Hello everybody and welcome to this tutorial. Today, I will show you a little
bit more stuff that you can do with nmap. But more
importantly than that, I will show you a tool which you can use
to assign a physical location, namely a city, to an IP address. It's relatively
precise, it's relatively good, but the downside of it is that you can only make
1,000 queries per day. Which is still very reasonable, I mean
1,000 queries per day is a pretty good thing. However, if you're doing some sort
of mass scanning, or something like that, it won't really help you. You will need
to go online and download the libraries for that. But 1000 is a very good number,
and let me just show you how it actually works. So here I have a command. This is
the command that I've used to scan, scanme.nmap.org, and to get some
information from it. So it's curl ipinfo.IO/, and then you get an
IP address here, it's a curl script, just copy paste that here. And this is the
command, curl. This is the argument that you are passing to it along with the IP
address. Once you press ENTER it queries the server, and there you go. You have an
IP, and you have a host, you get a host name as well. You get a city, it's
Vermont, its region is California, a country, U.S. You even get some
coordinates here, organization, postal code, and so on, and so forth. So you get
some really useful information here in regard to an IP address. Bu,t as I said,
the downside is that you can make only 1,000 queries per a day. So you're not
doing anything illegal here, or anything of a kind,
you are simply querying a database somewhere in the world to give you
specific information on an IP address. You could have done this by simply
typing on the net who is, however I wish to teach you how to do these things in
the terminal so that you would be less dependent on the browser, or things of a
kind. Anyway, let me just go ahead and clear this. Now what I wanted to discuss
with you today are some external resources which you can use in
combination with nmap. Nmap has a wide variety of scripts that are
applicable to it, and then you will be able to use nmap in order to scan for
particular vulnerabilities on the servers elsewhere in the world. So just
go ahead and open up your browser. Okay, so I have this website, scanme.nmap.org,
open here, and on that website there is a link, it's nmap.org,
and then some link here. You can just copy paste this if you wish, or something
of a kind, just read through it, and then navigate over on their website. But
it's not really that hard. Look, I'm here on nmaps website, and I
have a list of categories, of what sort of scripts can I run with nmap in
order to scan for particular vulnerabilities. So I have...there are
490 scripts, which is a lot. So I can for DoS, for denial of service attacks, those
sort of vulnerabilities for exploits, for, I don't know, external, for brute-forcing,
for authentication, etc. Anyway, let's just go and click on one of them. Pretty much
any will do, it's not a problem. I'm gonna go ahead and click on vuln,
general thing, and now I have all these things here. So if you're wondering, well,
how can i bypass firewall rules? Well, simply use a script. It says firewall-
bypass: detects vulnerability in netfilter and other firewalls that use
helpers to dynamically open ports for protocols such as ftp and sip. So
this is gonna help in a good amount of cases. You can go ahead and
let's open it up in a new link, in a new tab, sorry. And once you click on it
you'll get the exact syntax on how to use it. So, example usage. It gives you the
exact syntax, there is nothing different that you need to do here. Instead of
just type in the IP address, and that's
it. Literally, that is the only thing that
you need to change here. Just type in, copy paste this command, so
just copy it, and then just change the last thing into the IP address that you
wish to scan. Now I'm not gonna go through all of them. As I said there are
490 scripts. We will be using some of them, however, in the later tutorials
where you will get some clear demonstrations, once we actually start
attacking particular services, and start exploiting their vulnerabilities.
However, again, I won't go to all 490 of them because the the course would be
ridiculously long, but you can go there, you can go to the nmap website,
find this, so look you have security tools, security lists, scanners, etc. There are so
many resources here that you can use, and I strongly advise you to go on to this
website and check it out. But, just take a look, this is probably the most important
part for you and for everybody on this website, is the
availability of these scripts. So just take a look at what they do, and what you
can do with them, primarily because you can save yourself a ton load of time by
just conducting a scan for certain types of exploits. If I click on exploits it
gives me all sorts of exploits. So, for example, if I'm attacking a very secure
File Transfer Protocol, just read through it, it explains in great detail what it
does, and if you click on it it's gonna give you the exact syntax which you need
to use. Literally, the exact syntax which you need to use. Right next to it you
just type in the IP address of whatever host you want, and that's it.
There are no changes, there is nothing else that you need to do, you just copy
paste this, and change the name here.
Anyway, I'm just gonna go and scroll up, and then I have yet another website that I
wish to show you. It's called exploitdB. So just type in
exploit DB, and the first site that pops up, exploit database by offensive
security, click on it. This is pretty much one of the largest
databases out there in regard to
vulnerabilities. You can find them all in one place here. They are literally here.
There are some very nice wireless tricks that you can do here,
reverse shells, privilege escalation, pretty much everything. We will be using
this site extensively in the follow up tutorials, in other chapters as well, but
I just wanted to mention it here, primarily so that you can explore it a
little bit. I strongly do advise you to do it. Just go through the website. For
example, take a look at the router that you are using. Just see what sort of a
router you are using, see what sort of a router was provided to you by the ISP
provider, and then go ahead and click on search in the
upper right, on the top menu. It's on the right, I'm selecting it now. So I'm just
gonna click on it once again, and search for the vulnerabilities of your home
routers. See what you can do with it, you can look at it by a port,
there is a free text search, description, order, platform, look at how many
platforms are down there. If you don't know what platform it is just just try a
free text search. Type in the name of your router in the free search
text and it's bound to give you some vulnerabilities, because pretty much all
the home routers have more vulnerabilities than they should.
So that is the task that I leave you with. I want you to open up this website,
exploit database, find the vulnerability of your router, of your home router,
figure out which one it is, first, but usually we can do this by just looking
at the box of the router, and once you've done that you, once you've found
the vulnerability, there will be a description of how to use it. Try using it,
try exploiting it, if it fails, and it probably won't because all you need to
do is copy paste things into the Linux terminal, and
we're gonna do some demonstrations later on along the way as we do some more
complex stuff, but before we do it I want you to try it. And if you have any
questions, post them in the question section. I
will be more than happy to not only answer them, but also to help you through
the process as well in terms of instructing you, or something like that.
You don't need to pay anything extra for that, I will do it gladly and help you
out. But please give it a shot. Try it first and then continue on with the
tutorial to see what I do, then perhaps you can fix your technique and improve
yourselves. Before I leave, just one more time, over here you have scripts that you
can use with nmap to detect particular vulnerabilities. Just click on it, once
you click on it, you will get the exact syntax. All you need to do is change the
IP address. And type in exploit DB, use this website extensively, it is very good.
There are lots of vulnerabilities on it, pretty much all of them are located
there. It's completely free, you don't need to pay anything for any of the
services that I have mentioned here. Open, free, anybody can access, no registration
required. And with that, I will leave you today. And one more time, I will urge you
to try it yourselves, and then continue on with the course
where I do it myself, and then you can see the particulars, and the fine
details of how it is done. I bid you farewell.