Hello everybody and welcome to this tutorial. Today, I will do some actual
scanning, and for that I have picked a domain outside of my local area network.
You can find this on the nmap official site. So it's scanme.nmap.org.
This domain they have given and you can feel free to scan it. Well, not as
much as you wish because you know a hundred times a day is not okay, but a
couple of times a day is okay, and you can test it out whether your nmap
works, and how it works. So, I need to take this domain. You cannot use control C or
control V in the terminal, primarily because control C is the universal
interrupt, and control V will simply not work. You will need to use a mouse and
manually do it. In any case, we need to trim this down, we don't need any of
these things, we just want the main name to remain. And now I'm gonna go
ahead and type in nmap, space, and there we go. We're gonna now scan this domain.
However, if I just press ENTER like this...
it's gonna conduct some scanning, it will do the job I assure you,
but it will give us no output whatsoever. So this will be continuously
empty until the scan is actually complete. Now on short scan such as these
that's probably okay, but if you're conducting a scan that can
last up to a day, or something about kind, it's pretty worrying to see that there
is nothing here. I mean you're not sure whether it's working, is it
bugged, or what not. That's why it's always better to pass a V
option for verbose output. I have a preference to pass the double V option
for extra verbose output, pretty much. So it tells me pretty much everything that
it is doing, and how it is functioning, and I can see it as it goes on, and I can
see that some ports are open a little bit earlier prior to the
completion of the scan. I'll just go ahead and start the scan, and you can see
immediately, before it finished the scan, it has told me that port 22 and that
port 80 are open. Now by default, nmap will scan for 1,000 ports. You can tell
it to scan for more ports no problems. You can tell it to scan for the maximum
range of ports, it's 65,000 something. I'm not exactly sure what the end number is,
but it's 65 thousand something, and you can find this on the net if you wish.
You can pass an option to nmap to do a full port scan, so all of
the port's will be scanned. Although, rarely anybody does that. It's
time-consuming. Usually you have an idea what sort of services you want to target,
and then you scan for the ports on which those services are likely
to run. For example, port 22 that would be SSH, and port 25 that's SMTP. If you don't
know what that is it's a mail server. 80 http, and you have nping-echo as well
on port 9929. Now the states of these ports are rather clear. So it's
open, open, open, and you can also get a state to closed. Because it says here not
shown, 996 ports closed. They are closed. And when it says filtered, well, usually
there's a firewall setting which is dropping the packets. It's not closing
the board perhaps, but it's definitely doing something to the packets that's coming on
that port it's filled. It's perhaps blocking them from a certain IP, or
something of a kind, there can be a lot of options here. In any case, the general
meaning of this filtered flag here is that the nmap can not determine whether
the port is open or closed. Usually, you want to stay away from those
ports, or you can do some extra research and find out how you can access them.
Maybe they require a particular app, or a particular protocol, or something of a
kind, to be accessed, and that's why nmap cannot actually figure pretty much
anything out of it. That can be a bit problematic. I would definitely, as I said,
advice to stay away from them. Stick to the open ones and see what you can do
with the open ports here. Now nmap also has an option to create graphical output.
Basically, what that means is that you can sort whatever
you get, whatever results you get, into a file, you can store it, and sort it as
well. And then what you gain is an ability to actually extract
pretty much separate bits and pieces of information. For example, if you just want
the IP addresses of hosts that are up, or you want the IP addresses of hosts that
have port 22 open, or filtered, or that are running a certain service like SSH,
or SMTP, or HTTP, or something of a kind. However, I won't be doing that for
scanme.nmap.org. I believe I have used their system enough, and for
this example I require a range of IP addresses to give you a
meaningful result. So what I'm going to do is scan my local subnet. And if you
don't know what yours is, well it's most likely configured as mine is,
but if it's not, just type in...let's just clear the screen, first. Type in ifconfig
and you will get a result here for eth0, or for whatever interface you are
using. Just take a look at this IP address that has been assigned to this
interface. So the lowest and the maximum value of the final octet here, or the
first octet here, will be the range of your local subnet. So from 0
to 255. Let me just show you what that looks like in case you did not
understand here. Type in nmap, and then for a graphical output we need -oG,
- and then we need to give it a range of IP addresses. So, 192.168.1.0 -
255. So it's gonna scan for all the IP addresses that have this, and that go
from 0 to 255. Now keep in mind that I can customize the strange anyway I want.
