Another tool that we can use for reconnaissance is known as Netcare now NEKE is actually known as the
hacker Swiss Army Knife.
That's how useful it is.
So it is pretty essential for establishing remote connections to devices that we're going to exploit.
You know, when you're actually conducting ethical, you know, hacking activities and you can also
use it as a scanner in some scenarios.
So Neka has the ability to allow you to either, you know, scan for like maybe open ports, but primarily
it can be used to listen to connections as they come into your system or to other systems.
So let's go over like some quick, you know, Netcare syntax and examples.
So if you want to run the command, so all you have to do is type in and see right here.
And that's going to call the program.
And then there's dash envy and you just say, hey, run this scan in very verbose motorcycle.
And map has the same type of verbose option.
If you don't want to see the verbose output and just take that off, then we have a view that means,
hey, time out until, you know, like a second pass and then you can move on.
So you could just do that to see how long it like limit how long it actually take, because sometimes
these scans can take a while, then you can do a dash Z to actually say, hey, no data transfer mode.
So that's actually going to make it run a lot faster.
And then we can have our target address right here, which is the metastable machine for us right now.
And then let's say we have or it's one to one hundred so we can go ahead and do that and hit enter and
it's going to spit out our results very, very fast.
If you run this without the dash, there will be very slow.
But as you can see, it tells us how can actually refuse, can actually refuse.
Hey, Paradies open can actually refuse, can actually refuse and you can see what parts are open.
This aligns perfectly with our map scans before.
So you can use this as a viable, you know, scanning tool as well.
So you see fifty four point fifty three is open.
Let's see if it goes open right now as age ATP telling SMTP this is stuff that we're going to look at
later.
But this is just showing, you know, how you can actually use Netcare as a scanner.
And just to note as well, if you wanted to, you can use as a scanner as well.
You would have to add a dash you option like right here, and it'll actually, you know, scan the UDP
force.
So it might be a little bit slower when you're doing that.
As you can see, it's kind of like just trickling through.
It'll eventually get through the entire list and then we're pretty much good to go.
And you'll probably see, I think only like we're 53 was open.
I don't remember exactly.
But, um, as you can see, you can use this for UDP scans as well.
So it's a very versatile tool.
OK, so another way that Netcare is very, very useful is that it allows us to actually listen on ports,
either on remote computers or locally for any track that comes over that port to that computer or to
our local computer.
So what we're going to do right now is it's a very quick example of actually using that cat to listen
on a port.
So all you have to do is call an Cadigan with Nancy and then you put Dash NVP The L is going to put
us in listening mode.
The V is going to give us verbose output and the P is going to allow us to specify the port so we could
put a target just here if we wanted to connect that to another port and listen, you know, over that
port for traffic.
But right now, we're just going to do this locally.
So we're going to listen.
Hey, if you know what connects to us over 480, you know, let me know what happens.
That's pretty much what this is saying.
Now we're listening up for eighty.
We know the IP address here is one, two, seven.
So let's actually go over to my Windows machine.
I'm doing all this on and let's see what happens when we actually type in HDP.
And then the IP address of my colonics machine.
So as Jack is spinning, I don't have a Web server or anything close to it right now, all like that's
pushing out stuff.
So it's just going to spin and it's not going to do anything.
All right.
We go back to R. Kelly Linux machine and click back over here.
Oh, hey.
It says, hey, we got a connection request from one nine to one six eight five six that one.
And it's giving us just different information.
And this is just a header and it's just, you know, telling us this is very useful for catching connections
and maybe, you know, also like viewing things, like potentially playing text that sent over.
It does a lot of versatility that comes with this.
So that's a couple of how you can use NPR to listen for connections in different traffic as such.
Just quickly show you guys I went back and actually to show you that, you know, things that are posted
to the euro can actually be seen over on a column.
So this is just an example and maybe it's an insecure application and it passes stuff over plain text,
like in the but you are also a user and and then a variable password pass that goes past to our politics
machine will actually show us a right here.
So it's pretty useful for catching information, so just keep that in mind.
So one other thing, as you want to do when you're conducting, you know, your active reconnaissance
is looking for SMB enumeration.
This is server message block.
And it's very key, like when it comes to corporate environments.
So look for SMB vulnerabilities.
They're very common and they're not too difficult to exploit as well.
So if you don't know server messages, block or SMB is use for file transfer and Istana ports one three
nine and four, four or five.
And like I said, easy to explain most of the time on some devices, you know, if you can exploit it,
you can actually own the entire system or your access to all kinds of stuff and be able to get like
a router account like almost immediately.
And SMB enumeration can be done with a variety of tools where we're going to focus like right now on
using and map, but as other tools as well.
OK, so we're going to call Linux machine.
So let's say we want to find out about some SMB, all what we have.
We just do our simple map command.
And then for this we're going to ask for verbose output because we want to see stuff as it's happening
is pretty cool.
We've got to do a dash P to actually specify the point and then we're going to say one three nine and
four four five, because we know that, you know, those are the ports that somebody runs over.
And let's say that we want to output the file to like SMB dot t and then we want to put the target.
So one on two to one six eight, five, six, one or four.
This is the metastable machine.
We're going to go ahead and actually run this command.
And then now, OK, hey, if those ports are actually open, so one of the neat thing we can do with
a map is that we can actually specify ranges.
