OK, so the next thing I know we can try is actually SMTP, enumeration, SMPTE, S.P.C.A., a simple
mail transfer protocol and everyone's eleven point twenty five is pretty much poor.
If you remember from the networking section, it's for sending email.
We can potentially gather information, you know, if that port is actually open so we can connect to
it like with Incat and then actually send it out commands to see if, like, you know, a specific user
exists or not.
So let's go ahead and try that out.
So we're back on a colonics machine.
So let's go ahead and actually try this SBB enumeration manually.
So let's try so ank and then we're going to do a Dash N.V. and then we're going to do our address one
or two to one six eight five six one want four.
That is the address for a disposable machine and let's just put it twenty five and then we can hit enter.
So we see that we're connected over SMTP, which is twenty five as we know, because it is an open port.
So what we can do is to verify some commands that we are Afgooye and then something like Rup.
If you see something like this come up, then we know that you know that this user is actually there.
But if we try something else like we are Afgooye, I don't know, I don't live here.
You know, I was going to say, hey, user is unknown, but this is a good way that you can actually
numerary users on a system outside of doing this manually.
One way that we can do it is we can use a script.
So remember, I talked to you guys about scripting.
This is where it can kind of come in handy, use your brain to kind of like actually find ways to automate
things.
So I have a script.
It's called SMTP API.
So it actually goes through and does this process for us.
As you know, we start with this command for our Python scripts.
We import Soki and policies.
And then this is like, you know, if we do it wrong, like if we don't have the right number of arguments
are going to tell you how to actually use it correctly.
So to use it, as you can see, is Essence PWI and then followed by spacing and a username.
This is Connect to the socket, you know, point twenty five on the machine.
So you have to go in.
You can also make that a variable too, if you wanted to.
For the purposes of this, we just made it a string.
So, so we know exactly which one I want to go to.
Then it turns out the banner like Winnik, when it connects to it and it sends out the verifier come
in.
You've got to make sure you have the space right here, too.
It's very important.
And then it's going to store the result here and then print it out and then close the connection.
So let's actually go ahead and try this out.
So when you make it, you ought to also have like a siege mod plus X Command and then somebody PWI just
to make it executable.
So you just do that slash TV type while it's true and then bam.
Now we know a way that we can automate this so we don't have to actually go through and connect and
type in the command.
We could just type we just run the script and give you a username.
You can even do like a list of user names.
If you wanted to see you feel free to trick that script, you know, for your own usage.
OK, so another tool is the Nessa's vulnerability scanner.
Now it's a vulnerability scanner.
It looks for vulnerabilities.
You allows you to scan the entire network and discover what vulnerabilities actually exist on each computer
on it.
So this is a paid tool, but they have a free version that actually limits the number of IPS that you
can scan.
But you can still go ahead and grab that and use that for, like, you know, practicing some scanning
in your own lab at home.
Another vulnerability scanner.
If you don't want to pay for Nessus and you want something fully functional and free, open voice is
a good option.
It's open source vulnerability scanner.
It's free to the public.
It's not as robust and it won't catch as much as Nessus would.
But it can be a solid vulnerability scanner if you set it up right and use it correctly.
Now, I will reiterate, it is very painful to keep that thing updated and actually functioning.
And the user interface is not intuitive at all, but it's still a vulnerability scanner, I think that
is said to have about maybe like half or like a third of the vulnerabilities that Nessa's covers.
But it's still free and so that you could use on your own.
OK, so a lot of passive and active reconnaissance tools that we can actually use to gather information
about, you know, systems on a network or just a network from the outside.
So what's next?
So now that we know how to do that, we're going to start launching some attacks.
You know, kind of like one attack so far, but we can start launching attacks against these discover
vulnerabilities.
So I appreciate you listening in as far and I see you guys in the next section.