[MUSIC PLAYING]
Banner grabbing.
Welcome to the vulnerability scanning
section of this course.
So the first step during the exploitation phase
of a penetration test, will typically identify
or will involve identifying services
that are running on the target, as well as identifying
whether these services are vulnerable to exploitation.
However, before we start moving into identifying
whether these services are indeed
vulnerable to exploitation, the first step
will involve identifying the service running
on a particular target, as well as the service version.
And all of this will tie into the process of finding
or searching for exploits.
All right, so let's get started by getting an understanding
of what banner grabbing is.
All right, so banner grabbing is an information gathering
technique that is used by penetration testers
or adversaries to enumerate information regarding
the target operating system, as well as
these services that are running on its open ports.
So the primary objective of banner grabbing,
is to identify the service running on a specific port,
as well as the service version.
So why is this important?
Well, let's say you're essentially
assigned to perform a penetration
test on a single system.
It could be Windows.
It could be Linux.
It really doesn't matter.
So where do you start?
Well, you start off by performing an Nmap
scan to identify open ports.
However, your next logical step, would
be to identify these services that
are running on those open ports, as well as those service
versions.
How is this information important?
Well, the next logical step would
be to utilize the service, as well as the service version
information, to identify vulnerabilities or exploits
pertinent to that specific version of whatever service is
running on a particular port.
So banner grabbing is fairly simple
and can be performed through a plethora of tools
or techniques.
An example of this would be to perform service version
detection or to perform banner grabbing
with Nmap through the use of the service version detection
scan, which you should be familiar with by now.
You can also connect to the open port
on the target using Netcat, and that is the de facto technique
that is utilized by penetration testers,
as it is the most accurate, and you'll
see why in a few seconds.
And you also have the ability to authenticate
with the service, that is if the service supports
authentication.
For example, you can perform banner grabbing on SSH
by simply trying to authenticate with the SSH server
with the SSH client, and that, of course,
works for any protocol or service
that supports authentication.
That could be SSH, FTP, Telnet, et cetera, et cetera.
So we're going to be taking a look at how
to do all of this within the practical demonstration
of this video.
This particular video has a lab environment set up.
So all you need to do is just fire it up,
and you'll be able to follow along with the techniques
that I'll highlight in a few seconds.
So I'm going to fire up my lab environment,
and I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And the first step, will involve identifying the target IP
address that we are going to be performing banner grabbing on.
So in order to obtain the target IP address, just type
in ifconfig and take a look at the interface ethernet 1.
So this is going to be your IP address.
Now, in your case, the subnet is going to be different.
However, the target IP address will
be on the next IP within the subnet range.
So for example, if the attacker's IP
is on the second IP address, the target IP address
is going to be on the third IP address.
So irregardless of what the subnet is,
just copy this value here and change the 2 to a 3,
and that's the target IP.
So now that we've identified the target IP address,
we can move on to the next step, which essentially, involves
performing banner grabbing.
So the first tool we'll be taking a look at, is Nmap.
Now, you should be fairly comfortable with using Nmap,
and, again, I'm just going to go through this
and show you a few of the techniques
that you might not have been aware of when it comes down
to using Nmap.
So in order to identify the services that
are running on a target system or on the open ports
on a target system, as well as the target operating
system itself and the version of operating system
that is running on the target.
We can, essentially, launch an Nmap scan
with the following arguments.
So we will perform the standard service-version detection
scan, which will not only tell us what services are running
on the open ports on the target, it'll also
tell us the service versions.
We can then perform operating system scan, and operating
system scan, that will, essentially, give us
a rough estimate as to what is running on the target,
whether it's running Windows, whether it's running Linux,
and in the case of Linux, it could give us
the actual distribution release name.
We can then paste in the target IP.
Remember to change the 2 to a 3, and we can hit Enter.
So I'm going to give this a couple of seconds to complete.
All right, the Nmap scan is done.
And as you can see, we only have one port open on the target.
That is port 22, which of course,
is SSH and that is a TCP port.
And you can see under the version column
here, that it actually enumerates
the actual service itself.
So it tells us that it is indeed running.
SSH.
However, it tells us the service version.
So it is running OpenSSH 7.2p2 OpenSSH is a very popular open
source SSH server that is typically installed on Linux,
as well as Windows, so it gives us the exact service name,
which is OpenSSH and the service version, which is 7.2p2.
And it also, in this case, gives us
a rough idea as to what operating system is
running on the target.
In this case, you can see, the target is running Ubuntu.
And that is very, very important information.
And I'll get to why that is important, in a few seconds,
from the perspective of a penetration tester.
Now, one really cool thing that you can do with Nmap,
and, of course, we'll be exploring
this in the next video, is the utilization
of Nmap scripts or the Nmap scripting engine.
