In this video you are going to get the hands-on experience
of Performing Network scanning use an end map.
So let's dive on in.
Network mapper who better known as endmap is
simply free network scanner that simply enables
cyber Security Professionals to discover live
systems owning Network scan for
open TCP ports and UDP ports perform
banana grabbing uneven series
enumeration.
Furthermore and my parts are capabilities of
detecting the host operating system and
even common security vulnerabilities online
host.
So don't forget you.
Let's start off by detecting life hosts
on a network.
For this exercise. We will need to pour on
three or four virtual machines. We need to pour on
our cardi Linux virtual machine the metasploitable to
Virtual Machine and even a metasploitable tree
virtual machine.
So let's pull on the two metasploitable machines
first so we can run these in the background.
But before we do, so let's ensure that each
virtual machine is connected to the right virtual
Network. Simply select metasploitable 2
VM click on settings, then simply
click on network and ensure it
is connected to the pen test Network and promiscuous
mode is set to allow all
Next let's check the network settings on metasloidable tree
the Windows Virtual Machine.
Let's click on settings.
Click on network and here you can see it's
also connected to the pen test Network.
We can start this virtual machines by simply clicking
a start button. However, let's run them
in the background to do so, simply click this little
icon here that points down
next to start button and simply select headless start.
This will simply run the virtual machine in
the background for us. So let's give this a few
seconds to boot up once it's booted. We
will then power on the metasploitable tree Windows VM.
Okay, great. Let's do the same for metasploitable
tree Windows VM. Simply select it
click this down.
menu, then select headlight start like
so
as you notice on a virtualbox manager, we
can see a preview of the desktop interface.
Okay, great. So the metasploitable tree virtual machine is
powered on now. Let's pull on our Kali Linux
virtual machine. Simply select Kali Linux
and click Start.
Ensure that you log on with your user credentials. The username
is Kali and the password that
you are set in the previous videos.
Okay, great.
So we are logged into our Kali Linux.
Which on machine?
Before we perform any network scans on a system.
It's highly recommended that you change or spoof your
Mac address simply to prevent your identity
from being revealed as in your devices Market
address to do this. Let's open a
terminal like so
And before we proceed further, let's check the number
of interfaces. We have and their Mac addresses. So
simply type I have config like so and press
enter.
As you can see, we have a few ethernet
interfaces. If you recall one of
the ethernet interface is connected to your physical Network.
That's this network interface.
Then we have another interface that is connected to all pen
test Network which is ethernet 2
and you can see that it has an IP address on the
pen test Network. And also there is
the MAC address now.
Let's say the Security Professionals were able to capture some
of the pockets that were leaving your system that will scanning
their assets. They can
simply use the MAC address and the two
men what type of system is on their Network. So to
spoof the market address. Let's follow these steps.
Firstly let's type sudo.
I have config like so
etch one because eth one is
connected to Penthouse Network and let's type down
simply enter your Kali Linux
password like so
and
we got back a new prompt. So let's type. I've conflict one
more time. And now you can see ethe21 is
no longer available simply because we have
logically shut down this interface and that's one
of the most important steps needed when
you're changing the MAC address on your system.
You need to know the interface.
Let's check to see what type of commands we could
use with Mark changer. Mark changer is
simply pre-installing Carly Linux and this
allows us to change our Mark address. So as
you can see we can view all current market
address. We could change it to another Market address. We
could round my super recess we can even select
from a list of particular types of devices, but
let's keep it simple. Let's use
a dash capital E parameter to set
a random Mac address of any kind.
So we can use sudo.
Mark changer
Dash capital e eth one
Here you can see the current market address.
The permanent Mark address and now we can
see the New randomized Market address.
Next let's type sudo.
I have config e the each and type
up like so and hit enter.
So at this point ethernet 1 should
be up unavailable with a new market address.
Let's check.
Let's do ifconfig and hit enter.
and look
The interface is now available and it
is using the new randomly generated Market address. Great.
Now that we have a new Mac address. Let's proceed
to actually scan our Network.
firstly
let's check the ifconfig once more and
we are already on the 172 TT
1.0 Network simply by the
class subnet mask. So let's assume that
there are live fools on this network. What can
we do? Well, there's a few tools that we could use but
we are sticking to enemap.
Would end up we can perform a port scan
we could perform a ping scan. We
could perform different types of scans. So let's use a
simple scan but before doing the scan.
Let me show you a few syntax that
you could use with end map on how to learn more stuff using MMA
we can type and map.
Let's type man then and map so
we can see the manual feature and map hit enter and
you get a full description of nmap.
Going on Twitter. We can see their various
syntax that you can use an examples
of the type of output that you will see.
Going on filter. We have a lot more different parameters that
we could use and most important thing is we
have so many different syntax or
what we might call switches to use it and
map.
