In this video we are going to take a deep dive into understanding
Banner grabbing and the enumeration techniques
are the commonly used by cyber security professionals. So
let's dive on in
What exactly is monographing to put simply paragraphing
is a technique that's commonly used
by boot tread actors and cybersecurity professionals
to collect information about a
host on a network. This information can
help us. See two men. If there are any sort of open ports
and the associated running Seuss's for
these open ports. Furthermore para
grabbing also helps us to determine the service
version that is running the services. For example,
let's see this port
22 upon. Well 42 is
a su seated with SSH secure shell. However,
there must be a suited service that
is running in the background on the horse operating system
that will open the port and this is where Barney grabbing.
Cut and this is where bana grabbing will help
us on also try doctors use
technique as well to determine what is associated
service and that service region. If it
is that we are able to get the source Vision we can
simply perform additional research on Google or whatever.
Your favorite search engine is to determine
any sort of security flows with
that particular service and if there are
any sort of known exploits
Additionally, there's enumeration enumeration is
simply the technique used by boot again hackers
and cyber Security Professionals to collect
information on a Target system
specifically on how to access a
system on whether there are any sort of resources stored
on our Target system.
Furthermore animation helps us to collect username passwords
open civil Sports and even
lists of any files that are stored on
any network shades.
I hope you're excited. So let's dive in into some practical
examples.
So now that we are on our cardi longx machine, please ensure you
boot up the metasploitable tree Windows Virtual
Machine.
As shown on my virtualbox manager, the metasploitable
tree Windows Virtual Machine
is actually running in the background.
So to get started, let's open up our terminal.
And I will increase my font size.
And now let's actually perform well before
I perform a network scan. Let's check
our IP address of our Kali long switch on
machine.
And currently the IP address of my machine. It is
172 TT 1 to
36. So let's copy this.
Great. So, you know the IP address of all machine Let's
perform a network sweep or
pretty much a pink scan of the entire network to
do so we can type and map Dash SN this
will specify the ping scan
pretty much and we specified in
network ID with a subnet mask. And of course,
we will exclude our IP address
or for Kali lungs machine like so and press enter this count
should just take a few seconds to complete and look
it's already completed. We have one who's available
and this one who's is on a
pen test Network, which is the metasploitable tree
Windows Virtual Machine.
So we are going to use this device as
our Target. Well that particular IP. So I'm
just going to copy once more again. We'll clear this
and let's do end map space -
S capital V
like so
and dash SV will specify to
perform service Vision enumeration or
Banner grabbing to put simply we'll do
Dash S capital T to do a tsp connect scan
then we will Dash capital E to actually
perform operating system are
enumeration. It will also perform service
enumeration and it
will also perform basic SMB scanning on
the Target and now we will specify the IP
address of Target like so
just to be honesty side. Let's type sudo.
So that this command will execute.
With administrative privileges good enter
going to enter my password for
cardioxide. So
and this should take a few minutes to complete. So
I'm going to pause the video and I will resume when this
is completed.
After a few minutes, the scan was completed currently we
can see that there's a lot of information that was
provided on the screen. For instance this
sport 22 upon. It's a TCB Port the
state of course is open the Service
Associated report 22 is fdp. However,
we have another column which is called
version. The service position that is providing that
service has causing the port open. For
instance. Again, we can see open as a
Siege 7.1 is being used to run the
SSE silver on our Target.
We can simply copy this information like so head over
to Google on all friendly web browser.
You can simply piece in the information and type
vulnerability.
And we can see that there is a cve details
if I open this.
We just simply need to reach through each
of these CV IDs that associated with open associate
7.1.
For instance, we can see an overall view such as the
cvid the type
of security flow the date publish this
severe he scored as well. Some of
these are so on point eight, which is really really
high. There's 5.0 4.6 and
even 4.0 as well. Let's say
we click one of these on
Once you click on one of these CV IDs
we can get some information about what is a
security flow on the system. We can even see our
additional details about why it
had a security well is vulnerability
score of 7.8 and
the type of weaknesses found.
the types of affected systems
that is related to this security vulnerability.
Additionally, you could head over to Google
Eyelash change vulnerability to exploit now
if we scroll down just a
little bit further. We'll see that there is a URL that
is associated with exploit DB to exploit
d2bees.
On exploit database we can see again.
There's a CV idea sociated with
it and the author of this particular exploit.
We can even download exploit.
Furthermore we can see the actual code that
was written by the author.
It's pretty good to actually read a code because you can simply
use one of these exploits. Try it on a
test environment or even modify the code and also try
it with any test environment before testing
this on a relive system.
Of course. Ethically speaking.
If you screw along some more will see the
specific version of the operating system.
Simply because Sports 135 139 445
implies. This is
most likely a Windows operating system as providing
file and print sharing the cool
thing is because we did the dash SV parameter
and map was able to enumerate a
service that was opening Port 445. However,
we are actually got a
Target operating system, which is Windows serial,
2008 R2 standard Bill
7601 that is
running silver spark version 1 which
is pretty amazing.
Let's scroll all the way down.
to write
about here Wait says who script
results
For instance, we can see it performs some
various SMB script scanning a determine the
security level for any sort of user accounts,
but most importantly it didn't smbos Discovery
automatically for us.
It identified it was running windowsilla 2019
R2 standard. They provided
a service solution for us on the series spark, which
is pretty cool full. We also was able to
enumerate a computer name.
All devices has a device name or sometime
you might call to say whose name.
It was able to enumerate a net bios
name and determine what it was connected to a
domain or it was simply on the regular work
group.
So great. Now, let's take a look at something called
it and Maps scripting engine.
What if we wanted to scan the specific
host, but determine the actual let's
say operating system.
We can specify the IP address of all target
like so which is 192.
Actually, it's 172 tt1
TT. You can type dash
dash script like so.
Next we can put an equal sign. Let's see
we want to discover the operating system. You
can see SMB Dash OS -
Discovery like so
And now we can simply hit enter.
This research should take a few seconds there on
as you can see and even do its scan and
tools all open ports or the top
1000 open ports. We also
was able to see the results of the smbos
discovery script which is specifically what
we need to know which is operating system. One
of the cool things we can do is we can
use the end map scripting engine simply because
end map contains a lot of scripts to discover various
things such as what a
host is vulnerable to a particular exploit.
During the course of this video. We look at performing some
practical examples in Banner grabbing and enumerating Suite
student services and fun
fact, we actually saw a security vulnerability on
our Target system, which will actually look at
exploiting at a later video.
In the next video, we'll look at some hands on network
scanning using their map tool. I hope this video has
been informative for you and thank you for viewing.