Now, in terms of banner grabbing,
there exists a very cool script that
can be found under the default storage
directory for Nmap scripts.
So if we list out the contents of usr/share/nmap/scripts,
and we can then pipe out the output.
And we can then grep for a specific script
that we're looking for.
In this case, the name of the script is banner.
So the banner.nsc or the banner Nmap script
can be used to identify the actual service banner.
So again, a banner is essentially
used for logistical purposes in that it
tells a user or anyone who is trying
to access that particular service, what
is running on that particular port,
as well as the service version.
Now, banners can be changed, but by default, that information
should be obtainable.
So if we wanted to use this particular Nmap script,
we could say, for example, Nmap.
And then we can perform a service-version detection scan
and then use the script.
Although, this will be redundant, and you'll see why.
And we can say we want to use the banner script.
We don't need to provide the extension, which is the .nsc.
And then we can paste in the target IP,
and I'll change the 2 to 3 here.
And lets hit Enter, and let's see what output we get.
So you can see that Nmap will perform
its typical service-version detection scan.
So it tells us it's running OpenSSH 7.2p2.
And for the actual script results,
you can see this is the banner script.
It gives us, pretty much, the same information
that we would have gotten if we had performed
the scan with a typical service-version detection
parameters specified.
Again, this is just a really quick and cool Nmap script
that can be used to perform banner grabbing
on particular services that might not necessarily
reveal what service version is running
when you perform a standard service-version detection scan.
And you'll actually come across quite a few services
that you're not be able to identify what is running,
as well as the service version, and this script
can be quite helpful.
So that is how to perform banner grabbing with Nmap.
The next tool, of course, is Netcat.
Now, again, I will be covering Netcat in its own section
within this course, but for now, if you
want to learn more about what Netcat is,
I can say what is, for example, what is Netcat, and that is nc.
Hit Enter and you can see this is the TCP/IP Swiss army knife.
It really is.
It's an extremely powerful tool.
So I can also open up the man pages for the Netcat utility,
and you can learn more about it here.
However, in this case, we're just
going to be going through a simple scenario.
So for example, we know that the target
is running SSH on port 22.
We can perform banner grabbing with Netcat by simply saying
nc, pasting in the target IP, and then the port that we would
like to perform banner grabbing on, in this case, it's port 22.
We hit Enter, and you can see it tells us or gives us
the exact banner that we would have gotten if we would have
performed the scan with Nmap.
However, as I said, many penetration testers still
rely on Netcat, as in certain scenarios,
Nmap might not be able to give you
an accurate idea of what service is running,
as well as the service version.
So you can always rely on Netcat.
Netcat has always got your back on this.
So you can see it gives us the actual banner.
Now, you might be asking yourself, well,
why is this information important?
Well, a penetration tester will typically take this information
and utilize a tool like searchsploit,
which I will cover later on.
They could say, searchsploit and then they could essentially
search for exploits pertinent to this specific version
of OpenSSH.
So I can say, searchsploit open SSH 7.2, hit Enter.
And you can see that OpenSSH 7.2 is
vulnerable to the following exploits or vulnerability.
So it's vulnerable to denial of service.
7.2p1, now remember, we're looking for p2 vulnerabilities,
is vulnerable to authenticated XOF command injection and 7.2p2
is vulnerable to username enumeration.
So immediately, an attacker is able to identify
what they can do in terms of exploitation
to this particular service.
So that is how to perform banner grabbing with Netcat.
Now, as I said, in certain scenarios,
a particular service may support authentication.
And in this case, SSH does support authentication.
So you can also retrieve the banner
by authenticating with the target system via SSH,
and, of course, you don't need legitimate credentials.
I could say, ssh root there type in the target IP.
In this case, I'll just change the 2 to 3 and hit Enter.
And we'll give this a couple of seconds.
And you can see that instead of printing the service version,
it prints out the SSH welcome banner.
Now as I said, this is something that's not very common,
but in some cases, this particular technique
might not reveal anything of importance
to you from the perspective of a penetration tester.
So you can see in this case, it's just
printing out a welcome message.
So that's really not helpful.
However, for other services that support authentication,
like FTP or Telnet, you can also try and utilize
the standard authentication client
to identify a banner or information that can be useful
later on during exploitation.
Because I don't have the credentials,
I'll just terminate that particular authentication
attempt.
So that is how to perform banner grabbing with Nmap, Netcat,
as well as the relevant authentication
clients pertinent to the service that's
running on a target system.
And this is going to conclude the practical demonstration
side of this video.
All right, so in the next video, we're
going to be taking a deeper look at the Nmap scripting engine,
in context or in the context of exploitation
and identifying and testing vulnerabilities.
And again, we'll take a look at how
to utilize Nmap scripts to identify or to check
whether a particular service or whether a particular target
is vulnerable to a particular exploit.
So I'll see you in the next video.