Original subtitles

OK so now we have key objects up and running.

We need to determine where it actually is and then we can do a little bit of scanning.

So what we're gonna do is we're gonna go up into our applications and open our terminal.

I'm just gonna make this a little bit bigger and we're going to run a tool called Net discover.

So before we can do that we need to type in.

I have config and identify your IP address and it's going to go ahead and copy this first three octet

here and we're gonna run it discover so net Discover is gonna look like this.

We're gonna say net discover we're gonna do a dash are for range.

We're going to paste in this and do a dot zero slash 24.

So what are we doing.

We are going to be using ARP to detect all the machines on the network.

So you should be familiar with our from the Linux lessons and from the networking lessons.

So we're going to attempt to use ARB to address anything on the network and we're sweeping the entire

subnet of soft 24 something go ahead and enter and in a second here.

Our machines just start popping up and it does.

So remember our host was at 1 thirty nine.

This host here at 134 is likely our culprit.

So you should only have two machines in network because you're only running two.

You can ignore dot 1 2 and 2 5 4.

We are only focusing on the one that looks similar to ours which is 1 9 2 1 6 8 57 1 34.

So now we know our machine address.

We can start attacking it some go ahead and hit control C which is going to kill this session here and

then hey control alt to clear my screen.

All right.

So I'm going to open up a notepad and we'll just store this away for a rainy day.

We need to first talk about what we're going to be doing here.

So remember before when we ran our teepee three way handshake we had something like sin sin AK and AK

Right.

And we had to say sin act like this to combine it.

So we've got three parts.

We've got the part where we reach out to a port and we say hey port are you open.

And the port says yeah I'm open.

Let's go ahead and make that connection.

And then we go ahead and connect to it.

So what we're gonna be doing is we're gonna be using a tool called n map and map stands for network

mapper.

Now what network mapper is going to go out and do its is going to scan for open ports and services.

Now this scanning is going to take place and it's going to identify these open ports with something

similar to this three way handshake.

So we're just gonna modify it a little bit.

Now what the process that we're doing is called stealth scanning and it used to be written out like

this.

Now it's just done by default.

And we'll get to the switches here in a second.

Don't worry about that just we're going to be running stealth scanning and now this stealth scanning

used to be stealthy right.

That's why they called it stealth scanning because it used to be undetectable nowadays very detectable

if you run and map in a network that has good security you're going to get picked up although being

a pen tester I would say and that probably doesn't get picked up in 80 percent of the assessments that

I run.

So don't expect clients to be running good security but just know that even though it says stealth it's

not stealthy at all.

So this stealth scanning why was it stealthy why was it called this.

Well if we go back to the three way handshake what the stealth scan does is it does the sin says hey

I want to connect to you in the open port if it's open we'll say yeah I want to make that connection

back with your friend.

And what's going to happen is we're just going to say you know what.

I'm just kidding I'm going to send over this reset flag.

So this asked me why.

Well that means we don't actually establish a connection.

So like when you go out to a Web site and you go to Google and Google loads well guess what you establish

a connection you establish that three way handshake.

What we're doing is we're going out and we're saying hey I want to establish connection.

The port reveals to us that yes I am open for connection and then we're gonna say just kidding.

Let's not make that connection because we never established that connection.

Then it was technically stealthy.

So that's why we're going out we're doing we're never making connections these ports.

But this is how we're identifying them as open.

So we're going to use a tool and we're going to use a tool like this.

We're going to say and map and we're going to say something along the lines of dash T for Dash Pete

Ash dash a.

Now you have no idea what this means and I don't expect you to.

I'm going to walk you through these and what we're doing here is we're saying hey and map I have a choice

and speed in that choice and speed can be between a one in a five one's really slow and five is really

fast.

Now the default for me has always been for now I'm teaching you my preference.

It's always been four.

OK.

And we utilize this in I think five five.

OK but five kind of fast maybe you're going to miss something.

Maybe it gets caught the slower the better in terms of detection.

But in the instance that we're gonna be running it through this course we're gonna use for any time

you do like a bold hub or something like a hack the box which you're going to see here in a few videos

you're going to run T4.

