OK, so in the last lecture, we talked about a witness capturing screenshots of our targets at Skell
and now we're going to get into port scanning so you could use and map the map is good, but map is
like a precision surgeon ready to analyze the responses, has intelligence to determine if a particular
service is listening or non-standard port maskin is more like a flamethrower.
I was just going to throw a flame across the Internet and scan everything in five minutes.
Right now, the way I like to do this is over my scan and I'll take the results and put them into investment.
That way we can get more details of this open for us.
The other thing, though, is that Maskin only takes IP addresses right as input.
So it's super fast, but it only takes IPPs, but we have ptomaine, so what are we going to do?
And that's why Restacking created the maskin.
So it's an archive project, but basically it's a wrapper around that scan and it allows you to feel
domain's into maskin so you can scan those.
And here's the basic usage, so I just want to show you guys how we can combine the flexibility of having
subdomains with the speed and efficacy of maskin.
All right.
So we do maskin.
You can see we have Mathcounts tolerate it.
And so by default in Kalay.
But again, it takes IPPs, we have Domain's and subdomains.
So this is what we can do and we'll put it in UPT.
Right.
So it's complaining because the folder is empty.
So let's just go into that folder.
Oh right.
So let's rerun this.
I'm just going to hit the right arrow to autocomplete and backspace out the destination.
All right.
So now we've got these maskin.
Let's see if we can run it.
All right, very cool, but we're running out of options, Maskin, so we could create a symbolic link
that will allow us to run it from our home directory.
Would you be kind of nice so we can do L.N. symbolic and we'll link up Dean Maskin, Dean Maskin to
user Ben Dean Maskin.
The reason I picked user Ben is because that those in our path here, so now, even though I'm in the
home folder, I should be able to type them, scan.
Very nice.
Right.
And this is actually good because this is where all my files are.
So what we can do is we can say Searoad Maskin and we can give it the PayPal combined file as the input
file, the file containing the domain names to resolve and scan input file.
And then we need a Dienes output file, so we'll just call that DNS dot blog and then we'll put everything
into PayPal that Dean Meskin.
All right.
So while this runs, let's split the screen and examine the combined file again.
You can see it is running, but it's using the default speed of 500.
Right.
So if you want to change that, you would just add the option to meskin options here.
You change the rate to something like two thousand or one.
Obviously, the faster you make it, the less likely you'll actually get detections.
You'll probably have false negatives.
So this is inversely proportional, right?
The quicker you go, the faster you finish, but the less detections you'll have.
So if you wanted to modify this rate, you would add it after this DNS log parameter right here.
But let's let's take a.
But the idea here is that we're going to get an output file, right, that contains open ports and then
we can feed this as input into a map and scan those ports for versions, for services and versions and
things like that, and even run some Inmet scripts against them.
We can output those results as an example file and then send that into a tool called brute spray, which
will then automatically attempt default creds found from the EMAP output.
So hopefully you're starting to see how everything works together.
And this is pretty simple to install and install Rouzbeh.
All right, so my session just unceremoniously closed and kicked me out, which is quite rude, but
let me see if I can get back in.
Teams attached.
All right, we're back in business.
That's why I like Demoex.
All right.
To control a shift five.
And we'll do a cat.
PayPal combined, let's do control alt the you may notice that there's no protocol prefix for any of
these domains, right.
So let me show you guys something.
Shivji to go to the bottom I to answered.
Let's put this in this review
scape shivs.
Easy, cat.
Now we've got a few.
Right.
Let's say you wanted to get rid of these HTTP protocols because by default, these maskin can't scan.
Domains that contain the protocol prefix, so you could do something like this with Orch, you could
run a field separator.
On a forward slice, right?
And then.
You could print the second filled of the file and see how to solve that problem.
Everything else is missing because nothing else, you know, nothing else had the the HDP part.
You could also do this and that print out everything.
And it also includes the domains that we changed then, of course, you could just output that to a
new file.
And you're on your way, control, easy exit.
That looks crazy, but it's working.
Wow, that looks absolutely amazing.
It's like putting a mirror inside of a mirror.
This is this is the Inmarsat guys, right?
So in the next lecture, we're going to get into go spider.
So I will see you in the next picture by.