say I want you to scan every one of the top thousand ports or let's say you don't even do that.
Let's say you do this option right here the -p dash which ends up scanning all 65,535 ports. So if you do -p dash and dash capital A, it's going to take hours for the scan to finish because it's going to do all types of scans against all 65,000 ports. So to mitigate that, to make it a little bit easier on you, and to make it a little bit faster, if you know that the most uh interesting ports to you and your exercise are SSH, HTTP, and HTTP3, right? You can then do dash capital A against these three ports and then it'll do all of the scans and everything that it does against only three ports, right?
So you can actually give it a port list by just using these comma separators. You can also give it a port range. So you can do -p and then do one and then dash and then the next number and it'll go between one and the next number. Or you can do dash 10, right?
So, or you could, excuse me, you could do -p 10 and then do another dash and then do 50. So, it'll go between 10 and 50, right? So, it's going to scan whatever the ports are between those two ranges while doing 20 to 25 right here. You can see that it'll go to do anything between 20 and 25.
So, you can scan all the ports by doing -pdash just like this, which will scan all 65,000 ports. It's going to take a really, really long time. If you want to do the common 100, you can do - f, which is what we did in the last one. Or you can do top ports 10 and it'll check the 10 most common ports or top ports 50 and it'll do that.
And again, you can control the scan timing using the dasht and then give it a value. So it could be t0 for example, which would be the slowest, meaning it's going to be a very slow scan, but it won't show up. it. It's like the least likely scan type to show up on network monitoring logs.
If you do T5, then it's insane, right? So, it's super aggressive and it's going to be very loud and it's going to be very fast. Therefore, most likely it's going to raise a lot of alerts on network logs. So, when you do paranoid, you mean you really don't want to get detected.
Sneaky is the next level. polite and then there's normal and then there's aggressive and then there's insane. And typically if you don't declare any of these values, it'll just go by normal, right? But if you want to be super slow and if you don't want to show up on network logs, then you can do paranoid, right?
So that's the the timing of the scan or the speed of the scan technically in relation to how many packets are sent out, right? So to avoid intrusion detection system, you can consider T0 or T1 and it scans one port at a time, waits 5 minutes between sending each probe. So you can guess how long a scanning of a target would take to finish. So 5 minutes against 65,000 ports.
You can take how you can imagine how long that would take. It's going to take days probably. So let's actually do that. So I'll even do this.
So we will do 65,535 * 5. That ends up being 327, minutes. Okay. 327,675 minutes.
And we divide that by 60 and that gives us 5,461 hours that it'll take. And you divide that by 24 and it'll take 227 days. So, it will take 227 days if you do a T0 scan against all 65,535 ports. Now, if you don't specify any timing, it uses normal T3.
If you use T5, it's the most aggressive in terms of speed, but it can also affect the accuracy of the scan results due to the increased likelihood of packet loss. So, T4 is often used during capture the flag exercises and when learning to scan for practice targets. and T1 is often used during real engagements where stealth is much more important. Alternatively, you can choose to control the packet rate using the minimum rate number or the maximum rate number.
So for example, if you do max rate 10 or max rate equals 10, it ensures that the scanner is not sending more than 10 packets per second and you can control probing probing parallel parallelization using min parallelism. Uh and then you give it the number of minimum parallel probes or maximum parallelism. And then you give it the maximum number of probes and it probes the target to discover which hosts are live, which ports are open. And the parallelization often specifies the number of such probes that can be run in parallel.
Basically meaning at the same time. So if you do a minimum parallelism of 512, it pushes nap to maintain at least 512 probes in parallel and these are related to the host discovery and open port. So uh it's asking a lot of end map when we do that. So, what's the option to scan all TCP ports between 5,000 and 5500?
So, you would do what? You would do -p and then you would do 5123. So, 500 0 dash 5500 0 or 5500 I should say. And that would scan everything between 5,000 and 55,000.
How can you ensure that NAPAP will run at least 64 probes in parallel? And so it would be minimum parallelism, this piece right here. So I'm just going to copy that part. And then we're just going to add the 64 at the end of it, which is that.
And what option would you add to make end mapap very slow and paranoid? And that would be - T0. That's paranoid. So extremely slow.
And that's pretty much it. So in summary, in this particular video, we covered three general types of scans. We have the connect scan, the sin scan, and the UDP scan. And these were the commands that we assigned to them.
So, or they were assigned to them. So, ST lowercase S uppercase T is the full connect scan. If you don't uh designate this, it'll just automatically do it unless you use pseudo. When you use pseudo, excuse me.
When you use pseudo, it uses N map and then it does the lowercase S, uppercase S, meaning the sin scan, also known as the stealth scan. And then if you do UDP then it'll do lowercase S uppercase U and then it'll do a UDP connect uh not it's a connectionless scan and it'll do a UDP scan for you. So these are the types of scans that will actually get you started using uh TCP and UDP services on a target. And then of course -p would be all ports.
-p1 to 1023 would scan everything from 1 to 1023. Dash capital F would be 100 most common ports. -ash R lowercase R scans ports in consecutive order. The T flag or the T option is the timing of the packets that are sent out and how frequently packets are sent out.
So T0 is the most paranoid and T5 is the most aggressive. So T0 is most likely going to be the least detected while T5 will be the most likely to be detected. And then you have the max rate of 15 meaning send 50 packets per second maximum or minimum rate of 15 send at least 15 packets per second. And then of course the minimum or max parallelism which sends at least or at max the number of probes.
So in this case it will send at least 100 probes in parallel. So that is pretty much it for our end map port scanning introduction. So, I hope you got some decent value out of this and you were able to run the exercises along with me so that you can practice end mapap and do the things that you need to do just to get a hang of the tool because in the next episode and the one after that we're going to be doing more advanced scanning and we're going to be talking you know we're going to review back to that uh initial uh diagram that we saw that RCP uh where we or RPC request for comments or RFC there we go RFC RFC that RFC RFC uh diagram that we looked at where it showed us the number of bits and the types of flags that we can set and we're going to refer to that more frequently so that you can actually uh do some of the more advanced scans and everything else that comes along with NMAP. It's a very very powerful tool.
It is an industry standard. Everybody uses it and it's something that you need to get good at using as we go along with Junior Pentester and as you go further into your penetration testing journey. So, I hope you found value out of this thing. And if you have any questions or comments, make sure that you drop them in the comment section below.
If you did get value out of this video and out of this room, I do encourage you to like, subscribe, and turn on the notification bell so that you get notified the next time that a video comes out on this channel. Especially as we continue with Junior Pentester. And every Friday, there's a new video that comes out for CompTIA Pentest Plus, which is the advanced conversation around penetration testing. Make sure that you drop your comments in the comment section below.
Drop your questions in the comment section below. And there is obviously there's a bunch of stuff that happened. This was actually the very first live stream that I did on YouTube uh earlier today. It was my birthday live stream and we actually had a good turnout even though it was a surprise and I didn't announce it to anybody.
There were a lot of people that showed up and it was really exciting. It was a really cool experience and I'm going to be doing that more often. So again, make sure that you turn on the notification bell and subscribe and all that stuff. And then we have these other playlists that are available.
So we have the CompTIOP Pentest Plus playlist that's currently being built right now. We have Network Plus which is already done. Uh this is exclusive to the Hackolix Anonymous membership community. We have Security Plus is already done.
Linux plus is already done. Network Plus is already done. Their SCIC 101, which is another playlist that's really crazy that is very very powerful. So if you haven't done it, I highly recommend you go through this.
This is very very powerful, very fun foundational. Uh sciisec hacking case studies. We have Hackholics Anonymous exclusives, sock level two, compilations, security engineering, and there's I mean there's a lot of stuff on the homepage. I have the sock level one, sock level two, and security engineering playlist available.
And of course, all the stuff that's available to members only. So, there's a lot of stuff. And if you don't know uh if you don't know which playlist the information that you're looking for is in, instead of browsing, you can just go to this search button right here and you can search for the thing that you're most interested in. and then it'll bring up all videos that have to do with that topic for you.
Currently, there are almost 400 videos that are available on this channel. 397 videos. It's pretty crazy. Uh there's a lot of videos that are available on the channel and there's more videos that are coming out and I respond to the requests that are being made in the comment section and I create videos around the stuff that you want to know about.
So, you can drop a comment if you want to learn about something in particular and we'll do that as well. So, there's a lot of stuff and it's all accessible to you for free through this channel. And the only thing that I request from you is to like, subscribe, and turn on the notification bell so that you get notified the next time that a video comes out. And if you drop a comment, it helps us with the YouTube algorithm.
If you're serious about your SCIC education and you want access to me on Discord, consider joining Hackaholic Anonymous. We have four tiers, the supporter, agent, guardian, and master. Each tier gets their own Discord server and early access to content. The agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations, live streams with me every month, plus so much more.
And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you will be able to join hackaholics anonymous. I hope I see you in the Discord chats. If not, I hope I see you in the comment section. And this is your boy Hank Hackers.
And at Hank Hackshackers, your favorite network and system attacker/protector. If no one else loves you, Hank loves you. Love, peace, and chicken grease. And I'll see you in the next video.
Later in episode 26 of the Junior Pentester training series, we're going to go through advanced port scanning with NMAP. this amazing tool that is available to everybody for free. It's actually one of the greatest tools that exists and this is an industry standard when it comes down to pentesting and ethical hacking and reconnaissance and things like that. And in the last two videos, we talked about the basics of live scanning with NAPAP as well as just the basic port scans like TCP and SIN scans and things like that.
So, in this particular video, we're going to be talking about the null scan or advanced techniques that fall under null, Finn, Xmas, and idle or also known as zombie scans. Spoofing, meaning spoofing your IP address, and of course, firewall and IDS evasion. So, these are all the things that we're going to be talking about in the video today. And this all has to do with ad uh end mapap advanced port scanning.
And so, of course, there's the introduction to the the room itself to the video. We have the null scan, fin scan, and Xmmith scan. We have the Maymon scan, act window and custom scan, spoofing and decoys, fragmented packets, idle zombie scan, getting more details, and the summary. And so that's all the stuff that's going to be covered in today's video.
And of course, this is developed and uh provided to us by Try Hackme. Really, really cool place. I love these guys. And so, this is a subscriber only room, meaning that it requires a paid membership.
However, you can always just download end mapap on your own computer and scan your cell phone or scan your other computer or something like that and still do everything that we're going to be doing today and you should be able to get the results that I'm getting. You may not get the same ports that are open because I'm scanning individual machines for this specific exercise, but you can run the same exact scans that I'm running and you'll get similar results. So, the room was developed by Stratagos or Strategio, still don't know how to pronounce it. Um, and then we have Jen Sane.
