So as you said earlier it's very important to understand that all the attributes of the map before continuing
with its course.
That is a tool called z map which has all the presets of what they're going to study in this video but
I advise you to go through this video in order to understand the details of all of each of these.
First of all if you want to have an end map target selection the default comment and map then you put
the IP address or put the IP address of my local machine
and then you stop you present it.
Let's do this example here.
It is the result.
It's finished in six point thirty four seconds and these are reports.
Or if you want to scan hostname you can do a man w w w dot whatever ABC e they've come and will give
you the same results as one previous computer just kind of range of IP addresses you go and map.
You type in the IP address and dash the range and then you presented the scan all the IP is within this
change if you want to scan a subnet is can.
This way if you have a determined list of ip addresses like I did here put them in a text file.
This is the text file here.
So this is the format of your text file.
You put all the ideas in there and then you issue this command and map minus uppercase.
Then the name or the file and then you press enter into those can all the ideas in this file going forward.
We'll see how to select words or a range of ports in order to scan if you want to scan a certain port.
This is the command you need to issue my spirit view.
And after that the name of the port or name of certain ports and a command professional then you put
the IP on the Italian machine then the press and area see that the SS each port on the target machine
is if you want to scan a range of ports to use the same command for example scan port one two hundred
on this target machine it will go through all of these ports.
And here we go.
We got the same result.
If you want to do it fast can you use the attribute F which scans which scans the most common use ports
the default.
It's good to mention that the default and a map command can thousand ports and it's going to take some
time.
So if you want to scan the most common port numbers you use the minus f attribute.
And here you can see that we have the S S H port open in addition to the advice for some people.
So if you want to do an extensive scan for all the ports issue this comment minus B and then the idea
is minus B and then minus and then the IP address it will take a huge amount of time because it's scanning
almost all the sixty five thousand ports and similar intense IP scan as well can be used using this
command like you need all the ports here.
1 2 6 5 5 5 and then you issue these two groups minus four minus a minus B what are these attributes.
As I said the minus B is the the port numbers from 1 to 6 5 5 minus the fourth template is the timing
template.
Actually this is an attribute that can go from D Udall to G by you know being the slowest type of gun
and T five being the first this type of stuff.
We are controlling how is the response of a map and how fast it is in this camp.
So actually this is a timing template and it gives it use it in an easy way to tune how fast and my
performance as we said earlier in the video previously that goes from 0 2 5 0 being paranoid to one
being sneaky 3 0 being paranoid one being sneaky to being polite is the normal for aggressive and quite
insane which is a minus a attribute actually it's an option that connects and math make an effort then
identifying the target os the services and division.
It also does a trace stroke and as well applies some S E which is engine scripts in order to detect
additional information.
This is a huge.
And it's actually quite noisy as it applies to many different kinds
if you want to select the type of this can you issue these comments and map minus s t and then the IP
address of the target machine as you said earlier we have two types of scans the since con which is
the default one and the connected scan if you want to pause and map to use the nets can you issue the
attribute minus SD.
So here it initiates a three way handshake like you send the egg and wait for the nugget machine to
play back with us.
And then the machine will send honesty packet and all the complete three way handshake if you want to
use the default type of scan use minus as actually if you want to scan UDP port you use the attribute
minus s you and then you need to specify the port types or the port numbers that you are scanning that
say here one two three and 1 6 1 then 1 6 2 of these ports are the S&P and the S&P trap as well as the
entity let's see how it goes here.
So as we said earlier EDP scan is different and if you scan because that doesn't include a three way
handshake as you see here with automatic blood with the results for the ports actually three of these
sports are filled to have more information we can many more examples can be given like a map minus a
then the IP address this can as we said earlier the minus a attribute will do its best to determine
the S type and the services running and it will issue it will use the NSC scripts in addition to doing
the case drop.
Another example is having a light banner of grabbing detection by using this command as V and then Virgin
intensity is controlling the intensity of the scan say 0 this the target I here the minus as the attribute
determine.
Actually the service is running on its own machine.
It actually rule the open ports to determine what services and the Virgin they are running for the service
thus running the sky against a target agency.
These are the results of the minus as the attribute.
It shows that the SS each port is open as well.
The version of the SS H that is running on the target machine.
If you want to do an intense scan with no ping the map can consider the target put up and running.
We use this in Steve for the template which is fast a attribute and then the be an attribute this is
that we consider as the target machine operating and the v attribute which is the intervals or verbose
attribute which gives us the status of the scan.
What's going on.
And then the the address.
Let's see.
So as you can see it's giving us a realtime update of the scan.
And here you go.
It's actually a good scan though did some NASA cribs.
And here are the results.
The SS each port is open and the assembly ports are open.
It also gives us VIP fingerprint which is a combination of passive data that defines the VIP stuck on
the atomic machine where one hope away and this is the S&P information medium.
Actually it's a pretty much useful information if you want to do a thing or sweeps can use the minus
s and attribute pretty fast.
If you want to output the result of a certain scan to a text file you use the minus or G attribute and
this is the output file and then the IP here it should create now x file and test output C and that's
it.
And here we go.
This is the result of this guy.
Now let's talk about the NSC which is the map scripting engine and that comes with resets or flips that
you can find under U.S. or
these are all the scripts that come with.
Actually you can invoke them while running the.
For example we can check for SMB vulnerabilities using this command and map show and buzzy.
Select the S&P points and use this attribute script to reference any script or I'll use the S&P for
s discovery and target e.
Here we go.
This is the result of this time and all the information related to the S and the it is good actually
to talk a bit about the map scripting engine.
Actually because it's one of the maps most powerful and flexible features it's not only just came for
snow.
It can be used to discover the network to have sophisticated version detection.
In addition to vulnerability detection factor detection as well as vulnerability exploitation.
So users can actually rely on the growing and diverse set of scripts that are distributed within the
map.
Or you can write your own script to meet any customer needs NSC script.
Thing is beyond the scope of this course but it was very beneficial to give an overview on the powerful
tool and the capabilities of the.