The first thing that we are going to use is let's perform a ping
scan.
Some hosts only network will have the icmp
enabled by default. However, some Network
professionals aren't even systems administrators. Will
this evil icmp messages
from?
Being Santa Crossing into it and also preventing
the assets from responding to any ping messages.
But we are still going to do it to see what is the expected result
or what results that will get before. We
actually perform any network scans.
So let's do ifconfig one more time to get
our own IP address.
So during our Network scan we can
scan the entire IP subnet. However, we'll
also be scanning our own system. So let's
exclude our own device from the scan.
So I'm going to copy the IP address of
my device like so.
Let's do I have config?
Let's copy our IP address.
Just this one.
Now, let's specify it here.
So this command will do it will perform a ping scan
or the entire network, which is 254 IP
addresses to check received. There
are any devices online that are responding to icmp messages.
However, it is going to exclude our
system which is a Kali Linux system from the actual
scan.
Hit enter and we actually need two.
Specify the right words actually
made a typo when typing nmap.
So now the scan it should take us a few seconds the pops
a few minutes. Oh, look, it's actually finished quickly. So
currently we can see there are two devices online, which
is
172 Tut 1.37 and 17230
1.t.
So let's start scanning one device at
a time.
So now that we tuman that there
are two live systems next we can start proving
for any sort of silver Sports running services
and even operating systems.
So great. Let's check for any sort of
open ports on both systems. Let's Ivan.
So now that we're back on our Carly learns machine.
Let's type and map and let's specify.
One of the IP addresses Let's scan this
particular system. What is scan will do it will perform
a scan for the top 1000 most
commonly used ports and silver
Sports horny system.
That's it. Enter and sometimes scan will
happen very quickly.
So currently we can see there's a list
of open ports we can see it's TCB ports
the status as opan and the
associated service
Let's scan the next device
Let's press up and let's change this to IP address
of the another host. Let's hit enter.
So currently we can see this other hose
has less Sports open but looking at
it we seem to be able to identify some common
services for example, there's FTP. So
pop says a file server, there's
SSE is HTTP a
web server.
And look these ports provide some
type of indication that most likely it's
a windows-based system.
However, we could take a deeper dive and even go further into
discovering what exactly is being
hosted on these particular ports.
So now that we find open ports, let's
actually start discovering the
operating system and together will enumerate
these services on
these systems.
So let's dive in and checking for the operating
system version and enumerating and grabbing
the banner of each of those ports found
on both devices. So, let's Dive In
So great. We are back at all Kali machine.
Let's press up a couple of times and we'll
start with the 2d7, which is obvious machine.
We wanted to man.
What type of service versions are providing
those Services found on the
37 together it we wanted to in
the operating system so we can use Dash capital A
which is used to perform a series of
scans Force Dash e will simply
tell and map to identify the operating system
the service versions of any running services
and perform B6 script scanning together
with a tree throws.
Next we can use a dash capital T command
followed by 4 and this command will
simply specify the timing options for the scan
and the ranges are usually between 0 to
5 and 0 is very slow
and fives very fast on a
real Network. You don't want to perform a very fast scan at all
simply because any sort of thread detection
systems me trigger an alarm, but because
we're doing this within all personal lab Network,
we could scan us quickly as we want. So therefore we
get a lot of results very quickly.
However, since and map usually scans the
top 1000 ports by default, let's specify
and tell nmap. Hey scan all
65,535 ports
to do this. We can simply use a dash
P command with another Dash like
so
so the dash P command allows it to specify
our Port let's say you want to scan Port 80
we can specify Port 80, but if we
put on another Dash after the dash P command
like so we're simply specifying scan
for all silver sports with the
non operating system.
Now to get a scan going we can simply press enter and
because we're scanning all the ports this
meeting sometime. So I'm going to pause the video Once
the results are completed. We will retain.
After a few minutes the scan was completed.
Here you can see we get a lot more information and this
information could help us create a profile
and tell us specific details about the type
of system that has IP address of 172 tt1.t5.
For example, we can see yes, it did scan
Port 21 again. It shows it is open and it
is running FTP but looking through that
we can see the specific version of FTP on
the system. For example, we can take
this information Let's see. We open our web browser like
so
arcade had water Google once we had a
lot of Google we can simply start doing some research to determine
the weather this particular service has
any sort of security flows so we can
piece the information there and we can either type
vulnerability or we can even
type exploit
So look at this the first few
results include that there's a backdoor command
execution.
If we click on exploit DB.
And let's say we also open the rapid7 link. We
should be able to get more details about the
security flow on how it can be exploited.
For instance, we can see this security flow. It
was disclose a very long time ago
and we get a full description. So this
system that you just scanned it is vulnerable
and there's an exploit module
that curated back door access in that particular
service Force.