That's a cool one. Jensen, Genensane, Genensane, Jensen, whatever. Um, thanks. Shout out to these people right here.
Very, very grateful for them because without them, we would not have access to this content that we're going to be doing today and we wouldn't have access to these instructions. So, I'm really excited about it. I hope you are, too. And we're going to be getting a lot of good value out of this video.
A real quick note from our sponsor, Hackolix Anonymous, and then we'll dive into it. If you're serious about your SCIC education and you want access to me on Discord, consider joining Hackaholics Anonymous. We have four tiers, the supporter, agent, guardian, and master. Each tier gets their own Discord server, and early access to content.
The agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations, live streams with me every month, plus so much more. And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you will be able to join hackaholics anonymous. Now, without further ado, let us jump into NMAP advanced port scans. So, this video is the continuation of the end map series.
In the last two videos, we talked about the basic port scan and the live host discovery. And now we're going to be talking about the advanced port scans. And in the next video, we're going to be doing the postport scanning. So in basic port, we talked about the TCP flags and the TCP 3-way handshake.
And to initiate a connection, the TCP requires the first packet to have the SIN flag that's been set. And then we will tell if the TCP port is open based on the responses that we receive. So that's for the TCP connect scan, right? Uh the TCP 3-way handshake is something that we'll just review in a little bit.
Uh security us researchers and hackers contemplated the TCP flags which are shown in this figure below right here. And they explained everything we or we did explain everything in the previous video that we did. So the episode right before this one and we started to experiment with these various flags. But they also wanted to know what would happen if we just send a specific packet which is not a part of any ongoing TCP connection with one or more of the flags set.
So if we look at this right here, these are the flags that we're talking about, right? Urgent, acknowledgement, push, reset, synchronize, and finish. These are the packets and each one of them are assigned a bit out of the 32 bits that are available here. They're assigned a bit.
And if this one is turned on, the value of this bit is one. If it's turned off, the value of it is zero. Right? That's the basics of these types of flags that we set.
So if the act flag is set when you want to acknowledge and receive data, the act scan is like trying to acknowledge the data that was neither sent or received in the first place. So if you just send an acknowledgement without anything else being sent, it's like, okay, I'm just trying to acknowledge nothing basically. So if we use this analogy someone trying to you know they're coming out of nowhere to tell you yes I hear you please continue and you haven't even said anything right so this room explains the advanced types of scans and scan options and some of these can be useful against specific systems while others are useful in particular network setups and we'll cover the following types which are the null fin xmas mayon act window and of course the custom scan So we'll cover the following of spoofing IPs, spoofing MAC addresses, decoys, fragmented packets, and the idle zombie scan. So we're also going to discuss options and techniques to evade firewalls and intrusion detection systems and options to get more verbose details from end mapap.
So this is going to be a pretty robust video that we're going to do today and you're going to learn a lot. my encouragement and I I really just recommend that you go through the basics video and the basic port scan and like the live scan video which is essentially the two episodes right before this one just to have that foundation because we're going to be talking about some more intermediate/advanced stuff and it might go over your head and it might seem a little bit overwhelming if you haven't gone through the very basics. So that's my recommendation. I've already started the attack box, which is a Linux machine that's assigned to us.
And I've already started the first virtual machine, which is the one right here with this green button right here. So, we are ready to go. Let's dive into TCP null scan, FINC scan, and Xmiss scans. The null scan doesn't set any flag.
All six flags are set to zero. All those bits that we talked about, they're set to zero. So you can choose this by doing the lowercase s uppercase N option and a TCP packet with no flags that are set. It's not going to trigger any response when it reaches an open port as shown in this particular thing that we see right here.
It's just basically null. There are no flags that are sent. Right? So the end mapap perspective is that a lack of a reply in a null scan indicates that either the port is open or a firewall is blocking the packet.
If it replies with something, it'll typically reply with a reset, the reset and acknowledgement, meaning that the port is closed. So, as long as we don't get a reply from that port, it's going to conclude and it's going to, you know, make an educated guess that it's either open or it's sitting behind a firewall, meaning it's filtered. So, this is the example of what a null scan will look like on a Linux machine. And it is one of those scans that require a an uh elevated privilege.
So escalated privilege meaning admin or root privileges basically. So you do need to run pseudo with it. And then basically NMAP and then the SN and then that's it. You give the IP address and it starts running.
So you can see right here, right? So it can't really tell whether or not it's open or it's behind a firewall, but it's no everything else that didn't get this kind of a response. it was immediately assumed that it was closed because the server replied with an RST, a reset connection and so that was the conclusion that everything else was definitely closed. These might either be open or they might be behind a firewall and they're being filtered.
So many end mapap options require root privileges. For example, the one that we just talked about or the stealth scan which is the lowerase S, uppercase S. So you unless you're running NMAP as root, you need to use pseudo as the example. Finn scan is the next one and it's going to be actually sending a packet.
So we're sending the FIN uh flag but that we've set that FIN bit has been set to one. So you can use it by doing lowercase S uppercase F. Similarly, no respond will be sent if the TCP port is open and end map can't be sure if the port is open or behind a firewall. So it'll probably say open or filtered.
And this is what it looks like. It just sends a FIN packet, right? So if it responds with a RST acknowledgement, it means that that port is actually closed. It's sending a reset.
So that's how we determine that the port is actually closed. And so SF against lowercase S, uppercase F would be the FIN scan that we're going to be sending with the FIN packet or the FIN flag being set to one. And so this is the response that we would get, right? So open filter, the type of service that it thinks is behind it and everything else actually responded with a closed.
Therefore, it's not on our list over here. The Xmmith scan gets its name after the Christmas tree lights. So, it sets the Finn, push, and urg flags, the urgent flags simultaneously. So, you can select this by doing S, capital X.
And like the null scan and the FIN scan, if an RST packet is received, it means that the port is closed. Otherwise, it'll be reported as open or filtered. So this is what we can see right here. Finn, push and urgent are both set.
Finish, push, and urgent are both set. And if we don't get any kind of a reply, that means it's either open or filtered. If we do get that reset acknowledgement, that means the port is closed. And we can run the scan by doing again pseudo mapap lowercase s uppercase x.
And this is what it looks like. And there we go. we just have these uh packets that are replied or these um replies that we've gotten from these ports that can be deduced as either being open or behind a firewall. So, one scenario where these types of scans can actually be efficient is when you're scanning a target that is behind a stateless or a non-stateful firewall.
A stateless firewall will check if the incoming packet has the sin flag set to detect a connection attempt. So using a flag combination that does not match the sin packet makes it possible to deceive the firewall and reach the system behind it. However, a stateful firewall will practically block all such crafted packets and render this kind of scan useless. A stateful firewall essentially blocks anything that does not match the allowed list.
And it doesn't matter how you try to deceive it, it's just going to block everything that doesn't match the IP addresses that are allowed to connect to its end points. So the question here is in a null scan, how many flags are set to one? And that would be zero. There are no flags that are set to one inside of a null scan.
Let me make sure my keyboard is awake. There we go. In a Finn scan, how many flags are set to one? That would be one.
In an XM scan, how many are set to one? That would be three. And we're going to start the VM and load the attack box. Once both are ready, open the terminal on the attack box and use MAPAP to launch a FIN scan against the target VM.
How many ports appear as open/filtered? So, I already have the attack box started and I already started the uh the virtual machine right here, our target machine. So, we're just going to do split view and then we're going to open it up inside of a full screen window so it's a little bit easier for us to manage this thing. And we're going to copy the IP address of the target machine.
And we're going to be doing a what scan? We're going to be doing a FIN scan. So, it's going to be lowercase S uppercase F. And I'm just going to run it without pseudo just to see if it's going to let me run it.
And if it I mean it already says that I'm root. So I I can run it without pseudo because I'm already root, baby. Okay, so here we go. So we're going to run N mapap and we're going to do it with the SF for the FIN flag and we're going to paste the IP address.
Press enter and it's going to run and boom, that was quick. Okay, so how many do we have? We have 1 2 3 or actually it says right here. Does it tell me?
No. So it says 991 did not show, meaning it scanned the top, thousand nine of them responded. So 1 2 3 4 5 6 7 8 9. Yeah.
So nine of them responded. So we have how many? We have nine that responded. Uh repeat the scan launching a null scan against the target.
How many ports appear as open filtered? So we'll come back over here and we'll do this n map s and then we're going to paste the IP address and let's see how many Oh, what what just happened here? That is not what I highlighted. So 10 10247201.
So how many do we think we got? So 991 closed, meaning we got a response from nine ports again. So again, it should be the same exact thing. So nine ports responded as open filtered.
All right, let's talk about the Maymon scan. Uriel Maymon or Mymon could be the name first described this scan in 1996. In this the FIN and acknowledgement bits are set and the target should send a reset packet as a response. However, certain BSD derived systems drop the packet if it's the open port exposing the open ports.
So, if the packets are dropped, then we can assume that it's an open port. If the packets are closed, we should be receiving an RST packet. It won't work on most targets encountered in modern networks. However, we included in this room to better understand the port scanning mechanism and the hacking mindset.
To select this, you would do lowercase S, uppercase M. And most target systems respond with an RST packet regardless of whether the port is open. In such a case, we won't be able to discover the open ports. The figure below shows what happened.
So, we just basically send a FIN and acknowledgement flags and then we get an RST. And it could be open or closed, which is it's I mean, it's kind of pointless like you can't really figure it out. So this is what the scan looks like and then you don't get anything right. It says all thousand scans uh all thousand scanned ports and nothing has responded.
So uh this type of scan is not the first scan that one would pick to discover a system. However, it's important to know about it as you don't know when it could actually come in handy. So how many flags do we set in this? We set two flags which is the the fin finish and acknowledgement flags are set.
Okay. So now we can actually move on to something that allows us to run it. So I'm going to go ahead and terminate this machine and we're going to move on to the next one and start this machine and first do the read through and then we'll actually do the scan. So in this section we're going to be talking about the acknowledgement window and custom scans.
So as the name implies the acknowledgement sends the acknowledgement flag, right? So we can use it with S A. So lowerase S, uppercase A to choose this. And as we can see, it's going to send the acknowledgement flag.
And then we should be receiving a reset flag indicating that the port is either open or closed. Right? So this happens because a TCP packet with that flag set should be sent only in response to a packet to acknowledge the receipt of some data. And in this particular case, we're sending it as the very first packet.
and there was no data that was received. So it won't tell us whether the target port is open in a simple setup. So this is what it looks like just like everything else pseudo and map and then you do lowercase S uppercase A give it the IP address. In this case we didn't get anything back, right?