So let's say we wanted to do one, two, two, five, four, just for example, it'll scan everything
on this subnet, pretty much so.
And look for those ports that are being open and put it into this file.
So let's go ahead and run that.
You might need to give a little bit of time, but it's going to give us a full report, you know, for
each system, each address that we found and actually tell us, hey, you know, they're closed on this
one oh seven device.
I believe that's my colonics machine.
Let's see.
There is to it on here.
It's open on one of four.
As we know.
It's filtered there.
It's open over here on the twenty, which is actually the domains are the main domain controller.
And it also open, let's see to do OK.
And it's open locally because I allow that to happen.
So and that's a good way to figure out, you know, if SMB is something that you will be able to exploit
so you can actually take this a step further and actually run like a zombie like winnability group.
So we could just do less users to share such and that and then slash scripts, slash SMB dash for you
L and you just put a star and it's going to give us all of the different like SMB vulnerability's scripts.
So these scripts actually go through and check if a specific system is vulnerable to, you know, these
specific vulnerabilities and you can just call it with the dash dash script command.
So let's say let's just test it out.
I'm not sure if it's actually going to work, if it'll actually be vulnerable.
Let's try this on the Windows server that we have.
So let's see.
Let's do a map, a C Dash V for verbals.
Let's do a dash dash script.
Equals and then let's actually just base one of these, because these are like the Microsoft Windows
ones, because you never know good work, just scripts.
And then we could just copy this over.
Uh.
We get a copy this down there.
So a selection.
And then it's actually going to run this script.
Didn't put the I.P. address one or two to one six, eight, five, six, dot 20, so happens so that
she can go ahead and run on that map and is going to go through and actually run this script for us
as well.
OK, so our script ended up finishing a ran the vulnerability script on after it did end mapped scan
and saying, hey, it's vulnerable, it's potentially vulnerable to remote code execution because sambi
version one being used.
So it's pretty big.
So if you like this and you know where you'll be able to exploit this pretty easily and we'll get to
this later and actually clarify if this is real or not.
As you can see, you can check out these other sources as well.
But as you can see, EMAP is very versatile and allow you to find, you know, vulnerabilities like
this right here.
Some people in our military, another type of renumeration that we want to do during our active reconnaissance
is actually Innovest Enumerations and Staniford Network file sharing.
It's another thing as key.
You know, we're doing this active reconnaissance or so Neff's runs over Report 111, and it's typically
used to mount network shares that can potentially be exploited.
You know, it's set up incorrectly so we can actually numerary Innovest information using.
And so I'm going to go ahead and show you how to do that or packing Archaia Linux machine.
So we have a map command set up.
So right now, set to where it's going to do a service scan and figure out the version of it with this
dash ASV right here.
And then we have Dasch, we're looking at Port 111.
So we're trying to see, you know, are there any devices that have power 111 open?
And then I put in a very verbose Mosso actually shows us, you know, what's happening, what's happening,
because it's pretty cool that we have our target right here.
And if we want to do the manifest enumeration, you can actually just do dash dash script.
And then equals and then what we're going to do is our PC info.
OK, so we could just go ahead, run that and then let's wait a minute and check out the results.
So we're going to go ahead and run this command right here.
So it was just a simple and my command is going to do a service version scan.
It's going to scan for 111.
And we're putting in a very verbose mode.
This is going to be a target.
As you'll see.
This is our kind of Linux machine.
So what I did was I went ahead and set up an NFL server locally on this just to show you how this works
and all inclusive instructions for you guys.
Actually, go ahead and set up an investor locally as well so that you can actually practice it and
try it on your own.
You'll probably find that in the research section.
So the script that we're going to use right now is RBC Info.
So pretty much what this is going to do is it's going to allow us to see which devices are actually
registered with PC Vyn.
And that's going to tell us, like, you know, if it points to, like, an offense or not.
So we can go ahead and run this one and just give it a second to finish so I can finish.
And hey, it said Port 111 is open, our PC bond is running on it.
And hey, we found this.
And right here, slash amante slash hacking share and has these files inside of it.
You can ignore those first two.
But what's interesting here is the super secret password text, huh?
So that's pretty neat.
We know what we know.
That's probably a follow that we want to know, like what's inside of it.
Let's look a little bit more some of the more information of some of the information that she gave us.
So we see that Mount is actually accessible to anyone that's on the subnet.
And hey, we broke into the network technically, so we're on the same network.
So we should be able to gain access to it so we don't have any restrictions there.
And it's just a little bit more information, you know, about the end US share as well.
So we can take this a step further and actually try to see if we can mount it to our system, to where
we can access.
And we do that with a mount in.
So I've already done this, but I'm going to show you guys the mount.
So just now, followed by the IP address of where the NFL shares and in and then the NFL share and then
our own folder.
So I made a folder called Manifest in these folder.
So what we can do is we can create such amante my NFC.
And we could do a and hey, it actually synchronized, you know, it actually went and mounted the manifest
here locally here.
Now I can access this file right here.
So if I wanted to, I can do a V supersecret password, sex.
And hey, I have read access to it.
That's pretty crazy.
I can also if I wanted to, I could do Cat Super Secret password and it'll cat it out.
So now I have a super secret password, so that's pretty neat.
So now you see kind of how, you know, antifascists enumeration can be very valuable.
You can find some up permissions usually on most Internet networks if you look for this.