Tutor: The second program
that we'll use for network mapping is Nmap.
Now in the previous lecture we use Netdiscover
and we've seen how nice it is to quickly discover
all the devices connected to our network,
see their MAC address and maybe get the vendor.
Nmap takes scanning to a whole new level.
It might be a little bit slower than Netdiscover,
but it'll show you much, much more information
about the target.
So you'll be able to see the open ports,
you'll be able to see the running programs
or the running services on these open ports,
you'll be able to determine the computer name,
the operating system running on that computer.
If you're in a network,
you'll be able to discover all of the connected clients,
you'll be able to bypass security, bypass firewalls,
and so much more.
Nmap is actually a huge tool
and there are books and complete courses done
just to teach and Nmap.
The Nmap book would actually be a really good read
once you're done with this course.
Now, because this tool is huge,
we're not gonna be able to cover all of its uses,
but in this lecture,
I'm gonna show you the basics of this tool,
how to use it to discover all of the connected clients
and see useful information about them.
And we'll actually use it more
when we get to the gaining access section.
We're actually going to be used in Zenmap,
which is the graphical user interface of Nmap.
So to run it in terminal, you just have to type Zenmap
or you can find it under your applications menu.
Now, as you can see, it has a very, very simple interface.
The first thing that we see is the target input box.
In here, you can put your target.
You can scan any IP that you can reach,
whether it's a personal computer, whether it's a server,
whether it's an IP for a web server for a website,
for example,
that you want to discover all the open ports
and all the running services on it.
Or, like what we're going to do right now,
we can put a range similar to what we did with Netdiscover
and it'll scan this whole range,
discover all the live IPS
or the IPS of the connected machines on the same network
and display information about them.
Now we'll have a look on how to scan servers
in the gaining access section.
So for now,
since we are still in the network hacking section,
we're gonna put a range
to discover all the connected clients
and see useful information about them.
So, right now I'm actually connected to my wireless network,
that's why I'm gonna specify the whole range
on that network.
And we've seen how to get that in the previous lecture.
So it's 192.168.1.1/24
At the bottom, you can see the command.
This is actually the Nmap command that will be executed
when I hit this Command button.
So like I said, Zenmap, what we're using right now
is just the graphical interface
that will run this Nmap command in the background
and show me the results.
So if you know a custom Nmap command you can put it here.
Or, if you just want to see Nmap in terminal,
you can literally copy this command, paste it in terminal,
and it'll give you the same results
that you would get if you run it here.
Alternatively, if you don't really know much about Nmap
and its commands,
you can use one of their ID profiles in here.
So in this lecture,
we're actually gonna be using a number of these profiles
and we'll see the difference between them in terms of speed
and the information gathered.
So I'm gonna start with the Ping scan.
This is a very quick scan.
It literally just pings every possible IP in the range
and if it gets a response, it'll record this response
and it'll show me the devices that gave me a response,
which means that these are the devices connected
to the network.
Now, a lot of devices do not respond to ping requests
even if they are alive.
So the list that you'll get in this scan
might not include all the devices connected to your network.
Now once the scan is done, as you can see,
we can see the list of all the connected devices in here.
And in here, we can also see the MAC addresses
for each of these devices.
We also can see the vendor.
So for example we can see that the device
at 192.168.1.1 is a Cisco device.
This is actually my router, and it is made by Cisco,
so this is correct.
So we can go ahead and start looking for exploits
in this device.
We can also see the 192.168.1.10 is a HTC device.
And again, this is a HTC phone, this is correct.
And since it's HTC,
then we know that it's probably running on Android.
So as you can see,
we're getting more information about the connected clients.
Again, we can see the 192.168.1.12 is an Apple device.
So it could be a phone, a tablet or Mac.
We can see the next device is a Dell.
So again, it was a very quick scan, but as you can see,
it still gave us much more information
than what we got from Netdiscover.
The next scan that I wanna show you is the Quick scan.
Now this is gonna be slightly slower than the Ping scan
but it's gonna show us more information.
So right now you can see that the scan
is showing us the same information that we've seen before
with the ping scan,
but it's also showing us the open ports
on each one of the discover devices.
So it's able to discover the following ports in the router,
and we can see that port 80 is open.
This is actually the port used for the router settings page
because it runs on a web server, so this is correct.
Again, we have our Apple device here
that we said it might be a phone or a computer or a tablet,
but we can see now it has port 22 open.
So this is a port for a service called SSH,
which is designed to allow remote access
to the system it's running on.
Again, if you go on all the other devices,
you can see all the open ports and the services running
on each one of these ports.
Now, in the next lecture we'll build up on this,
we'll see how to gather even more information.
And you'll see how important information gathering is
because we're going to use the gathered information
to hack into an iPhone
that is connected to the same network.