This would be helpful if there's a firewall in front of the target. Consequently based on which acknowledgement packets resulted in responses, you'll learn which ports were not blocked by the firewall. In other words, this scan is more suitable to discover firewall rule sets and configurations. So after we launched the target machine, we repeated the acknowledgement scan and this time we received some interesting results.
So there was actually a firewall was launched with this instance right here. So they did the same exact scan, but in this particular case, we actually received unfiltered responses, meaning that this port, this and this one were not hidden behind the firewall. That's what the indication of this would be. So it's actually very interesting.
It can tell you whether or not there are ports that are not uh being blocked by the firewall and what the firewall rules are. So in this particular case out of these top thousand ports that were being scanned these three were not being filtered by the firewall. So actually very very handy and very useful to know. Okay.
So let's move into the window scan. So it's another similar scan uh which is the TCP window. Uh it's almost the same as the acknowledgement. However, it examines the TCP window field of the RST packets that are returned on specific systems.
It can reveal that the port is open. And you can do it by doing lowercase S uppercase W. And in this figure, it'll send the acknowledgement and the reset again. So it's very similar to the ACT uh packet being sent or the the acknowledgement scan, but in this case, it's actually just the the lowercase SAS W.
So it's a window scan, but it's actually sending an acknowledgement packet. So if we get a reset again, it's saying that it's either open or closed. So running it against the Linux system with no firewall, it's not going to provide anything. And we can see that the result of the scan is empty without a firewall.
But if we repeat the scan against the server behind a firewall, we expect to get more satisfying results. And what we can see right here are these pieces right here. So they're actually closed, right? So in the previous one, we saw that they were unfiltered, right?
In the the acknowledgement scan, we saw that they were unfiltered. So they're not being blocked by the firewall. However, in this particular case, it's showing that they're closed. So obviously, if they're closed, then the firewall doesn't need to block them, right?
So that's kind of the conclusion that we can make with that. So if you want to experiment with a new TCP flag combination, you can actually just use your own custom scan. And you can do that by doing the scan flags option here and then give it the flag. So this is the rst flag, the sin flag and the fin flag have been set in this particular case.
So then you would send custom flags using whatever your custom flags are and then I don't know what the response would be in this particular case but in this particular case if you do scan flags uh urgent acknowledgement push reset synchronize and finish all of them have been set. So all of the flags have been set and I don't know what the response would be. So it's essential to note that the acknowledgement scan and the window scan were very efficient at helping us map out firewall rules. However, it's vital to remember that just because a firewall is not blocking a specific port.
It doesn't necessarily mean that a service is listening on that port. So for example, there's a possibility that the real rules need to be updated to reflect recent service changes. Hence the acknowledgement and window scans are exposing firewall rules not the actual services themselves. Right?
So the acknowledgement scan showed that they were unfiltered but then when we did the window scan it showed that they were closed ports. Right? So it actually show it tells us a lot about the setup of that network and the firewall rules themselves not necessarily the services that are running on those ports. So in the TCP window scan how many flags are set and that is one.
you decide to experiment with a custom TCP scan and set the reset flag. What would you add after the scan flags and that would be RSD for the reset flag? So, the virtual machine received an update to its firewall rule set. A new port is now allowed by the firewall.
After you make sure that you have terminated the VM from Tax 2, which I already did. We're going to launch this one. And then once you're ready, you open the terminal and use Nap to launch an acknowledgement scan against the target VM. How many ports appear unfiltered?
What is the new port? To determine the new port, you need to compare the scan results of task two to the ones of this task. And is there any service behind the newly discovered port? Okay.
So, the ports from task two to the ones of this one. So, let's go to task two real quick. And let me zoom out here just to make it easier. So, we're going to go to the ports of task two.
There we go. Okay. So, what was open in task two? Oh, I totally don't even remember.
Right. So, what is it? We had um nine that were open, nine that were filtered, and this one had 994. So, I don't even remember.
Did I clear it out? I'm not going to clear it out. So, I'm not going to clear these results. These were the ports from task two.
So, we're not going to clear them just so we can use them as a comparison. So, in this particular case, we're now going to scan this target, which is the new port and or the new IP, excuse me. And we're going to be using the what type of what are we doing? We're doing an acknowledgement scan.
So let's zoom in here and we will do an acknowledgement scan against this one. So uh it's going to be end mapap sa like that. And then we're going to paste the IP address like so. Press enter.
And let's see what kind of a response we get and how long this would take. I wonder how long this takes. Okay, very quick. Okay.
So, uh we have four ports that are unfiltered technically. So, what does it say? It says um how many ports appear to be unfiltered. So, we have four.
Now, what's the new port number that appeared? Uh to determine, you need to compare to the task two of this task. I see. I see.
It's the That's so stupid. Okay. So, based on these comparisons, what's the new one? So, we have 225 80 and 443.
443 is the new one that shows up here. So, is there any service behind the newly discovered one? And it does. Technically, it says it's HTTPS because that's the default port for HTTPS.
So, we're going to say yes. Now, is there any service behind the newly discovered port number? The answer is yes, because it does say that there's a service. So, I don't understand why this is being uh the way that this is right here cuz this is technically they did a Windows scan.
So, I mean fine, let's do a Windows scan of this cuz uh based on the the acknowledgement scan, it says that there is uh a port service, right? It's that's what it says. So, we're going to paste the IP again. My god.
Again, this thing like as as soon as I highlight anything, I guess it copies it, which is stupid, but okay. So, we're going to do window scan now. And the same port should technically show up. And it says they're all closed.
So I guess there is no service behind them, I guess. But it does technically say HTTPS, so whatever. All right, let's talk about spoofing and decoys. In some network setups, you can actually scan a target using a spoofed IP address or even a spoofed MAC address.
But this is only useful when you can control the capture of the response or you can actually capture the response. Because if you're doing it from a random network that you can't capture all of the responses, then it doesn't really help you. You're spoofing something that you can't see what the replies would be. So, this is what the uh figure shows if the attacker uses NMAP- capital S and then they provide a spoofed IP address and then the machine IP, which is the one that you're going to be scanning.
So, it'll craft the packets using the provided source IP, which is the spoofed IP. and the target machine will respond to the incoming packets replying to that spoofed IP. And for this to work, you need to have the monitoring of the network traffic to actually be able to analyze what's coming to that spoofed IP address. So this is what it looks like, right?
So you send the command, the host, which is you, you're sending it to the server yo using the spoofed IP. the machine will then reply to the spoofed IP, which is this thing right here. And if you don't have access to the traffic of this specific IP address, then it doesn't matter what you do because you're not going to be able to find it. Like you're not going to be able to see what the results are.
So the attacker will send a packet with spoofed source IP address. The machine replies to the spoofed IP address and the attacker captures the replies to figure out what the open ports are. you expect to specify the network interface using the -ash e and to explicitly disable ping using dash capital p lowercase n. So instead of doing nm mapap s spoofed IP machine IP, you actually need to do something a little bit more sophisticated which is n mapap- e and then you give it the interface and then you do capital p lowercase n to disable pings and then you do capital S to give the spoofed IP and then the machine IP that you want to scan at the end of this whole thing.
So, it's worth repeating that this scan will be useless if the attacker system cannot monitor the network for responses, which is basically going to be that spoofed IP. So, when you're on the same subnet as the target machine, you would be able to spoof your MAC address as well because it will end up using the ARP protocol to actually send out its packet. So, you can specify the source MAC address using spoof MAC and give it the spoof MAC address. And this is only possible if the attacker and the target machine are on the same Ethernet network or the same Wi-Fi.
So you're in the same subnet so that it doesn't use IP addresses to try to communicate with the other device. It'll still use the MAC addresses because MAC addresses are used to communicate with devices on the same network. It doesn't necessarily need IP addresses to communicate with devices on the same network. So spoofing only works in a minimum number of cases when certain conditions are met.
Therefore, the attacker might resort to using decoys to make it more challenging to be pinpointed. The concept is simple. Make the scan appear to be coming from many IP addresses so that the attacker's IP address would be lost among them. As we can see in this particular figure, uh it's going to be coming from three different sources and consequently the replies will go to all of those sources as well.
Right? So, it'll come from the decoy, right? So let's go look at this. We have the decoy, the actual attacker IP and another decoy.
So the response is going to go to the two decoys as well as the attacker IP. So all three of them are going to get those responses and one of them is actually going to be you. So if you wanted to do this or use just random IP addresses, you can just do dash capital D. for example, end mapap- capital D 10101 10102 and then me which would end up being your actual IP address and it'll make it appear as if it's coming from all these things and then the MI is replacing that your IP address should appear in the third order.
Another example would be 10102 R&D R&D and then me. So R&D will end up being random choices, right? So random I IP addresses that NM map will just choose for you. And then the final one is going to be you the IP address for your actual machine.
So each time that you execute this latter command, this piece right here, you would expect two new random IP addresses to be third and fourth decoy sources because they are being randomized. So what do you need to do to or what do you need to add to this command right here to make this scan appear as if it's coming from the source IP address 10 10 10 11 instead of your IP address and so that would be what dash s and then you would do 10 10 10 11 like that so what do you need to do uh what do you need to add to the command this piece right here to make the scan appear as if it's coming from the source IP address 1010 20221 and 1010 20228 in addition to your IP address. So this is going to be the dash decoy portion. So we'll do dash d and then we're going to do 10 10 20 21 comma 10 uh 10 2028.
Whoops. And then comma me. And there we go. That's what we got.
So let's talk about fragmented packets now. Okay. Okay to understand why this is important why the concept of fragmented packets is actually important is first we need to understand why a firewall is how it plays out in this whole scenario here. So if you don't already know a firewall is either a software or they're actually physical firewalls that exist um that are usually attached to your routers or maybe your switches and they permit packets to pass through or block the packets from actually passing.
So it functions based on the rules that are established for it and it could be blocking all traffic with the exceptions or allowing all traffic with exceptions. So for instance, you can block everything to your server except those coming to your web server from a specific IP address. A traditional firewall will inspect at least the IP header and the transport layer header. And a more sophisticated firewall would also examine the data that's carried by the transport layer and signatures and things like that to determine whether or not it should block it.
Okay. Then you have the intrusion detection system which inspects the network packets for behavioral patterns or specific content signatures. And a next generation firewall will end up being something that actually has an IDS embedded into it. So the IDS raises an alert whenever a malicious rule is met.
