So remember that while performing a penetration test, we should always test the network devices whether
they're vulnerable to attacks.
All the ones we've mentioned up till now, Of course, we have to discover the network devices and the
services running on them first.
So let's see how we discover network devices and their services and what else we can do to attack these
services.
Come on, it'll be fun.
So as you already know, the first step of a penetration test is always reconnaissance.
In other words, gathering the information.
So how can we collect information about the network devices?
The answer is the same with a reconnaissance of all the other parts of the penetration tests.
We can scan the network and find the network devices according to the fingerprints or operating systems
of the devices found.
For example, if the operating system of a device is Cisco iOS, it's most probably a network device
such as a switch or a router.
Sniffing is another way to collect data about the network devices.
You should always especially focus on the clear text services such as Telnet.
Now, one of the brilliant ways of reconnaissance is analyzing the documents collected throughout the
penetration test.
In a typical penetration test, you probably find a lot of sensitive information by just looking at
the file servers, shared files and email backups or unprotected Ascii files of compromised admin personal
computers.
So as we were saying before, the most common services open in the network devices are SSH, Telnet,
Http, Https and SNMp.
And the default ports of these services are listed in the slide.
I want to call your attention to these are the default ports.
Right.
So they don't have to run on the specified port.
You can run an SSH service on port 443 or an Https service on the port.
I don't know, four, three, two, one, etcetera.
You can discover more details about the network devices by analyzing these services deeply.
Right.
So now to have the correct results and discover even more.
You should always scan network with OS discovery and version detection options.
So if you look at the example in the slide, again, you see an Nmap command.
Nmap is a security scanner which is used to discover hosts and services on a computer network.
In the same sample command shown.
The O parameter is used for OS detection, while s upper score V is used for version detection.
Great.
So just listen to the traffic.
We can gather some information about the network devices here.
The protocols which use clear text communication are especially important because you can see the payload
data transferred between the endpoints.
The most important clear text protocols are telnet.
Cisco Discovery Protocol.
Spanning tree protocol.
Routing protocols.
Vlan trunking protocol and.
Simple network management protocol.
So let's scan the router according to the criteria that we talked about up till now.
In Cali.
I opened a terminal screen, so I'll use the nmap to scan the router.
But first.
Let's go ahead and ping the router to check the network.
And it's okay.
So Nmap is the command itself.
As subscore s to make it a Sin scan.
A sin scan is a kind of TCP scan where three way handshake is not completed.
But please refer to my network and vulnerability scan for hacking by Nmap and Nessus course for more
details about the Nmap and those scan types.
Target IP is our router.
As upper score V is for the version detection of the open ports.
Oh, for the operating system detection.
Reason is to force and map to tell the reason of its decisions.
And P is for the ports.
So let's scan SSH, telnet https http and SNMp ports.
Now hit enter.
So that took 15 seconds.
It seems the only port open is the Telnet.
Here's the details.
It is a Cisco device and one of these series.