Just because you're not worried about this detection not worry about anything.

So T4 is a speed purpose.

Now dash P dash.

Well this stands for I want to scan all ports.

OK.

We could say something like dash P or we could just have dash P left off completely.

Now if we leave off dash P completely it's going to scan what are known as the top 1000 ports the top

1000 ports are your most common ports.

So think of like port 80.

Port 4 4 3 1 3 9 4 4 5.

All the ports that we covered in the networking section.

Going to show up again here.

But there are sixty five thousand five hundred and thirty five ports out there.

We want to scan every single one of those because what if for example there is a service running on

Port forty seven thousand seven hundred well that's not a common top 1000 port if we don't scan all

ports then we're going to miss that port.

And that could be something incredibly valuable to us.

Right.

So I always scan like this dash P Dash.

You can also do things like scan specific ports.

You could say like four for three or say you wanted to scan just for web servers you could do eighty

four for three something like that or you can mix in.

So you want to scan for DNS as well you can add in fifty three etc. You can scan for specifics if we're

going to get into that in a little bit a later video on why we might do it this way.

But for now for the beginner lesson dash P dash we're gonna scan everything.

And lastly we've got this dash a in here so dash a stands for everything.

I want to scan all of it.

I want you to tell me I want you tell me the version information the operating system information anything

you can tell me fingerprinting etc..

Now this may all be confusing.

It's gonna make a lot more sense when you see a scan.

I'm going to go ahead and open up a new tab and what I want you to do.

Let's go ahead and I'm going to blow this up for us.

And what I want you to do is I want you to go ahead and start running the scan.

While we wait to go ahead and copy this here and the last thing we're going to do is we're gonna put

in our IP address and that's how it knows where to scan where it is going to hit enter on that and now

we're standing so from here what we're gonna do is we're going to take this.

And I want to run an app again with a dash help and I want to talk through some of these settings in

here so that you understand fully what we're doing now dash help is always great.

As I said before man pages are good as well.

But let's talk about some things here.

So we've got this host discovery section which we're really not going to use in this course but this

is good for say a dash.

And so you want to do a pink sweep of the network.

Well you can do a pink scan right where you just sweep an entire subnet a slash 24 for example and see

what's up.

Very quick a dash pen maybe the host isn't acting like it's online but you know it's there for sure.

You can say dash pen and you say hey I want to leave all the hosts or treat all the hosts as if they're

all online even if they're not responding to my ping request or anything.

So make yourself familiar with this kind of stuff.

This is interesting and we'll cover a lot of this as we go in the course.

But just for the first walkthrough while we're scanning I think this is super important.

Now scan techniques.

This dash as SS comes back into play.

TGP sin is what it's called but it's also known as the stealth scan.

There's all these other types of scans.

You're not going to need them.

There's only maybe one scan out of all these that may be useful but you're not going to need them through

this course and you're probably never use anything but the SS and the ESU.

Ninety nine percent of the time.

So for the scope of this course that's what we're going to focus on now.

The SS We've talked about connection oriented protocols we talked about TCB.

Well guess what.

There's also UDP and there's sixty five thousand five hundred thirty five ports over there as well that

we have to scan now UDP is a connection less protocol.

So what we're going to do when we scan it.

Let's go back to this scan.

What we're gonna do when we scan it is we're going to actually do that Eskew in here and I'll copy this

syntax and just move it over so it looks a little cleaner.

We're gonna say something like

we can put it anywhere we want big.

The order doesn't matter but we can say something like dash as you to scan for UDP and the one little

change that I make here to change is actually I take off the dash a and I do a dash P dash.

Why do I do a dash I should say why do I do this.

I do this because UDP takes for ever to scan absolutely forever to scan because it is a connection as

protocol.

It does not have that instant response time.

So when we scan UDP typically we scan the top 1000.

That is my recommendation to you or else you will be sitting here waiting for hours upon hours for a

scan to finish.

See now our scan over here is already finished.

If I were to run this UDP with the same thing it will take forever going back into this before we get

into the scan you could see here that we can specify dash P of Port.

That's going to be very common for us.

But here's where I really want to get into we're doing a dash s v a dash SC a dash.

