Hi and welcome back to Deep dive
into, not sotus s months by easy console. This
is section for advanced network
security techniques. In this
video will take a look up fingerprinting suva's. So,
let's iPhone in by fingerprinting
services, will be able to understand
the underlying Technologies such as web Technologies
on Swap tahitians, which are running
on a web server to get a better idea. Let's start
up or Kali Linux machine. Like so
I will just log in
I know that we are within all Cardinals machine or
the first things you want to do is open or to melt like
this. And let me ask me. It's
a little bigger for you to see properly.
Let's check the seawater, all network adapters
on our Network reach we can simply use
the IPA DDR command. Are we can
see there's a number of network adapters Associated to
this Kali Linux machine.
On this machine, we are currently using adapter ethernet, Zero
ice currently on this network. Now. My
IP address is. One or two. However,, Santa
Ana to 32 Meriwether, there's let's see
any web servers on our seem subject
to do this week and use and map
to could do sudo.
And mop lightest - pee
alot specify to Portrait
HTTP. Https specify Port,
80, 80 80.
On, let's use. Port 443.
Which is for each GPS. I'm you specify or
entire network range. So let's
change to Doug 0/24 on a
tender.
Will enter our password for Kali Linux
machine because we're using the sudo command.
This scam should take us
a few seconds. So probably a minute or two to complete it will
simply performance can on entire subnet and
look for any vices that has ottati. Dl443
that is open.
Once it finds us the song with these any of
these reports upon, it's an indication that there's a
web application or web server running on
DC for boats.
Toscana's completed a, let's take a
look at our results so you can see the ideas of that
one, but it will ignore that one. The one is simply ordered
a TV service will ignore that
one. Guess. 100. The
100 is 40/80. Address, 443
is also filled out as well. However, let's
take a look at that. One. One, one one has
42 1/4 for 3/4 +?
48, equals one or
two. I think it was all machine. Let me just double-check.
That's when i p. E, d, r, one small.
And yes, one or two is all machine so
I can screw up and therefore, our Target is
definitely want one. So if
we support it is open on.
Let's see targets such as 192 168
50611. We can
copy this address. We can open up a web browser like so.
We can enter IP address.
Unless specified HTTP colon slash
slash lie. Hit. Enter on, look. We
actually have a web page loaded to this
web page is a default web page for California, roll
machine, which is an awesome at this place a little too. And he
had a different vulnerable web applications, within metasploitable
2.
Another tool we could use our tax rate
then if I let see the underlying Technologies is
it to notice what web. So we could type what
web and then specify the IP address
of a Target? So the target being 192 168
50611. Let's press
enter on a 12 profile and
provide us with the technology such as a web
application on any sort of additional technologies that
is running on a Target. So this will
take a few seconds. So probably a minute or two to complete a
look at a very, very quickly. So,
we got an HTTP, two Hundred Oaks
theaters, which has excellent and me to citywell application
on your webpage is available. We can
see the target is ruining Apache specifically 2.2.8.
The country is
left out its Reserve at a web server.
As an H-E-B supervisor running on a u-bahn to
Lennox System again.
Have a Apache 2.2.8 Ubuntu.
It's using death
to we have the IP address. It's also running
PHP and I think that's
about it. So, it's Apache are Peach
be on a newborn to be
system to do, is, you
can use a mop on small. So, they use and mop. Capital
who likes with a
fake profile. Breathing system. Of the silver
is running the web application. So this
kind should take us a few minutes to
complete. So I'm just used to do it.
Answer on this will tell us the underlying application.
Sorry, the underlying operating system,
which is hosting the web application.
Okay, so just got to finish on this
town. Should be performing. And only entire system itself
looking on food. We can see where it
says oscp. It's a Lennox be
system. Apart from War, web is
telling us that it's a you going to storm here
just telling us to be system.
I'm not so we could use as within a web browser. We
can use it to such as Netcraft.
Net craft is actually website that we can.
Somebody Sue Turn Up For a flight suit. Let's click
on www.net. Kraft.com. Netcraft
has a
super awesome tool. If you scroll down what we
don't look for. Is this portion that says what's
that site running? We can simply
enter website. I saw you enter like www.microsoft.com like
to enter to
begin the search. I specify you are also,
let's do each DPS school and slash slash if
enter once more.
On what it will do. It would provide us
access Technologies service in network block and any
other relevant information for this to mean. She
currently is this is a result. So we can see
the site title, which I assume is Microsoft. We can
see the first date. It was ever seen a 2004
and me could see.
The network block information, who is hosting
the side of public, ipv4, addresses of public, ipv4,
addresses, Associated internet, service
providers, which is the highest numbers. We
can also see the to me and Rodger Shah information
to DNS information as well. We can
see the nether blocks. We used to
host has IP address. We can get a somewhat, a
specific Geographic locations of
all. We have the SSL, Auntie Alice information
on this web server and food.
Oh, you got a certificate information. It could
actually help us identify whether the Target website.
What is vulnerable to the poodle a Taco, hot
bleed and she got a Jose information. So
we could see who the who sing block owner, we can
get the IP address. We can see the operating system
with a silver witches, who sings Uber application, or the
website of applications hidden here, which is a good thing
to see the last fight scene. So this date
is very recent to today's our point
of recording. Cuz currently, we are in August 2021.
So, this is very,
very close to the present time of recording. So
that means it's a most likely. This is a current IP
address for the web server and food,
or we can see if there's any spfr which
is a personal policy framework and DeMark. I
saw the web trackers, but look at it. We even
have to cite technology so we can see the suicide
Technologies. I can see two clients I Technologies
and any sort of client side web scripting
Technologies.
In this video, you took
a look at understanding the importance of performance fingerprinting, as
it will help you on the stand on the line Technologies, which
is running on a remote server. Most importantly,
we took a look at the music and mop what
web on even using an online to such as
an aircraft to actually fingerprint a web server.
The next video will take a look at understanding the importance
of enumerated virtual host on websites.
I hope this will you have to inform to see you
and I will see you in the next one.