For example, here where it says 1, I can type in - 67. So it's gonna
use these, it's going to use this octet, and this octet in combination, and it's
gonna scan for all possibilities, although that might take a lot of time because that's
a lot of IP addresses. Anyway, I'm not just done, yet. What I need to do is
actually cause a redirect. So, before I cause a redirect I'm just gonna give it
a double verbosity mode. And, why am I redirecting my standard output? Well, I
don't want all the information to just be printed out on the screen, on the
terminal screen, where eventually it will be lost, pretty much as soon as I close
the terminal, or as soon as enough commands are passed that the cache needs
to be rewritten for the terminal, or something of a kind.
Furthermore, if it's written out in standard output and on the terminal
itself, I can't do anything else with it. I cannot manipulate it, it's not a file
that I can take, or something of a kind, rather instead it's just standard output.
What I want to do is cause a redirect with a greater than sign into some sort
of a file. So I'm just gonna go ahead and type in /home/ and I don't know I can...
maybe not home. Well, not even desktop, that's not a
good idea. Let's just leave it at home, that's better.
And I'm gonna name this file SCAN, excellent!
So, all the results that nmap gathers now will be stored into this
file here, well into this file here, and this is the path to the
file. Since I have passed a good amount of hosts here, I mean I've given
it 255 hosts, because I'm in LAN it's gonna go faster. But when you're
doing this over the Internet, a very good idea is to pass a port, or at least a
port range. Don't let it scan all 1,000 ports. Or, even worse, do not specify that
it should scan a full port range, primarily because regardless of what
sort of internet connection you have it will take a good amount of time to
finish. Furthermore, I mean you're bound to trigger some red flags, or something
of a kind, so you should define a port here in order to save yourself a lot of
time, and I mean generally you will know which
service you want to attack, you will have some sort of an idea there. I'm gonna go
ahead and pass port 22, that is the port that I wish to scan for, and press ENTER,
and hope to god that it works. There we go it is functioning, it
finished rather fast, but even though I passed double verbosity mode,
everything here is being redirected here. So, I will see nothing.
If this scan takes longer when you're doing it over the internet, and it will
take longer if you're doing it over the Internet,
don't think immediately that something is bugged. Primarily, because
nothing is being written down below. If we just changed home and list what is
there, there we go, we have the scan. So let's just do this, ls, now look what
I'm doing here. I'm gonna do a very similar thing with our scan file, and I'm
gonna type in grep SCAN, press enter, there we go. I have
passed the LS command to list pretty much everything within the home
directory, and then I have piped the output of LS to grep,
basically pipe means just pass it, I've passed the output to grep, and what grep
does is basically pull whatever you specify here. It just pulls it from the
output. I've told it to pull whatever is in there, that has the name scan, or that has the
string scan within it. So I could have had a name like AAA,
scan, BBB, it would still pull it, no problems. This is one of the ways in
which we can make sure that the file is located within a certain folder,
especially in situations where you have hundreds of
files in a single folder and you just can't go through them or manually. Just use a
grep if you know the name, or if you know a partial name, in order to figure out
what is where. So let's just go ahead and clear the screen, and let me just show you what
is located within our scan file. So less scan, press Enter, and there we go. So we
have pretty much all the hosts within my lan network, within my local subnet.
They are all down of course because I don't have 255 computers or devices
within my home network, rather instead you see what it has found. It has found
this is the router IP, the router that I'm using for this test, and it
says port 22/filtered/TCP/SSH, excellent! That one has an open port of 22.