So if we are lucky we'll be able to exploit it
and check this out. It shows how to use some
Metasploit module to compromise the actual Target
which will take a look at any later video
when we reach the exploitation fees.
If you check the exploit D to base link
we can also see.
The specific details and the code that is
used to actually exploit that security flow on.
our Target system
But we'll come back to exploiting this at a
later time for now. We are trying to determine what type
of system that we are looking at without seeing
the physical system. That is
we can even see that end map capture the
banner information Force automatically simply because
we use a dash a parameter like so
for SSH we can see open as
a Siege 4.7 P1 is a
version that is being used on the target
system, but let's scroll down
way down.
There's something particular we need to take a look
at.
Let's look at a service information.
For whose the name of the horse is
metasploitable.
However, if you look at the operating system
types here we can see the specifying Linux.
And nothing else. So most likely this
system is a Lennox Beast operating system.
So so far we were able to identify at
least one security flow, but we must
go through each port and do research
to determen what it is any sort of security weaknesses
on any of the services that will found
running on the system so far. We were able to
find one security flow that seems to be exploitable. We know
the operating system is a Lennox bass operating system.
Okay, great while you are capturing. Oh
while you're performing all of this scanning on
all of these techniques on using all of these tools. Be sure
to start taking notes simply because
at the end of a pantry shantas, you need to compile your
notes and create a very good executive any
technical report. Once you start performing any
sort of technical stuff start creating your
notes. I highly recommend to use any new
tea can up you can use Google Docs you
can use
Microsoft OneNote you could
use Microsoft Word you could even
use notion if you want, but please ensure your notes are
backed up and secured all times.
So now that we have an idea on what this system
is Let's scan the not a
system or the next system. So let's changes the
dot tte. Like so hit enter
and once again, I'm going to pause the video because this
usually takes quite some time to complete.
After a few minutes the sky is finally completed similarly to
the type of results. We got in the previous scan
by scanning Delano space machine. We can see
the same sort of four models use to scan
this system, which is that TT. This system is
also running FTP, but it is running in Microsoft
version of FTP.
It is using open SSH 7.1. And
again, we can simply take all of these information and
do some research on Google to
determine what it is any sort of known security flaws
and what it is any sort of exploits for
these services.
However, we can see that there are many Microsoft services.
But if we take a look at Port 445,
it's specifies exact
version of a Windows and it's a
Windows Server 2008 R2 standard width
this specific build
number 7601 that is
running so spark 1 so great. If we
screw it on some more we will see all the ports
are open. We could even see there's an SQL silver
running on this system, but screw only
one further way down. We don't almost
got screw
in way down.
We can see that it performs a basic smb/os Discovery
scan by using the
script. Of course, it tells us the operating system which
we found earlier, but on this section
it verified operating system for us and
told us the actual CP is a
Windows to a 2008 series spark
1. Well, this is an odated operating
system, which means they are so many security weaknesses
on this version of
Windows. So when we reach on to
the section on exploitation, we'll take
a look at using different exploits to
compromise each of these security weaknesses
phone both on the lanox system
on the window system.
So great. Now that we have seen how to use and map
discover common ports identify earning Services
performed monograbbing unidentifying suits
Vision. Let's take a look at some common evasion
techniques that we can use it and map to avoid
being detected while performing Network scans
on a network.
During and map scans, we could even spoof our Mac
address automatically by using and map so
you don't need to really change your Mac address directly on
our network adapter. We can simply use a command
such as nmap dash dash spoof like
so
Dash mark
zero for randomization and then we can
specify a targets IP address such as
let's see 172.t.1 dot.
Let's see.
T6 just seeing right
so during this and map scan it will
actually spoof all Mac address automatically and if
any sort of Security Professionals with
the captured the network Pockets or even check the logs
will be using is simply randomly generated
Mac address.
Another Technique we can use is we can simply specify
the dash capital S command to
spoof our IP address instead so we
can use let's say sudo.
Just ensure we use administrative privileges to run these
commands sudo and map Dash capital
S. I'm going to specify a random
IP address within the actual Target Network.
So let's say we use tt.1.1 like
so or probably the 10 then we
can specify - e
Ethernet and this is the specify our
ethernet adapter one and no we can specify the
actual Target IP address,
which is let's say one seven two
dot ct.1 dot. Let's
see TT it for example.
So that's two techniques that we can use actually spoof or
Mac addresses and IP addresses when performing
Network scans.
During this video. We have taken a look at detecting operating
systems and detecting service
versions using the end map tool on Kali
lancs. Furthermore. You have seen how to perform
Port scans using and map and we have taken a look at
common Vision techniques using and map simply by
spoofing the MAC address and IP addresses during
and end map scan.
In the next video, we will take a look at performing in
network vulnerability scan only who's using
the necess tool. I hope this video has been informative for
you and I will see you in the next one.