In addition to the IP header and the transport layer header, the IDS would inspect the data contents in the transport layer and check if it matches any malicious patterns or signatures or anything else that you would have asked it to check on. So, how can you make it less likely for a traditional firewall or for the IDS to detect your end map activity? So, it's not that easy, right? Depending on the type of firewall or IDS that you're actually dealing with, you might benefit from just dividing your packet into smaller packets, also known as packet fragments.
So, NAPAP actually provides the option that you can uh declare by using the lowercase f so - f to fragment the packets. Um once you do it, all the data will be divided into eight bytes or less. So when you add another f, it could be - f-f or you just do - ff. It'll split the data into 16 byte fragments instead of 8.
So you can change the default value by doing the mtu. You should always choose a multiple of eight no matter what you do. So you can do mtu uh 8, you could do mtu 16, mtu 32, which I don't know why you would do that because it ends up just being 32 bits anyways. So you can do um or actually I guess not 32 bits, excuse me, because 32 bits would be inside of a given packet.
So if you're separating them by bytes, then you're talking about fairly large chunks of data that's being transferred back and forth. So whatever you're going to end up doing, just make sure that you choose multiples of eight. So to properly understand this, we need to go look at the figure again, the RFC 791 figure. Uh in particular, we're going to look at the source address taking 32 bits or four bytes on the fourth row while the destination address is taking another four bytes on the fifth row.
And the data that we will fragment across multiple packets is highlighted in red to reassemble on the recipient side. The IP uses the identification which is the ID and the fragment offset which is on the second row of the figure below. So we can see this right here. So this is the element right here.
Here you have the source address and the destination that take up a full 32 bits each. Then you have the data. Okay? And so the IP will go ahead and reassemble these things.
So let's go back and read this piece one more time. To reassemble the recipient side, the IP uses the ID and the fragment offset which is in the second figure which I guess we can't really see because where's the second figure? Is it down here? No, it's not.
It doesn't show us. Maybe I don't know if this is the thing that they're talking about, but this is the piece right here that I think they're mostly relevant to or more they're identifying or talking about, but it would end up taking the ID as well as the fragment offset. So fragment offset is right here. So it'll take the fragment offset as well as the identification, which I don't see here.
Oh, there we go. Identification. So there's identification, also known as the ID, and the fragment offset. These are the things that are going to be used to reassemble the data.
So, let's compare this using the stealth scan on port 80 and the stealth scan on port 80 and doing the -F right here. It's kind of hard to see because it's been separated. But with this one doesn't have -f. This one has -f.
So, we know that using a stealth scan on port 80. However, in the second command, we're also doing the fragmentation. So in the first two lines we can see that the ARP query and the response. This is what we see right here.
So the first two lines right here are the ARP query and the response. The second two lines show the sin ping and a reply. So sin ping and then RST acknowledgement has been sent. So that's the sin ping and the reply.
And the fifth line is the beginning of the port scan and it sends a TCP SIN packet to port 80 and the IP header is 20 bytes and the TCP header is 24 bytes. And the minimum size of the TCP header is 20 bytes. So if we go to look at this a little bit closer here, these are the R packets. These are the ping and the reply.
And then we get to see the SIN packet being sent to port 80. Port 80 replies. And we don't really get to see that the size of the data, but we can see that it is uh there's actually the sin has been done. So this is the one without the fragmentation.
So when we look at the fragmentation which is going to be this one, the 24 bytes of the TCP header are going to be divided into multiples of eight with the last fragment containing 8 bytes or less. And since 24 is divisible by 8, we get to see three IP fragments and 20 bytes. Oh, earlier I jumped from uh 816 to 32. So technically there was 816, 24, and 32.
Wow, my multiplication tables are so bad, bro. Uh I can I can just imagine what people are going to say in the comments. So we got three IP fragments. Each has 20 bytes in the IP header and eight bytes of the TCP header.
And we can see the three fragments over here. So we can now see that it's actually fragmented IP protocol, fragmented IP protocol. And then what's been sent as the final right here to port 80 and then there we go. And then port 80 actually responds.
So that's what we can see. So if you did FF or you know - F-fragmentation will be multiples of 16. In other words, the 24 bytes will end up being two specific fragments. The first one is going to be 16 and the second one is going to be eight.
So it's always going to do the first series of uh fragments by the number that you have declared and then whatever will end up being the last one will most likely end up just being that last eight bytes. So if you prefer to increase the size of the packets to make them look innocuous, you can use the option data length and then give it a number where the number specifies the number of bytes that you want to append to your packets. That's very interesting. So you can actually modify what your packets look like or what they perceive to hold and it will go ahead and add data uh whatever the number would be.
And I would presume that you want to add some kind of a even number, not necessarily a uh an odd number, but that's just an assumption on my part. So, okay, what's the question down here? It says, if the TCP segment has a size of 64 and the FF option is being used, how many IP fragments will you get? So FF means that it's going to split it into 16.
So if I go ahead and do a division of 64 by 16, it ends up being four packets. So we're going to end up getting four fragments that are going to be sent. And that is indeed the right answer. So now let's talk about zombie scans.
So, if you have the limitations that you're in a network setup that doesn't support spoofing, then there's another option that you have that can be done using the idle scan, also known as the zombie scan. So, this requires an idle system that's connected to the network that you can communicate with. So, for example, or essentially NMAP will make each probe appear as if it's coming from the idle host, the zombie host. So a printer right like technically a printer is connected to the network but a lot of times it's inactive because it's not receiving any kind of data it's just sitting there.
So it will end mapap will check for the indicators whether the idle zombie host received any response to the spoofed probe and it's accomplished by checking the IP identification. So IP ID in the IP header and you can run an idle scan using the SI lowerase S capital I give it the zombie zombie IP address and then the machine IP address that you want to scan and that would be it. So basically the zombie IP would be the the IP of the idle host. Uh this requires the following three steps to discover whether a port is open.
So trigger the idle host to respond so that you can record the current IP ID of the idle host. Then send a sin packet to a TCP port of the target and the packet should be spoofed to appear that it's coming from the zombie host. Then trigger the idle machine again to respond so that you can compare the new IP ID with the one that was received earlier. So this is what it looks like if we were just looking at it with the figure.
So, first and foremost, you're going to send the the acknowledgement to the zombie IP address, and it'll send something to you to give you its IP ID. Once you have that, you would then go ahead and uh craft your packet, craft the scan that you're doing to your actual target using that information. So the attacker will send a sin packet to the TCP port they want to check on the target machine and this packet will use the idle host the zombie IP as the source and three scenarios would arise. The first would be in this specific figure that the TCP port is closed.
Therefore the target machine responds to the idle host with an RST packet. The idle host does not respond. Hence the IP ID is not incremented. So keep that in mind.
Right? So every time you do this the IP ID will actually increment. So in this case we sent it from the zombie IP. The machine is going to send with a reset and the attacker system will now get that the IP uh the IP ID of this zombie will not be incremented.
The port is closed if we receive this reset packet. In the second scenario the TCP port is open. So the target machine responds with sin acknowledgement and the idle host responds to this with an RST packet and it increments its IP ID. So we send one right from us using the zombie IP.
The machine responds to the zombie IP. It's open. So the zombie IP will send a reset because it's literally just a printer. It's not going to do anything.
And so when it does this, the zombie IP ID is going to increment by one. In the third scenario, the target machine does not response at all due to firewall rules. This lack of response will lead to the same result as with the closed port, and the idle host will not increase the IP ID. For the final step, the attacker will send another SIN acknowledgement to the idle host.
The idle host responds with the RST packet incrementing the IP ID by one again. And the attacker needs to compare the IP ID of the reset packet received in the first step with the IP ID of the reset packet received in the third step. And if the difference is one, it means that the port on the target machine was closed. If the difference is two, that means the to port on the target machine was open.
So it's worth repeating that this scan is called an idle scan because it's choosing the idle host and it's indispensable for the accuracy of the scan. And if the idle host is busy, all the returned IP IDs would be useless. So you need to use something that actually is idle and it's not being used. So you discover a rarely used network printer with the IP address 10105 five and you decide to use it as the zombie uh in your scan.
What argument should you add? So that would be the idle, right? So it would be - SI, right? It's dash dash SI.
My god, I am having a hard time speaking. So we're going to do - SI. And then we would give it the 10 10 55. And that's it.
All right. So now we have another machine that we're going to end up using. And for this one, we're going to probably do some more scanning. So let's see what the documentation reads.
So what you can do is add a few different uh options to your scans to just get more details about what happened with the scan. And one of them would be the dash reason. So d-reason if you want end mapap to provide more details regarding its reasoning and conclusions. So we have two scans.
This is the one without the reasons. So you can see this right very basic and then you have the one with the reasons and then now it gives you the reasoning that it had. So sin acknowledgement TT time to live was 64 essentially. So providing the reason gives us the explicit reason why end mapap concluded that the system is up or a particular port is open.
In this output above that we just saw look right there we can see that this system is considering online because end mapap received ARP response. So this is actually the reason right here. So let me see. Oh there we go.
Host is up. Received ARP response. There you go. That's the reason over here it just says host is up.
So there's another thing. I just thought it was actually this piece right here, but it's this piece right here. Receiving an ARP response was the key element. So on the other hand, we know that the SSH port is deemed to be open because NAPAP received a SIN acknowledgement packet back.
So for more detailed output, we can actually now use verbose or VV for very verbose and it'll give us even more information. So you get VV for very verbose. And every step of the way as it's scanning, it tells you what's going on, right? And previously, uh I don't think it was I don't know if it was this video or another one.
I'm recording all of these on the same day. But as it scans, it'll be like, yeah, 40% done, 50% done, 80% done, and then it'll show you along the way that discovered open ports, discovered open ports, etc., completed the scan at this time, and then finally it gives you its report at the very end. Right? So very very useful stuff.
So if VV does not satisfy the curiosity, you can use D for debugging or DD for even more details on debugging and you can guarantee that using the D will create an output that extends beyond a single screen. So what we're going to do for this final exercise is we're going to do a stealth scan uh using the F flag and it's going to be fast. So, it's going to be scanning the top 100 instead of the top thousand. And we're going to ask for a reason.
And then we're going to be scanning this IP address at the very end right here. So, I'm just going to copy this. I know I can copy the whole thing, but I like typing these things out. So, we're done.
We're going to do a stealth scan with the F flag, and then we're going to ask for reasoning as well. So, let's go here and actually get this done. So, here we go. So, we're going to do N map.
We're going to do SS and we're going to give it the F and we're going to ask for a reason. And then we're finally going to provide the IP address here. Press enter. And there you go.
So it says host is of received ARP response. And what do we have? Sin acknowledgement TTL 64. All of those things, right?
