Now we need to move to guys getting active information.
In this phase we can interact with the victim to get active information like open port services network
topology and ability.
So you're going to get more critical information.
And this will be definitely very useful one.
While we are planning for the penetration testing.
But I have to warn you first that when it comes to active information this is actually kind of critical
and you need to get an approval for doing that.
So if you practice scanning and port scanning and later scanning make sure that you got the right approval
or you are doing that in your own lap but do not start scanning different system internally or online
without getting that approval.
This would get you some problems.
So let's start with what exactly we are looking for when it comes to active information.
First I need to know if this system is live or not.
And a simple way for doing that is using pink and Pink will allow you to test if the system is connected
to the network or not or live or not.
Which is if I type pink and I put an IP of an existing computer inside my network 163 255 I can get
a reply and pinging Linux is different in ways that it's not just sending for packet and waiting for
supply.
It's a continuously process in windows when you looping it sent for small packet.
And if the victim got a specific protocol called ICMP up and running.
Have to reply but you have to reply back with the same amount of packet and same size.
So think is a way for doing that.
Except most of the system right now if you have a computer that has Windows XP Windows installed on
it by default the firewall is on the firewall will blocks ICMP so sometimes the system is on Senator.
It's life but when you are using pink you will not be able to know if the system is live or not.
That's why you're going to see in a few minutes how to use another tool.
So number one I need to know if the systems that I will scan or the systems that is considered my victim
it's life or not and when I'm saying life I mean that it's connected to the network.
The second
information or the second piece of information I need to get is the open port.
Now what is exactly is a port.
When I when I'm talking or when I'm saying port what do I mean by port a port is a logical communication
channel.
So any service on your computer needs to be or need to use a specific port for instance when you open
your browser and type any Web site.
So if I'm up if I open my browser here and type any Web site M.S. and Google dot com anything.
Now this request for opening the page so I go here and I type for instant
w w w but yeah.
Dot com XXX request
we'll go through port 80 this port.
Port 80.
Know how to deal with web page because it used a specific service called HDTV.
And this H2 TGP service know how to send a request for a page how to receive requests for a page and
so on.
So what I'm saying here is that only port 80 can deal with Web site requests and so on.
Well if I'm trying to download something for the Internet from the internet I need port 21 support 21
is using a service called FTB that is dedicated for download.
If I need to connect to a system through a service called telnet and I type for instance telnet and
an IP telnet are using port 23.
So my point here is that different service are working on different port.
As an example if you are working somewhere and you need to call the H.R. people different definitely
in your phone you have an extension for each other department and another extension for finance department
and insert the extension for support team.
You don't have one single numbers that allow you to reach everyone.
Same concept are here that we have different communication channel that allow us to use different services.
The second question is Is it the physical
port.
I mean can you open your computer and see what is port 80 and what is Port 23 and 20.
No.
Those are logical communication channels.
It's not something physical is logical.
Okay.
Third question how many port do I have in my system.
I have sixty five thousand five hundred and thirty five.
So we have a huge amount of port.
And those are divided to two different type or two different categories.
We have support that is less than
1024.
And those are known as a well known port.
I mean if I scan my system and I see that port 80 are open this is a well known port.
It should not disturb me but if I see that I have port 6 6 6 6 open which is higher than 1024 I should
investigate what is opening this port.
It could be a virus.
It could be someone hacking my Computer so all the ports that is above 1024 so actually need to be investigated
somehow.
Now what I need to do right now is to scan my victim port.
What port he got on his system running.
So I'm Bruce a very important tool called and map and map.
It's a very very important tool.
While you are gathering active information this will be used for a different type of information.
So let's start by getting the port of my victims so I'm going to type and map and then minus small s
and then captain is
small skip that this.
I'm sorry
and map
minus small s capital is minus capital and the IP of my victim which is 1 9 2 1 6.
This is a Windows machine.
1 6 3 point 2 5 0.
The point here is minus small as captain as me and show me the open port.
And what service are using those port.
So I have port 135 open.
What exactly is opening it.
Because according to that I may check if the service is vulnerable and can be hacked or not.
And minus captain who will show me the operating system.
So let's see if I use this comment.
What exactly are we getting.
So as you can see this was fast.
So I got all the open port.
So I have for instance port one step too.
Five open and it has an R piece this is the Microsoft service running 139.
So they actually are very very handy and if you funds those port open I'm going to show you how easy
it is to compromise the system for four five five.
So it seems that a lot of service are set.
And when you see a huge amount of service that's mean that most probably you'll be able to compromise
the system because you need to check any reasonable service.
And if the service increase that means the probability of find the vulnerability increase.
So I'm getting all the services here and all the port all the service running on this computer.
I also was able to get the MAC address of this computer and this will help me with some layer to attack
and I I need it give me that.
This computer is a virtual machine.
It's not a physical machine.
And I was able to get the operating system it didn't get the specific operating system it told me it
could be Windows XP Service back 2 or 3 or Windows Server 2003.
Also this is very useful at least I don't know.
I know that it's not to understand or it's not once the server 2012 those our very valuable information
and we're going to see later on how to utilize this information to to compromises and then tell me that
that network this is is one hope.
I mean this computer is directly connected to the network.
It's not.
There isn't any traffic routing.
I mean there it's on the same network.
So this is actually the information that I'm getting using.
And Matt so let's see how to use and map in a little bit deeper way and get more information.