‫In those in math lectures, we have seen no port scam, also known as Ping Scan.
‫Different ways of scanning ports.
‫SoundScan, also known as half open scanning DHCP scan, also known as TCP Connect Scan and UDP scan.
‫Now, let's see some more details to be able to use and map more effectively.
‫We have found the hosts and open ports of them.
‫Now is it time to find out the services which are listening to those port and the version of those services?
‫In addition, let's detect the operating systems running on those systems.
‫Suppose that you ran an end map query and it told you that ports 25 TCP, 80 TCP and 53 UDP are open.
‫Using it in map services database of about, oh, 2000, 200 well known services and map would report
‫that those boards probably correspond to a mail server, SMTP web server, FTP and nameserver DNS,
‫respectively.
‫This lookup is usually accurate.
‫The vast majority of demons listening on TCP Port 25 are, in fact, mail servers.
‫However, you should not bet your security on this.
‫People can and do run services on strange ports.
‫Even if and map is right, and the hypothetical server above is running SMTP, http and DNS servers.
‫That is not a lot of information.
‫When doing vulnerability assessments were even simple network inventories of your companies or clients.
‫You really want to know which mail and DNS servers and versions are running.
‫Having an accurate version number helps dramatically in determining which exploits a server is vulnerable
‫to inversion detection helps you obtain this information after TCP and or UDP ports are discovered using
‫one of the other scan methods.
‫Version detection interrogates those ports to determine more about what is actually running.
‫The Map Service Probes database contains probes for querying various services and match expressions
‫to recognize and pass responses, and map tries to determine the service protocol.
‫For example, FTP, S.H. Telnet FTP.
‫The application name could be ISC Bind, Apache HTTPD de Solaris, Telnet de.
‫The version, number, hostname, device type, something like a printer or a router and the Aussie
‫family, you know, that is Windows, Linux, etc..
‫So let's see how to use service and version detection and then map and why it's important.
‫OK.
‫Go to Carly and open a new terminal window.
‫Let's create the map, scan command and map as a command itself.
‫And is to avoid the DNS resolution.
‫Uppercase pennies to avoid the host discovery.
‫I'm using the sin scan this time.
‫All right, the destination IP, which is the IP address of my Metis voidable VM and the destination
‫ports.
‫The top 10 ports, let's run this command first to see the results of a command without version detection.
‫Now I open a new terminal window to create a new and map command.
‫I prepared the command with the same configuration.
‫Since scan.
‫Metasploit voidable.
‫And Top 10 port.
‫I add s uppercase v parameter for version detection and hit enter.
‫As you see, the query takes longer this time.
‫The in scan without the version detection took less than a second, and this in scan with version detection
‫took about 12 seconds.
‫In the first query, service names are estimated by end map, according to the default services running
‫on those ports in the second query, on the other hand, and Map probed the ports to determine more
‫about what is actually running.
‫Now, I want to show you the most important reason of using version detection and map queries in Cali,
‫I'm going to run Sage on Port 443 and then scan the port within Map.
‫Let's perform the demo together.
‫First look at the listing services if Assange is running netstat NLP.
‫As Ice Age is running on Port 22 at the moment.
‫Type service S.H. stop the stop as a service and hit enter.
‫Now, to change the port of S-H, we're going to change the configuration.
‫Open the SS HD underscore config file with a text editor, change it.
‫I use nano text editor for this type, nano slash Etsy slash speech slash, SS HD underscore and fig
‫and hit enter.
‫Find the port line, delete the sharp to make it a valid configuration line.
‫The sharp was used to make it a comment line.
‫Change the port number to four four three.
‫Control X to exit Nano Y to save changes and hit enter to save over the existing file.
‫Start S.H. again using the service, say, Start Command.
‫Look at the listening ports to double check netstat NLP.
‫Such service is running on Port 443 now, let's scan Port 443 of Kali within Map.
‫Prepare the maps and scan command.
‫No version detection for this query.
‫And map, the text of the port is open, look at the service and map, says the services GPS using it
‫and map services database and Map reported that this port probably corresponds to a web server for HTTPS,
‫and we know that's not true.
‫So let's prepare the maps since scan again, but this time use as uppercase V parameter to run the version
‫detection mechanism.
‫Now, as you see, Port 443 is running and the service is S.H., not HTTPS version detection interrogated
‫the port to determine more about what is actually running and map query the port using the probes of
‫the end map service probes database and matched expressions to recognize and pass responses.
‫And the version of S.H. is open source eight version seven, but 6P one.
‫So if you are not 100 percent sure about the type of the running service on a port run version detection.
‫Got it.
‫Good.