So what does it say right here? It says uh what is the reason provided for the stated ports being open? And so it is this thing sin act which is basically the same thing that we just saw right here as well. And that's it.
We got the reasoning for it. And that was our last exercise for this room. All right. So, in conclusion, as a summary, we have talked about a variety of different techniques and scan types and all of that good stuff.
So, we talked about the null scan, the Finn scan, Xmmith, Mayon or Mymon acknowledgement window, and even customizing our own TCP scans. And then we have all of the options here as well. And you can always just go to N MAPAP or you know your Linux machine and just do mann map and pull up the manual for end mapap and just read through this like you this is one of the easiest ways to learn as much as possible about a given tool and it'll show you exam uh examples that it has. So example one, a representative endmap scan.
It's using - a. So it's going to do all of the scans and it's going to do it a little bit faster than usual and it's going to provide all of these things for you. And so it finds the SSH host key for you. It found the open port for SSH itself and all of the elements that are assigned to it.
And then it found port 80 that was open. Uh it pulled the HTTP title for you. would pound the version of server that's running on it etc. So this is just an example scan and then you can go through the option summary read through all of those details and there's a lot of stuff that's available for end mapap for you to learn and use and just become masterful at.
So this is not a tool that you can learn how to use with just a handful of videos. You have to experiment with it. You have to go through all of the different options that are available to get really good at it, to get proficient at it. And should you choose to invest that time then you will get a result as a response meaning you will actually get good at using end mapap and then most likely you will stand out from your competitors and your peers at work and so on and so forth.
So all of these options are also available inside of the manual and the explanations for all of these options are available. We also talked about spoofing our IP address but you do need to have access to this spoofed IP address over here. We talked about the MAC address spoofing, the decoy scan, and of course the zombie scan, and how to fragment your IP data into eight or 16 bytes or even how to do it uh for other sizes as well. You can do a source port.
This is another one that we didn't talk about, but you can actually specify the source port that you want to scan from, that you want to show your scans are coming from, and even the data length option where you can append random data to each given packet that's being sent out to reach a given length that you're interested in. Um, then there's the reasoning element to pull more information, the verbose and very verbose debugging and details for debugging. So all of this stuff is available if you want to learn even more about what's going on anytime in MAPAP does a scan and the information that is being uh collected and its processing and all of that stuff. So you can just learn more about how it works and what happens behind the scenes instead of just pressing enter with some basic options and then getting the results the report that it gives back to you.
So really powerful tool I personally love it. There's one more video that's left in our series, which is the postport scans for N MAPAP. And once that's done, we're going to move on from N MAPAP to the rest the uh the remaining series of videos that are available to us. Um, which are going to be so let's zoom out a little bit so we can look at this.
So, we have postport and then we're going to go through protocols and servers and protocol servers part two. And then there's a network security challenge that's available at the end of this module. And we're going to go through all of that stuff together as well. So hopefully you found some value out of this video and you learned some really cool things.
And then we are going to move on. If you did get value out of this video and you want to get more videos like this one, I encourage you to like, subscribe, and turn on the notification bell so that you get notified the next time that a video comes out on this channel on this pathway which is junior pentester. And if you're really interested in pentesting, then there's the CompTIA Pentest Plus playlist which is available. This weird screenshot that you see right here is the very first live stream I ever did during uh this was earlier today.
It was like a birthday surprise live stream that I did for the community. It was very wellreceived. A lot of people loved it. So, I'm going to most likely do more of those from now on just to make sure that people actually get to have their questions answered and we'll do an AMA and all of that good stuff.
And then there's the other playlist as well. So we have the CompTIO pentest plus which is uploading every Friday until it's done which is I think it'll happen in a few weeks. Network plus is already done. Hack anonymous exclusives.
We have CompTIO security plus done. Linux plus is already done. And then there's a bunch of other ones. Security engineering all the compilation.
So level two. Um cyber security 101 which is really big deal. Members only videos obviously. And then there's this is the actual sock level one section.
Sock level two and security engineering. So there's a lot of stuff. There's a lot of stuff that's available for you. If you don't want to browse or if you already know what you're looking for, you can just go to this little search box right here and then search for something.
So, for example, let's say Splunk. Let's say you want to learn more about Splunk. You search for it and there's a bunch of videos that come showing up about Splunk and how you can use Splunk. If you want to learn about John the Ripper for password hacking, you can search for John the Ripper and then find videos on that one.
There's a lot of stuff that's available. So, uh, just depending on what it is that you're interested in, what you're trying to do, you can find information on this channel. And there's over 390 videos, 397 as it stands right now, but by the time that you see this, it's most likely going to end up being 399. And I think my screen froze a little bit, so sorry about that.
So, there's a lot of stuff. There's a lot of stuff that's available, and there's a lot of stuff that's continuing to come out. And most likely by the time that you see this video, the channel will have grown to even a larger number and the video count is going to be even higher. And it's really crazy to think that we're over 25,000 subscribers and I've been doing this for I think a year and a half maybe something like that.
And that's just very humbling. It's like a really crazy experience. And I hope that you'll end up joining this community because there's a lot of content and a lot of value that I try to share with everybody and I want you to get access to it too soon. So if you have any questions or comments about what we talked about today, drop them in the comment section below.
Otherwise, make sure that you like, subscribe, and turn on that notification bell so that you get notified the next time that a video comes out on this channel. If you're serious about your SCIC education and you want access to me on Discord, consider joining Hackaholic Anonymous. We have four tiers, the supporter, agent, guardian, and master. Each tier gets their own Discord server, and early access to content.
The agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations, live streams with me every month, plus so much more. And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you will be able to join hackaholics anonymous. I hope I see you in the Discord chats. If not, I hope I see you in the comment section.
It's your boy Hank Hacker sent Hank Hacks Hackers, your favorite networking system attacker/protector. If no one else loves you, Hank loves you. love, peace, and chicken grease, and I will see you in the next video later. In episode 27 of the Junior Pentester training series, we are going to continue with our end map series of videos for network security and we're going to be talking about the postport scanning activities.
So, the things that you would do after the scan or to enhance your scans. And this is a part of the series that goes along with NAP. And of course there is all the videos that are inside of the network security module. So uh the next couple are going to be protocols and servers part two and one as well as the network security challenge.
So for this video we're going to be doing you know the introduction service detection uh OS detection and trace route end mapap scripting engine saving your output and of course the summary final thoughts and things like that. And then you will be dismissed for the day. the uh v uh the video or what am I saying? The room itself.
I'm kind of losing my thoughts here. Uh the room that we're going to be using is going to be inside of the try hackme platform and it was developed by Stratagos. Now, this is I think going to be the official pronunciation of Stratagos cuz somebody in the community told me that I think it's Stratagos. You know what I mean?
Like it's kind of like a a modified version of Stratagos. Maybe. I think that's what it is. Maybe.
I have no idea. The only way that I'll know for sure is if Stratagos actually hits me up and says, "This is how you pronounce my username." But anyways, that's basically what it is. This is a subscriber only room that's available inside of Try HackMe, meaning you do need a paid membership. However, if you have access to Nap on your own computer, then you can just go along with everything that we're going to be talking about in this video and you'll be able to implement all the exercises and learn everything that we're going to be talking about today.
So that is pretty much it for the overview for this video for NMAP post scans. And of course a quick note from our sponsor Hackaholics Anonymous and we will dive deep into the contents. Let's go. If you're serious about your sci-c education and want access to me on Discord, consider joining Hackaholics Anonymous.
We have four tiers. The supporter, agent, guardian, and master. Each tier gets their own Discord server and early access to content. The agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations live streams with me every single month, plus so much more.
And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you'll be able to join Hackolix Anonymous. Now, without further ado, let us jump into NAPAP postport scans. So, we have officially come to the last video in the NM MAPAP series. And in this particular video, we're going to be talking about service detection, OS detection, the scripting engine of NAPAP, and of course, s uh saving your scan results for further analysis after you're done scanning.
And in the first room, we learned about enumerating targets and discovering live host. Then, we learned about reverse DNS to find interesting names. And then, we talked about all of the different types of scan uh in the second and third video. And then now we're finally going to be talking about the detection of the versions of the running services, detection of the OS that's running, uh, end mapaps, trace routes, naps scripts, and of course saving the results.
And all of these things that you see right here, the ones that have been grayed out are the ones that we've talked about in the previous videos. And these are going to be the ones that we're going to be talking about today. And it's actually very straightforward. These things are quite easy to wrap your head around, especially if you've gone through all the previous videos.
So if you haven't gone through those videos, I do encourage you to check them out. But if you've already gone through those, the rest of this stuff is going to be a piece of cake. So, I'm going to make sure that our attack box has been launched and we actually have access to the virtual machines. And from there, we're going to run and gun.
Let's go. Okay. So, this is where your reconnaissance really starts to take off is when you start discovering the various services and operating systems that are running on these ports that we've been scanning. Because once you know what services are running and then what versions of those services are running, then you can really start doing some reverse engineering to see what kind of vulnerabilities actually would exist for those versions of operating systems or services.
And then from there you can go to a place like exploit database or GitHub or even try to write your own vulnerability or exploit I should say. And it becomes a really interesting experience because that's where the rubber really meets the road. So if you do a really good job of reconnaissance and research and finding out the versions of things and the the the operating systems and the potential vulnerabilities that exist for those things. You can use metas-ploit for example to find existing exploits that would exist for that given vulnerability or for that operating system and it you're off to the races.
You know what I mean? It's just that you have to do really good recon and enumeration and research to actually make the exploit part work well. And as we go forward with Junior Pentester and as the rest of the videos for CompTIA Pentest Plus get dropped every Friday, this becomes one of those common themes where if you've done really good research, the exploitation phase becomes incredibly easy, almost scarily easy because you already know exactly what you're going to be attacking for your attack vector. If you don't do good enough research or reconnaissance, then you go to try an exploit, it doesn't work, and then you have to come back and do more recon and research.
Then you try it again. Doesn't work. Then you have to come back in. So spend a lot of time on recon and research.
As the old saying goes, if you have 4 hours to chop down a tree, you spend 3 hours sharpening your axe. And reconnaissance and research and enumeration counts as sharpening your axe. And then you spend that 1 hour chopping down that tree and doing some very precise exploits because you know exactly what you're going to be attacking. And that's kind of the whole spirit of everything that we've talked about so far and as it combines for this video as well.
So when you use the lowercase S uppercase V, so SV, it's going to start collecting and determining service and version information for the services that are running on those open ports. And then you can look at version intensity level, for example, where the level ranges between zero, which is the high the lightest, excuse me, and nine being the most complete. So if you do for example SV version light has an intensity of two, version all has an intensity of nine. So these are the ver the ways that you can try to get as much detail as possible about those services that are running on those ports.