Also, it's status is up. And I also have on 100 status is
up, 22 is closed, on 102 it's up, it's filtered, and so on, and so forth. So let
me just go ahead and with this, and I'm gonna do a very similar thing here
because I want to leave it on the screen so I can explain it to you, the less
command is very nice but when you exit it disappears. Cat however just prints
everything within a file to standard output, and it stays here pretty much for
the duration of the terminal. The reason why I did this will become apparent
quite soon. So what you want to do now is type in cat SCAN as before, and now we
want to pipe the output of SCAN to grep in order to pull something out of here,
some sort of useful information. Let's say that I want to pull all the hosts
that are up. I want to pull all live hosts, I want to see their IP addresses,
and when I type in grep, what is the universal markation for all the
hosts that are up? Well, you have a flag here, status and then flag up. Let's
just go ahead and type in up, press Enter, excellent! I will just give you
a bit of clarity, there we go. You have these flags
which are up, so I have all the hosts here that are currently up and running,
that are alive on the network, but this is not what I want. If I wanted
to pass these IP addresses to another program, or something of a
kind, I wouldn't be able to pass this whole line because it would make no
sense, if the other program is only requesting the IP address of the host. Because
you can do one nmap scan just to see which hosts are alive, and then once
you figure out which hosts are alive then you can do a more detailed scan on
those particular hosts. And in such a way you would save a lot of time. So we have
these hosts here, but we want to pull these IP addresses. And I'm afraid I just
can't do that with grep. Perhaps I even could, but I mean it would just
be too complicated, and too complex, and it really wouldn't be practical.
That is why Linux has something that is called awk, so awk. It's basically used
for formatting text and pulling out certain parts of a file that you have
deemed that you need, or something of a kind. Now you can make a separate
tutorial on awk, you can have hundreds of hours, and there would still be features
of it that you would not know. I would strongly advise you to
familiarize yourselves with awk, take a look at the man pages for awk,
however for the time being, and for the purposes of this tutorial, we
will be using some basic awk commands which pretty much everybody uses, and
which are a necessary part of pen testing. Primarily, because you need to do
stuff of a kind that we're gonna do here. So cats can print everything to standard
output, grep Up. So grep all lines
that contain the word up, and then what I want to do here is eliminate this part,
leave this part in, and eliminate this part. Now how shall I do that? Well, the
first thing that we need to specify is a field delimiter. What a field
delimiter is, basically if you say that the colon here is a field
delimiter, this will be one field, this will be another field, and this will be
yet another field, so you will have three fields in total. However, that
doesn't really work for us, does it? If we say that the colon is a
delimiter, this entire section that I've
highlighted will be considered a field, and we will have parentheses, and the status,
the parts that we don't really want. What you can use as a field delimiter here
is a space. So space here, this is one field, this is gonna be another, and this
is gonna be again a field delimiter because there's a space, and this will be
a third one, and then you have a again space, and the fourth front, and so on, and
so forth. So in order to specify a field delimiter to be space, well simply
leave an empty space in between the quotation marks. Generally,
you would put quotation marks and you would specify a field delimiter in
between them. If you wanted a colon, this is how you would
do it, but we don't want to colon. We just want a space and that's it. Open
single quotation marks, open curly brackets, type in print $,
and then you just need to type in the number of the field that you would like
to print out. So we would like to print out the second field, 2, close curly
brackets, close quotation marks, press ENTER, and there we go. We have all
the IP addresses listed of the host that are up without anything else. Now what
you can do with this is, well pass it to another file,
it's called SCAN2, press ENTER, and then you can type in nmap - iL
scan2, then you can do a full nmap scan for just four hosts. This might take
a bit...no, I don't want to view it like that. Let me just give it a double verbose, excellent! So now you can
do a full scan for just four hosts, instead of doing it for all 255 hosts.
Just figure out which hosts are alive, and you don't need to do that with port
22, or something of a kind, just do a ping sweep, and that's gonna be it. You will
be able to figure out which hosts are alive, perform detailed analysis of this
particular host, and you can see I'm already receiving
information here. It says port 21...yeah, that's not the best of ideas, but this is
my home router that I'm using for these testing purposes. It is filled with holes,
and I don't worry about it. I'm gonna switch it as soon as I'm done with the
tutorial. I have 443 on 102, so I probably have some SSL going on
there. Port 80 here, port 23. We will soon see what all these services mean. However, you can
experience these flags here and usually you will get delays, because
you know there are some packets that are being dropped, some that are being
refused by the servers on the other side. You can also have time limiters, and so
on, and so forth. So here you can see scans and what they have revealed thus
far. They've given me detailed scans and they can tell me pretty much everything
that I want to know in regard to the local area network. It even gives out the
MAC addresses which I'm gonna cover up and you won't be able to see them, but, in
any case, you see how much information you get. and how much time you can save.
Now I am gonna call this tutorial here and we will move on to the next one. I
hope that you've enjoyed this one, and I'll see you next time.