1 00:00:00,760 --> 00:00:05,350 Hello, my name is Stephan, and in this lecture we will explore the fascinating world of a network 2 00:00:05,350 --> 00:00:06,310 reconnaissance. 3 00:00:06,640 --> 00:00:07,390 So. 4 00:00:08,550 --> 00:00:15,000 Nmap is renewed for its extensive range of host and port discovery techniques, allowing penetration 5 00:00:15,000 --> 00:00:21,000 testers and system administrators to gather critical information about their networks. 6 00:00:21,000 --> 00:00:27,240 By utilizing these techniques, we can effectively scan hosts even in the most restricted environments. 7 00:00:27,240 --> 00:00:33,600 So let's explore some of the key techniques employed by Nmap for host discovery. 8 00:00:35,060 --> 00:00:37,460 We can also trace routes with map. 9 00:00:37,460 --> 00:00:39,950 So tracing routes with Nmap. 10 00:00:41,250 --> 00:00:47,880 From the scanning machine to the target host can provide valuable insight into the network topology. 11 00:00:47,910 --> 00:00:52,680 Nmap enables us to include trace route information during our scans. 12 00:00:52,680 --> 00:00:57,750 So for example, now we will enter the Nmap as an nmap. 13 00:00:59,390 --> 00:01:02,900 As and we will add a trace route option. 14 00:01:04,830 --> 00:01:11,430 So by using this option, we can trace the path taken by packets from our machine to the target host. 15 00:01:11,640 --> 00:01:13,260 Let's do this example here. 16 00:01:13,260 --> 00:01:18,040 So nmap traceroute and here we will enter our some website. 17 00:01:18,060 --> 00:01:21,090 In this case it's going to be, for example, code sally. 18 00:01:21,240 --> 00:01:23,460 This is our application which we. 19 00:01:24,320 --> 00:01:29,990 Our website which we installed for penetration testing in in this course here. 20 00:01:29,990 --> 00:01:37,460 And as you can see here, traceroute has to run as root and we will use this sudo here and after that 21 00:01:37,460 --> 00:01:41,090 and as you can see here, here we this is our traceroute. 22 00:01:41,090 --> 00:01:47,660 So this command initiates a ping scan with a traceroute enabled for both the. 23 00:01:49,140 --> 00:01:51,630 Constantly on our host machine. 24 00:01:51,630 --> 00:01:56,460 So we can also add another here, for example, Google.com and here. 25 00:01:56,460 --> 00:01:56,970 That's it. 26 00:01:56,970 --> 00:01:57,660 So. 27 00:01:58,500 --> 00:02:05,970 We are allowing us to visualize the network path and identify potential bottlenecks or routing areas 28 00:02:05,970 --> 00:02:06,210 here. 29 00:02:06,210 --> 00:02:09,360 As you can see, we don't have any usually on rooting here. 30 00:02:09,360 --> 00:02:19,860 So Segment three Leveraging NSA scripts during host discovery and Maps scripting capabilities through 31 00:02:19,860 --> 00:02:21,390 the Nmap scripting engine. 32 00:02:21,390 --> 00:02:28,890 NSA here provide a powerful way to gather additional information about a target during the host discovery 33 00:02:28,890 --> 00:02:29,370 phase. 34 00:02:29,370 --> 00:02:37,140 By executing the Nmap scripting engine scripts, we can extract valuable insights about a target service's 35 00:02:37,140 --> 00:02:45,930 vulnerabilities or even perform specific tasks to execute Nmap scripting engine script without conducting 36 00:02:45,930 --> 00:02:52,860 a port scanning, we can use the as an option to skip port scanning and specify the desired script using 37 00:02:52,860 --> 00:02:54,870 the script option. 38 00:02:54,870 --> 00:03:03,730 So here what we're going to do is an Nmap script here and we will use the DNS root DNS root as a Nmap 39 00:03:03,730 --> 00:03:04,870 scripting engine. 40 00:03:04,870 --> 00:03:11,620 So DNS root here and after that we will enter our target domain or IP address. 41 00:03:11,620 --> 00:03:16,720 So in this case it's going to be console here, dot com and here. 42 00:03:19,640 --> 00:03:22,010 We will pay the execution here. 43 00:03:30,170 --> 00:03:33,350 Let's actually run with the pseudo privileges. 44 00:03:44,540 --> 00:03:48,680 And here, as you can see here, we got no target specified. 45 00:03:48,680 --> 00:03:51,530 And so zero host scanned. 46 00:03:55,610 --> 00:04:00,710 And here, if you are getting this error, you can also use the alternative script for this here. 47 00:04:00,710 --> 00:04:09,370 So instead of writing DNS root here, you can also write the DNS insecure and enum and after that you 48 00:04:09,380 --> 00:04:12,590 enter the your domain or IP address. 