When you use SV, keep in mind that it's going to do the TCP 3-way handshake. So the connection, right? It's going to do another version of the connect scan that we did. It's just going to search for more information.
And this is a loud type of scan. So keep that in mind. If you're trying to evade being detected on a network scanner or a network monitoring tool, then you want to combine SV with maybe the slowing down of the the timing, right? Sending it at a paranoid level or as a careful level so it doesn't set a bunch of packets at once and at least it makes it a little bit easier.
Or maybe you want to fragment the packets that are being sent. There's a combination of things that you could do that we talked about on the previous videos to try to avoid detection of the firewall or the intrusion detection system etc. So if you do for example the connection establishment is very necessary because you can't discover version without actually establishing a connection. So when you do a stealth scan which is SS it's not possible to do SV at the same time because SV requires that full TCP 3-way handshake.
the stealth scan for example if we try to do this so we're going to do a comparison here so we have the output that shows the stealth scan with the SV option adding the SV option leads to a new column in the output showing the version for each detector for instance the case of port 22 instead of 22TCP open SSH we obtain open SSH and then we have the version of it Davian etc etc so the SSH protocol is guested as the service because the TCP port22 is actually open MAPAP didn't need to connect to port 22 to confirm. However, SV required connecting to this open port to grab the service banner and any version information. For example, in Jinx 162. Hence, unlike the service column, the version column is not a guess.
So, when you see this right here, the service column right here is a guess. It's guessing based on this is like the default port for SSH. This is the default port for SMTP. It's making those guesses.
But the version column that we see right here, this is actually done with that connection being established and then the headers are being pulled so that it can figure out that this is dovecot pop 3D for example. You know what I mean? So you it's a combination of the two. However, again just keep in mind anytime that you do this when you do the SV element of this it's going to establish a connection.
So many end mapap options require root privileges. Unless you're running end mapap as root, you need to use pseudo. And we're going to start the actual version m. I already started it.
So I think it's ready and up and running to go. Same thing with the attack box. I think it's ready to go. So what we're going to do start doing is just doing some version scanning of the target machine that we have here, which is 1010 18662.
So, I'm just going to copy this and the rest of it I want to type because I really do want to get this in my fingertips and really get a good understanding of how these commands actually go. So, I like typing most of them out and I know that you can copy it and just paste it. I understand all of that, but I just like typing it out. So, which service did not have a version detected with version light?
So, that's another question that we're going to get based on running this scan. So, we're going to go ahead and do our split screen here so that we can maximize this view and then we'll have a full screen version of the attack box and then we can open up the terminal and run that scan. So, just as a reminder, let me see what the command is supposed to be. Uh, end mapap sv and then we're going to do version light and then we're going to do the IP address.
So, here we go. Let's do this. I'm so excited about this. I love running anything on the command line because it makes me feel like I'm an actual hacker, which I am, by the way.
At this point in my career, I feel like I've learned enough to be like a decent pen tester. So, end map. And we're going to do SV like that and then version light like that. And see, I also have a mechanical keyboard.
So, it just makes it really fun to type these things. So, there we go. Now, it's running. And I think it'll take a little bit of time.
or maybe it just might be quick depending on what the the response would be. There's also other ways that we can make this a little bit faster for oursel by maybe uh shortening the number of scans that it does. So, by default, it'll scan the top 1,000 ports. As you can see right here, 992 were closed, meaning that we actually have eight ports that have shown up here.
And one of them is missing the version, which is RPC bind. So, that's what we get. Now, what it says right here is what is the detected version of 143? And it's Dovecot IMAP D is what it says.
So, we're going to type that piece out. Dovecot IMAP D. And then RPC bind was the one that did not have a version detected. Excellent.
So, let's talk about OS detection and using trace route. OS detection will be done with the capital O. So this is an uppercase O as in OS. That's the way that you can remember it.
Service or service version is the SV. These are the ways that I try to remember these various scan types. So uppercase O would be for OS and they actually combined it with the stealth scan. So that did work for them.
Uh NAPAP detected the OS to be Linux 3 something and then it guessed further that it was running kernel 3.13. So this is what we can see right here. So, it ran everything and then we get the versions of this or actually it's not where is it? I think it's towards the bottom.
Yeah, there we go. So, towards the bottom we see that it's running Linux 3 something and then the OSD details Linux 3.13 kernel 3.13 is what it guessed right. So, the system that we scanned and attempted to detect the OS version is running kernel version 316 and Map was able to make a close guess in this case. And in another case, we scanned a Fedora Linux system with kernel 51314.
However, NAP detected it as Linux 2.6x. The good news is that NAPAP detected the OS correctly. So, it is Linux, right? The not so good news is that the kernel version was wrong.
And this is what I mean when I say that you really want to do indepth reconnaissance because if it's actually running 3.16, there's a good likelihood that it has all of the errors that were patched after 3.13. Right? So 3.13 is older than 3.16 and there is what three or four I think three versions at the very least because 14 15 and 16 right so three versions that came after 313 and all of those versions had something that was updated including maybe some vulnerabilities were patched and so if you're basing your entire research based on this output right here and then you go and you try to find vulnerabilities that match 3.13 and then you're trying to run all these exploits that are attacking a 3.3 3 version of Linux and you come up short, it's because you didn't fully figure out that it was actually running 3.16 and now you're wasting your time and energy and then you have to go do more research, etc., etc. So, this is why we want to do full reconnaissance, right?
So, it's good to know that it's Linux. It's not so good to know that the kernel version is completely off, right? OS detection is very convenient, but many factors might affect the accuracy. First and foremost, NAPAP needs to find at least one open and one closed port on the target to make a reliable guess.
It is still a guess, but it's I guess as close to reliable as possible. The OS fingerprints might get distorted due to the rising use of virtualization and similar technologies. Therefore, always take the OS version with a grain of salt. Then we have trace route.
So, if you want to find the routers between you and the target, you can just do trace route. And in this example that we're going to see at the bottom right here, we appended trace route as the scan results and end mapap trace route works slightly different than the actual trace route command by itself or trace RT which is on Windows. So trace route is on Linux and Mac because they're based off of Unix and then trace RT is available for Microsoft Windows. So trace route starts with a packet of low TTL time to live and then it keeps increasing until it reaches the target.
NMAP's trace route starts with a packet of high TTL and then decreases it. So we did in this example end mapap SS so stealth scan we appended trace route to it and we can see that there are no routers or hops between the two as they are connected directly right so where do we see that trace route there we go there was there was one hop and it went from the the starting machine to the target machine right so one IP address one in the middle and that's basically it many routers are configured not to send ICMP time to live exceeded which would prevent us from discovering their IP address for more information. We can look at active reconnaissance which already has been done. So if you haven't seen the active reconnaissance video inside of Junior Pentester, I would recommend you go check that out because active reconnaissance we talked about trace route and we looked at different examples of running trace route to find the number of hops that a packet will take or a connection trying to get established will take.
And it's always random. It's never going to be the same exact number of hops. Even though in that specific exercise when we ran it, it did give us the same number of hops, but usually it's not going to show you the same number of hops with the same routers that it took or the same paths that it took. It's typically going to give you a bunch of different IP addresses every single time that you run it, but that's for a different room.
So, if you have not seen active reconnaissance, go check that out as well. So, now we're going to do end mapap with the O option against the target which we had right here. So, I'll copy that again. And so again, we're just going to go over here.
And as a good practice, I always keep saying this, but for whatever reason, I forget to do it. And when I do it, actually on my own exercises, I promise you I do do this. So end mapap O. And then it said do it with trace route.
No, we're just doing O. And so we're going to paste this piece right here, right? And then this is what I always say, just do V at the very end just to get some verbose output. So it shows you as it's finding them.
See, it says it discovered these and it it's going to do the rest of the stuff as well. And then it's going to generate the final report for you. And you see how that it's now finding all that stuff. Look, it found all these other information, the TCP IP fingerprint and the various OSS that it tried to detect or guess.
And all of this stuff is showing to us because we actually did that -V for the verbose output so that we can get some detailed output. Right? So now we have all these various OS versions. This is the uh the full report that we have right here.
So what's it's asking what what's the question here? It says what OS did end MAPAP detect and the operating system. No exact matches if you know what's running TCP IP fingerprint OS scan etc etc. Let's see what it guess the the guess.
What's the guess? Where is it at? So I did run it again without the -v just in case it would try to find some kind of response for us. But it still said the same thing, right?
So, it said no exact OS matches were found, but if you know what's running, you can just search for it on the actual or you can submit it to the nmap.org website. But over here, if we just go through the information that we get right here, we can see that it says PC Linux GNU. So, we can detect that it's potentially Linux cuz there's a lot of information that's over here. But through all of this jargon, we can detect that there is Linux right there.
So, I'm going to just go ahead and type out Linux. And there you go. That's the actual answer. So whether or not you do -v, it seems to be that it'll still give you the same exact output and it's up to you to try to find whatever the response might be in this uh guess that it's making because no exact match was found, but it did make its best guess.
So let's now talk about all of the scripts that come inside of the end map scripting engine, which is actually really freaking useful. It's really awesome. So, in case you don't already know, a script is essentially a piece of code that doesn't need to be compiled. It remains in its original human readable form and doesn't need to be converted into machine language uh or assembled is another way to talk about it.
So, many programs provide additional functionality via scripts. Scripts make it possible to add custom functionality that did not exist via the built-in commands. N MAPAP provides support for scripts using the Lua language and the NM MAP scripting engine is a Lua interpreter that allows NAP to execute N mapap scripts written in Lua. We don't need to know Lua to actually make use of these scripts.
We just need to know how to refer to the N mapap scripts that actually exist. Now when you go to the end MAPAP installation folder, it's in our particular case, it's inside of this location. So it's basically wherever end mapap is installed. If you find that specific portion in your file system, there's inside of this folder, there's going to be a scripts folder.
And inside of the scripts folder, you'll be able to find a bunch of scripts that are in here. So, these are some of the scripts, right? And there is one in particular that I'm actually really, really interested in, and I believe it is called the VULN. There we go.
So, there we go. So you have the VULN and then it shows all these different CVEEs that it can potentially scan for which is actually very freaking interesting. So it'll try to go for all of those. If you specifically use each one of these, it'll go for those.
But there is another one that actually just goes for all of the vulnerabilities. And I'm trying to find that one in particular because I think it's like HTTP vault in general or whatever that is. So, I will go ahead and try to find it for you. I might have to Google it, but let's see.