Here all with the dash a.

OK so we're probing open ports for service information.

We could say dash SUV and we can say dash I see you could pick these you know one or the other a mixture

of some of these but we could also do script scanning which we'll get into script scanning here and

a little bit as well but we can do OS detection where it goes out and tries to define an operating system

and you're going to see all this with our scan.

But when we use dash a it does it all for us.

So why why not use dash.

So you can see it does OS detection version detection script scanning and trace round.

Now there's one caveat to dash a we're going to talk about this in another video and a thought process

it is much faster to remove the dash a and scan a dash P dash.

Typically that'll come back much much much faster than what you can do is you can define the open port.

So say there's Port 20 to port 80 OK.

Just go through this.

You can specify those ports specifically.

You could say dash P like we did an example earlier with 18 4 4 3 and then do a dash 8 on those.

Now that will this scan only these specific ports with all instead of going out to every single port

in attempting to do all on every single port.

It's just a little bit faster.

Now if your wheels are spinning and you're thinking about it maybe even you can script this right.

You can script something to say hey Ed map I want to take I want to take these ports from a basic scan

anything that you pull back and I'm going to go ahead and I'm going to run a new scan on it with a dash

a only specifying the ports that we found back gets your wheels spinning.

This is where scripting becomes important.

If you want an improvement on speed.

For me personally I've never ever done that.

I don't think for me personally that it's made much of a difference.

I just let my scans run as they run and I work on other things while scans are running.

There's plenty of time to do other things while you're doing your scanning.

So in typically another thing to note is typically we're doing scanning when we're doing our O.S. as

well so if we start up a client assessment one of the first things I'm going to do is probably kick

off a NASA scan or an end map scan.

And while I'm doing that I'm going to go look for those breech credentials or I'm going to look for

that juicy information on Google or social media or I can find it and utilize that time.

While this is scanning or else I'll just be sitting on my hands doing nothing while these wait.

So we're gonna take this information now and we're going to start reviewing it.

So we have here our scan results and you can see the scan results come back and the first thing we notice

are open ports.

That's what we want to look at.

We want to look at these open ports and we want to look at what's running on these open ports.

So we see here that what's running on Port 22 is SS age.

OK.

On top of that it's got a version here for us.

So open SSA SS H two point nine P to and then we see Apaches running on port 80.

We've also got Apache running on port four for three and we've got this RPG bind in one thirty nine.

Now remember from the networking lesson these kind of always play together.

So we've got SMB open basically samba shares and what we can do is first step is usually enumeration

once we see this we take the scan and we scroll down a little bit as well and we can look at some things

and see OK there's no OS information.

It found Linux here two point four point x.

And it's most likely pulling that down from from the the Apache.

It's probably a best guess because it's running red hat that it's running Linux and taking a stab at

it here or may have actually determined that from sort of header or some other location.

A lot of times this isn't so sure as it's saying it is here.

A lot of times we'll give you a percentage so the OS is not always definitive as it is here.

So we've got the OS which could be useful for us later when we do enumeration and you'll see how that

comes into play.

What I want you to take in right now is that so far we've got a scan result back and that scan has gone

out and it has looked for open ports doing that modified stealth handshake.

So it says Cin Sinek reset Aristide doing that it's found a few open ports now it is our job to look

up the information that we are seeing on these open ports and try to find exploits on them.

So that's what we're going to do and I'm going to cover in the next video we're going to go kind of

step by step and I'll talk through the methodology and why I attack certain ports first what ports those

are how we can enumerate those ports and then we'll enumerate everything get all the details down once

we have all the details down.

We're going to move into the section of exploitation.

It's going to get really fun and we'll exploit this machine in multiple ways.

So from here just take apart or take that away from the lesson that you've officially successfully scan

this machine.

I encourage you to maybe go back and take notes or to go back and scan it again get the syntax down

in your head keep typing this out remember it.

This is the one thing you probably can type up more than anything else.

And then also go through and look at the different types of options you have there.

If there's one that interests you just run it against the machine play around with it.

This is your lab time.

Make the most of it.

So for now that's it.

In the next video we're going to start enumerating these ports.

So I will catch you over in the next video.