49 00:04:12,590 --> 00:04:22,310 So here this is an alternative and this script performs a DNS enumeration by querying for Dnssec records, 50 00:04:22,310 --> 00:04:25,520 which can provide valuable information about the domain. 51 00:04:25,520 --> 00:04:27,560 And here now, we will get. 52 00:04:28,400 --> 00:04:29,480 An output here. 53 00:04:42,030 --> 00:04:49,670 And also keep in mind that the success of this command depends on the availability of this DNS insect 54 00:04:49,710 --> 00:04:56,340 enum script on your network configuration, and you may need to install additional Nmap scripting engine 55 00:04:56,340 --> 00:05:02,130 scripts or adjust the command according to your specific environment. 56 00:05:02,220 --> 00:05:04,950 So if you need any. 57 00:05:06,040 --> 00:05:12,820 Assistance If you or if you encounter any errors, feel free to ask me on the. 58 00:05:14,160 --> 00:05:15,900 Question sections of our course. 59 00:05:15,900 --> 00:05:18,930 And as you can see here, we got a lot of information here. 60 00:05:18,930 --> 00:05:21,570 We got ports and this here. 61 00:05:21,660 --> 00:05:30,180 So here in this command, we are executing this DNS Dnssec script during host Discovery, which attempts 62 00:05:30,180 --> 00:05:34,530 to brute force DNS records for the cozily.com domain. 63 00:05:34,530 --> 00:05:42,840 This can reveal hidden subdomains, but also provide valuable information here and as you can see, 64 00:05:42,870 --> 00:05:44,700 open ports and so on. 65 00:05:44,700 --> 00:05:48,600 So we can also use the SDN here before the script here. 66 00:05:48,600 --> 00:05:51,720 And let's see how the port will change. 67 00:05:51,720 --> 00:05:56,280 And as you can see here, this is now we are not scanning port signs. 68 00:05:56,280 --> 00:06:04,230 This parameter will not scan port here and here We are sending this host record server here. 69 00:06:04,230 --> 00:06:07,890 And as you can see here, our hosting for this domain. 70 00:06:08,990 --> 00:06:14,000 Contains this domain address here and which is this is the IP address of this. 71 00:06:17,110 --> 00:06:24,400 And one interesting Nmap scripting engine script available in Nmap is broadcast ping script, which 72 00:06:24,400 --> 00:06:31,750 utilizes a broadcast ping request to identify online hosts within a network by broadcasting a ping message. 73 00:06:31,780 --> 00:06:39,370 Nmap can detect hosts that respond even if they have a restrictive firewall rules. 74 00:06:39,370 --> 00:06:46,270 And to use this script, we specify it with this script option as we did earlier, along with the desired 75 00:06:46,300 --> 00:06:47,710 target range. 76 00:06:47,710 --> 00:06:51,550 So we will do Nmap as n here script again. 77 00:06:52,840 --> 00:06:55,150 With two year script. 78 00:06:56,860 --> 00:07:03,680 And after that we will enter the broadcast pink and 192168. 79 00:07:04,570 --> 00:07:06,670 Let's actually see our. 80 00:07:09,120 --> 00:07:10,260 Ifconfig IP. 81 00:07:10,350 --> 00:07:15,630 Local IP address 13 138 13 one here. 82 00:07:15,630 --> 00:07:19,260 And after that we will enter the 24 and here. 83 00:07:22,560 --> 00:07:23,140 And map. 84 00:07:23,490 --> 00:07:28,950 And so we need to actually oops, we had the error with this typo here. 85 00:07:30,020 --> 00:07:32,780 Broadcast and that's it. 86 00:07:33,880 --> 00:07:36,460 And as you can see, it's not running for lack of privileges. 87 00:07:36,460 --> 00:07:43,150 So we need to run it with sudo here, root privileges here and now you will see an output. 88 00:07:45,930 --> 00:07:46,860 And here. 89 00:07:46,860 --> 00:07:54,360 So with this command, we are scanning the local network with the IP range of this one slash 24, which 90 00:07:54,750 --> 00:08:05,520 we will scan this IP address from 0 to 256 here using this broadcast ping and here, this can be particularly 91 00:08:05,520 --> 00:08:12,040 useful in scenarios where your host might not respond to a traditional ping requests here. 92 00:08:12,060 --> 00:08:18,480 So in conclusion, Nmap discovery capabilities provide a powerful arsenal for network reconnaissance 93 00:08:18,480 --> 00:08:26,640 by understanding the leveraging techniques such as traceroute, NSA, Nmap, scripting, engine scripting 94 00:08:26,820 --> 00:08:33,930 and specialized scripts like broadcast ping, we can gain comprehensive insights into network environments, 95 00:08:33,930 --> 00:08:38,280 identify active hosts and uncover potential vulnerabilities. 96 00:08:38,280 --> 00:08:45,870 So equip yourself with the knowledge of Nmap host discovery features and embark on your network recon 97 00:08:45,970 --> 00:08:48,070 science journey with confidence.