Let's see. Let's just go and ask Gemini real quick. Okay. So, it's actually just script vone.
So, script vuln and it'll scan for any and all vulnerabilities that it can potentially find. it is a good idea or I think it's like a requirement to do the SV option here as well because it enables service and version detection and many vulnerability scripts rely knowing on the service and version to accurately check for vulnerabilities and then you just do that combined with the script vone option and it will do what it's supposed to do. So that's what it is but I mean as you can see right here there are very many other scripts that exist here as well. So you can specify to use any or a group of these install scripts.
Moreover, you can install other user scripts and use them for your own scans or you could just have Gemini write one for you. You know what I mean? Or Grock or GPT, whatever your favorite AI is. So we're going to go through some of the default scripts and you could do script default and it'll just use the default scripts or just doing the dash s lowercase S uppercase C.
In addition to the default categories, there is authentication, broadcast, brute force, default, discovery, DOS, which is denial of service, exploit, external fuzzer, intrusive malware, safe version, and vone. There we go. A brief description is shown right here. So, O was look for authentication related scripts, broadcast with discover hosts by sending broadcast messages.
Brute performs brute force password auditing against login. This is actually very handy right here. Default scripts named as uh lowercase s uppercase C. Discovery retrieves accessible information like the database tables and DNS names.
DOSS is for uh servers that are uh vulnerable to denial of service. Uh exploit attempts to exploit various vulnerable services. Uh external checks using a third-party service like Geo Plugin and Virus Total to try to find vulnerabilities. Fuzzer launches f uh fuzzing attacks.
intrusive scripts such as brute force attacks and exploitation. Malware scans for back doors. Safe. What?
What did I just do? I just clicked tab and it brought me all the way to the top or bottom. Where am I? I don't even know where I am now.
There we go. Okay. Safe scripts that won't crash the target, retrieve service versions, and of course checks for vulnerabilities or exploit vulnerable services. So, some of these scripts belong to more than one category.
Moreover, some scripts launch brute force attacks against services while others launch denial of service attacks and exploit systems. It's crucial to be careful when selecting these things if you don't want to crash services or exploit them. So, we can use end mapap to run a sin scan against the target and execute the default scripts. And the command is this right here where SC would be the default scripts.
Uh there are some details that will appear and we can even get all four public keys related to the running server which is very useful as you move towards your exploitation phase. And another example potentially could be that the HTTP service at port 80 and map retrieve the default page title. And this is it gives you a much larger response when you use any of the scripts than if you were just doing a normal scan. So for example, this is all the data that came from port 22, right?
And then port 25, this is all the data. And then port 80, this is the data. And then etc, etc. For each port, it gives you more information than previously uh ran scans that we've done so far.
So just based on what we've done so far, if we look at this right here, for example, this is it, right? So these are all the ports that were available here. But you can see that it's just giving us this basic information. And then when we look at the vulnerability output or the the default script scan that was done, it was giving us a lot more information.
So you can specify the script name by using script and then giving the script name or doing something like script and then doing something like FTP and then an asterisk which would include FTP brute. Essentially the asterisk is the wildcard character and it'll get replaced with anything that has FTP in it. Uh if you're unsure what it does, you can open the script file with a text reader like less on the command line or just a text editor. And in the case of FTP brute, it says that it states that it performs brute force password auditing against FTP servers.
And you got to be careful as some scripts are pretty intrusive. So if you're trying to be uh if you're trying to avoid detection, you may not want to use something that has brute in it because it's going to try to brute force something. So you definitely want to avoid those things if you're trying to avoid being detected. Some scripts might be specific server and if I chose a random, it'll waste your time with no benefit, which again goes back to doing really good reconnaissance so that you only use the things that are relevant to you.
So if we do HTTP date, it would retrieve the server date and time and it's confirmed in the description, right? So it gets the date from HTTP like services. Also, it prints how much time or how much the date differs from the local time. So, we would do this as the full script or the full command to run the HTTP date script.
And so, we would run it and then it says HTTP date Friday yada yada yada 0 seconds from local time. So, it's assuming that it's basically running on the same time that this person was when they were running it. So you might expand the functionality beyond the official script and you can write your own script or download scripts from GitHub for example. Downloading and using an end mapap script from the internet holds a certain level of risk because it could potentially be embedded with malware.
So if you're going to do this then paste it inside of uh Gemini or Grock or GPT and be like hey is there any malware in this? Is there anything inside of the script that I need to worry about so that you know it doesn't mess up my network or my computer or anything like that? So let's see what the question is. It says knowing that the scripts are saved in end mapap scripts what does the script HTTP robots check for?
So we can go ahead right here and essentially we can just append it to the end of this and we can just do less for example and then put this at the end of that. So it's http robots.txt. So I can go right here and do something like excuse me sorry about that. Uh so we can do something like you know um less and then we would give it the full path right and then at the end of that we would do http robots.txt and it says there's no such file directory.
So what's the http robots.txt that's what it's supposed to be. So okay why don't we do this then? We're going to CD to that location. And let's see if we can actually find that script.
http robots.txt and and and is it here? Ah, see I see. So it says nse at the end of it. So that's the piece that we were missing.
So http robots.txt.n is what we need to do. And there it is. now tells us what it potentially can do. So, it checks for disallowed entries in the robots txt on a web server.
And that I think is the description that we're really interested in. Oh, if I scroll up, it won't work. So, what if I click up? Click up doesn't work either.
So, okay. So, sorry about that. I know that noise when in the recording is a little bit more annoying than it is. So, it checks for disallowed entries.
So, it checks for disallowed entries. Can you figure out the name for the script that checks for the remote code execution vulnerability? This piece right here. So, we already can do that.
So, I'm going to escape out of this. Right. Can I escape out of that or control C? How do I escape out of this?
That's so annoying. Okay, quit. So, Q for quit. That's the one that you would do to escape out of that.
Now we're looking for the CVE 2015 1635. So that's the piece that we're looking for. Now what I can do is this. I can do ls and then gp it to uh what is it?
CVE, right? CVE 2015 1635. So we'll do it like this. CVE 1635.
And okay, maybe that's not it. Okay, I had to try a few different tactics. So grip by itself obviously doesn't work. I forgot my own teachings with Linux.
So I feel I feel a little bit ashamed of that. But it took me a few different tries to try to figure out what I was trying to do here. So all of these things are in lowercase. So when you do GP without applying a case insensitivity, then it'll search for the actual capitalized version or whatever it is.
It'll try to search for it literally. So when you do ls la and then you grab for something if you want it to be in caps lock or if you don't know if it's in caps lock you can do case insensitive by doing dash i. And then the other element of it is making sure that you have the uh the preceding and succeeding um asterisks to account for anything that might come before or after your keyphrase. So in this particular case there we go.
So we have it. So it's HTTP vone 2015 yada yada yada. That's the piece that we are looking for. So we should just paste that and that's the answer.
Excellent. Okay. So now we're going to go through this after you ensure that you've terminated the VM from the task two. So is there another one that's over here?
I guess there's another virtual machine that's inside of this one, huh? So after we've terminated that, we need to go ahead. Yeah, there's another machine here. So I'm going to terminate this one.
I'm going to launch the new one that's inside of this specific task. And then we're going to run this scan at the bottom right here, which is the the uh default script scan. So when we run it, it says you'll notice that there is a service listening on port 53. What is the full version value of that service?
So let us I'm going to wait for the the machine to launch and then we'll go ahead and run it. All right, cool. Now we have the IP address assigned to us. So we're going to go ahead and copy this piece and we're going to do a default scan.
Right. So let's go ahead and see what we can do here. Um I'm just going to stay in the current folder that I'm in. I'm just going to clear the screen just to make it a little bit easier for us.
So we're going to do N mapap and we'll do SV and SC and then we're going to paste the response here. and let's see what we can learn about this IP address. And the question specifically that we're answering here is there's a service listening on port 53 which is the DNS port. So what's the full version of the DNS port which would be responding to us.
Now interestingly enough I only get port 111 open. So that's interesting. So let's do SC just by itself and let's see what that does here. Maybe I shouldn't have done SV.
Okay. And it's still only giving me this one port. So now what we're going to do is we're going to give it the specific port of 53. 53.
53. And then we're going to do SC and give it the IP address. Let's see if it get gets anything for port 53. So this is what's really interesting, right?
So when I ran it just by itself, it only showed me port 111 being open. And then when I ran it specifically against port 53, it pulled some information about port 53. And so the bind version is right here. And this, I believe, is what they're looking for for us.
It's so weird that it didn't show that when we just ran the default scan by itself. So there we go. That should be the answer right there. Based on the description, descript SSH2 enum algos reports the number of algorithms for encryption, compression and etc.
that the target SSH2 server offers. What is the name of the server host key algorithm that relies on Shaw 512 and is supported by this? The name of the server host key algorithm. So let's go ahead and run it on what is it?
It's on port 22. So it would be SSH2 I would assume. So now we're going to do the same thing here. I'm just going to do the port 22 scan and we'll do this.
And actually so maybe not even that. I think we should be doing SSH enum algos. So that's what we should be doing. So instead of doing the default, we're going to do the script.
So actually I'm going to do d-cript and then that equals to uh ssa come on equals to ssh enum algos. Let's see if that's what it is and fail to initiate. Let's see um I think my syntax is incorrect or ssh enum algos. My syntax was incorrect.
It needs to be yeah script and then like that. So we'll try it again and it needs to be SSH2 enum algos. So one more time end map. This is the this is the one right here.
Script. And then we'll do SSH2 enum algos in quotes. And then we'll give it the Oh, I didn't give it the the I didn't give it the IP address. That's probably why it didn't work last time.
So 1010 1641 134. And there we go. Boom. Look at that.
A good amount of information. Now, we're looking for the response to which one? Shaw 512. The algorithm that runs Shaw 512 and is supported by that.
So, if I come here, it's RSA Shaw 512. I think that might be the one. So, we'll just copy that for now. Let's see if there's anything else that has to do with Shaw 512.
The Algo server host key algorithm. I think that's the one that we're looking for. And there's nothing else that would be relevant to that. So we'll paste that.
Is that the answer? That is indeed the answer. And so we have another one now that there's going to have its own virtual machine. So we're going to terminate the old one and we're going to launch the new one and we're going to read through this and by the time that we're done reading it, the new machine should be up and running and then we can just run the scan.
So let's talk about saving the output. So, whenever we run a scan, it's only reasonable to save the results in a file. And there are a few different ways that you can do this. And one of my recommendations always is to append the results to a scan file instead of overwriting them or instead of creating multiple files.
Uh that way you can have one comprehensive file and uh save a bunch of different outputs for the same target. Right? So this is assuming that you're running it against one target. If you're running it against multiple targets, then in that case, you would want to save them in separate files.
But if you're running a variety of different scans against the same target, you want to append your results. And then I'll show you how to do that as well. So when you save the results, there are a few different formats that you can uh gra uh grab, right? You can extrapolate or kind of expand upon.
So selecting and adopting the naming convention is also crucial to make it simple for you and the number of files can go. So your ability to be able to find a previous scan will end up being very difficult. So again you want to append them. So normal greable meaning being able to g it or search through it.
And then there's the XML version. And the fourth one that we would not recommend would be the script kitty, which if you know what that is, it's basically people who copy scripts from or copy malware and things like that from across the internet and use it for their own. But if you're using scripts or malware or anything that's been pre-established, exploits that have been pre-established, there's a really good chance that it already exists inside of the database for an IDS and it can detect the signatures for that. So when you run it, you'll automatically be blocked and it doesn't work very well.
It it just it hinders your process. So it'll block your IP address. They'll block your MAC address most likely and maybe your even your subnet or whatever. So you want to stay off the radar as much as possible.
And if you use a script kitty format there, there's a very high likelihood that there's going to be some kind of signature, some kind of file signature that's going to show up and it's going to block your scan and even get you blacklisted. So, as the name implies for the normal output, it's basically very similar to what you would get onto the screen, right? So, the machine IP scan.nmap, this is the first output that we're looking at, and this is what it looks like, right? So this is the file that was saved and so it just looks normally like what it would if you were just running end mapap into your terminal.
Gpable is what you can search through. It comes from the global regular expression printer and it makes filtering the scan output for specific keywords easier. So you can ska save it in grippable format using the og lowercase O uppercase G and then giving it the file name and it would save it in a grippable format. If you just did - O by itself, it would save it in the output, which would be a normal output.
And the normal output is 21 lines. However, GPable output is only four lines. And the main reason is that Nap wants to make each line meaningful and complete when the user applies GP. As a result, in greable output, the lines are long and are not convenient to read compared to normal output.
So, you can see these are the four lines that we have. And if we scan to the side right here, we'll get a bunch of stuff. So all the ports, port 80, all of these things are now on the same line. So if you were to search for 110 for example, it would bring you this entire chunk, which is actually handy.
It's very useful to you. But when you're just reading through it by using cat, it's not very very user friendly. It's not human readable friendly. So if you were to GP for the keyword inside of the text file, it'll display all the lines containing that provided keyword.
So if we take the output of grip on normal output and the grippable format you'll notice that the former does not provide the IP address of the host instead it just returns this piece making it very inconvenient and however the ladder provides enough information so this is the former and this is the normal output and then when you do the greable format you can see that it gives you the host the ports etc etc so it gives you everything uh including that IP address and this one just gives you the line with the the port on it. So it again it's not it's not user friendly when you are reading through it manually but when you want to gp through it and search through it it becomes very handy when you use the greable format. XML is very similar to HTML. So you can do o x lowercase o capital x and it would be the most convenient to process the output in other programs.
So if you want to actually load it into something else. XML is very organized, so it can be read very it can be read easier than if it was just a normal or greable output. So you can save the scan output in all three formats by doing O A and then it'll create one in normal, grapable and the XML format. And then the script kitty is useless if you want to search the output for any interesting keywords or keep the results for future reference.
But you can always save it for that if you just do O S, right? Cap uh lowercase O capital S. And this is what it kind of looks like I guess, right? So the script kitty like host is up is now turned into this weird thing.
Not shown is it's all very weird. Like the the formatting of this is very weird. And I think it's even irrelevant in the concept of a script kitty detection. I I thought that it would be formatted in a way that maybe it would make it hard for us to use this somehow or maybe that the scan that we're doing would show up in the detection, but it has nothing to do with that.
It's just this weird formatting in the syntax that makes it I guess you can read it, but if you were to try to search for service without actually typing it like this, then you wouldn't be able to find anything for the service. So, okay, whatever. Um so now uh in the previous task we terminated it on the attackbox terminal issue the command secure copy and we're going to take it and we're going to take everything from the home pen tester and we're going to save it to our local drive and we're going to download the end mapap reports in normal and grippable formats from the target machine and the username pentester has the password thm17577 which is what you would need to do to copy anything and we're going to check the logs how many systems are listening on the http PS port. So, this is going to be an interesting little exercise here.
So, first and foremost, we're just going to save this. So, I'm just going to copy this right here just to make our lives a little bit easier. And I know I'm contradicting what I said previously. And I want to come out of where I am right now.
So, I'm going to go to the uh roots. And then from roots, we're going to go to actually we're going to go to this location because that's our root users location. And then we'll go to the desktop and in the desktop is where we'll save it. So we're going to do this piece right here.
Enter. And yes is fine. And THM, what was it? THM17577.
There you go. And there you go. So it saved these for us. Okay, great.
So now check the logs. How many systems are listening on HTTPS? So we're going to do this. We're going to do cat and we're going to do the greable format.
So I'll do scan 172. Oh, whoops. 17217 network and then GN map if I can spell right. And we're going to scan for HTTPS.
And nothing came out of that. So I'll do the same thing. And I'll do case insensitive and scan for that. There we go.
So what do we have? We have um host one right here has HTTPS. Host two has HTTPS. And host three has HTTPS.
We have the IP addresses and they all have HTTPS. So I'm going to say three would be our answer. Great. What is the IP address of the system listening of port 8089?
So we'll do the same exact thing. And now instead of doing that, we'll do 8089. And the IP address, there's only one machine that's actually listening on it. And this is that machine.
So we'll copy that and go over here, paste that. There we go. Officially, we have gotten all of the answers. Hopefully that was not too crazy.
Hopefully you understood what I just did right here. It's basically a very simple cat uh command and then we just grapped case insensitive to just make sure that you can search for whatever you want. And on the first one, I searched for HTTPS. On the second one, I searched for 8089, which is the port that they were asking for.
And just like that, my dear friend, we have finished all of the questions for this one. I was in a little bit of a rush as I was doing this recording, so I apologize. cuz I was kind of reading really fast and I was talking really fast. So hopefully that didn't bug you and you were still able to keep up with me.
All right, so in summary, we have gone through a variety of different options here. So we did the SV for version scanning and let me see if I can zoom in on this so it's easy. There we go. So SV to ver uh get the service and version and then you have version light that tries the most likely probes.
Version all tries all of them. You can also do version zero or version five or version 9 something like that. Capital O was detecting of the OS. Trace route runs the trace route to the target script and then the name of the script will actually choose the script script to run for you.
Whichever script you assign right here in the placeholder right there. The lowercase S uppercase C will run the default script. Uh capital A, we didn't really talk about this, but this will run everything. So, it's going to run all of these elements for you.
It'll run the service, the operating system, and the default script for you. And this is going to take a while, by the way, because you're doing essentially four activities for each port and each IP address, assuming that you assign a subnet to be scanned. Uh, O N will output it into normal, og will output it to greable, ox will output in XML, and O A will save them in all of those formats. And that's pretty much it for our postcanning.
And this is a tool that takes a lot of practice to get used to and to become friendly with. So it's not something that you can learn in just a quick series of videos. And my recommendation is get it downloaded or get access to one of the free attack boxes on Try Hackme because they have a bunch of free rooms that have access to the attack box and that attack box will have end mapap installed on it. So go nuts, right?
Practice. Go look at the manual for end mapap and look at all of the various options that it has. Read through them. Go read through some of the scripts that are available, the things that might be most interesting to you and just try to get that information in your system in your mind at the very least just so you understand.
Oh, you know what? I think I remember that I read something about this one type of script that was available in N map. Let me go check the list of all of the scripts, right? So, that's kind of what you want to do.
At the very least, expose yourself to the information so that when the situation when the the opportunity presents itself, you will know what is available to you and then you can go specifically to find that for yourself. But apart from that, that was it for this one. This is probably the shortest one that we've done in the end map series of videos, and I hope that it was actually valuable to you. If you did indeed find value in this video and you want to get more videos like this one, I do encourage you to like, subscribe, and turn on the notification bell so that you get notified the next time that a video comes out on the channel.
And feel free to browse through the rest of the videos that are on the channel. There's a lot of great stuff that's available. We obviously have the completed playlist and we have the playlist that are being worked on right now. So, for example, comopentes plus is actually being worked on right now.
Network Plus is already done. This is exclusive to hackolics anonymous. We have security plus already done. We have Linux plus already done and I have a bunch of other ones as well.
For example, security engineering compilations, uh, sock level 2, uh, SCIC hacking case studies, cyber security 101. This is a really, really big one. If you haven't gone through this, I highly, highly recommend it because it'll fill in a lot of the gaps in your foundation and in your basics. And once you finished SCIC 101, then you can choose if you want to go into defensive security or offensive security.
And in defensive security, you would go through sock level one, sock level two, security engineer. In offensive security, you would come back to the junior pentester and then go complete comtio pentest plus etc etc. And there's a lot of great content that's available here and there's a lot of standalone videos as well. So if you actually come over here to the search box and just search for Python for example, there's a lot of cool videos on here.
Building algorithms for cyber security. This is actually one of the more popular videos that are on this channel and it takes you from the very basics of Python, how to install it, how to get your first IDE, how to write your first program and then it builds you all the way up to learning how to write algorithms in Python for cyber security and it's a really really good video. I've gotten a lot of great feedback from it and it's very handy. It's very useful for a lot of people.
So, I encourage you to explore the videos that are available on this channel and expand your skill set as much as you possibly can to prepare yourself for the more advanced pen testing and everything else that we're going to be doing. So, that is pretty much it. If you have any comments about what we talked about today, make sure you drop them in the comment section below. If you have any questions, drop it in the comment section below.
And of course, like, subscribe, and turn on notification bell so that you get notified the next time that a video comes out on this channel. If you're serious about your SCIC education and you want access to me on Discord, consider joining Hackaholics Anonymous. We have four tiers. The supporter, agent, guardian, and master.
Each tier gets their own Discord server, and early access to content. The agent, guardian, and master levels get exclusive content, exclusive downloads, monthly Python automations, live streams with me every month, plus so much more. And to join, you can simply click the link in the description below, or you can go to our homepage and click the join button there, or you can go to youtube.com/hankhackshackers/join, and you'll be able to join hackix anonymous. I hope I see you in the Discord chats.
If not, I hope I see you in the comment section. It's your boy Hank Hackerson at Hank Hackshackers, your favorite network and system attacker/protector. If no one else loves you, Hank loves you. Love, peace, and chicken grease.
