Hello everybody and welcome to this tutorial. Today, I will start a chapter on
footprinting. So I have explained what the act of footprinting is before, but
now we will actually go ahead and conduct a few scans to see how it all
works, and introduce you to the tools that we will be using. So, first off, we
need to find ourselves a target to scan. Of course, I could just scan myself, or
something of a kind, but that would not be a realistic thing, really, because I
already know what the results are going to be. And plus, on
top of that, I'm not scanning long range over the internet, or something of a kind,
I would be scanning within my own local network. So the speed of the scan
would not be realistic as it would be a lot faster than say when you
conduct the scan over the net, some distant and remote server. So what I did
was I went online, and you can do the same, and I found
on the official nmap website they have a section devoted to actually allowing
people to scan them to test their tool out. Now here is the, I am selecting the
permission, there is a written permission here that you can actually
scan this website, and they basically say, I mean you can scan it to test it out, a
few scans a day here is fine, but do not scan a hundred times a day, or use this
to test your SSH brute force password cracking tools, etc. So that's definitely
something you don't want to do, but you can run a few scans on this site per day,
and according to them that's perfectly fine. You are not breaking any laws,
or anything of a kind, I'm just emphasizing one more time that you do
have a written permission right here on the site. Which is fantastic because it
gives us an opportunity to actually simulate real time circumstances and see
how nmap behaves. Now nmap is an unescapable tool of pretty much any pen
tester out there. Many people say today well that it's pointless to
port scan, doesn't do you much good, and so on, and so forth. Well,
perhaps in terms of exploiting the services running on the port themselves,
it doesn't do you that much good, but just by seeing which ports are open
and which ports are closed you can, to a fairly good extent, determine what
operating system, or what platform, is being used on the other side, and then
you can find weaknesses of that same platform. Of course there are some other
ways in doing this, I will show them to you, like banner grabbing, or something of
a kind, but let's just see how nmap really works. Now
nmap is known to basically trigger quite a lot of alarms, quite a lot of
firewall red flags so to say, and you want to make sure that your nmap
scans are as quiet as possible. Now there are tools to
actually figure this out, but I will show you here how to actually do it via
terminal. There is also something called zenmap. Now zenmap is basically a
graphical user interface of nmap, but we will not be using that. Rather, instead,
I want to teach you how to use a terminal version. So nmap is the one
most commonly used, and it is always used in the terminal text format, rarely
anybody uses the actual graphical user interface. In the previous chapter, we
have also discussed how to stay anonymous. So, at the end of the chapter I
will be combining these things: scan, footprinting, the act of scanning, and
anonymizing your scans. However, you might think about that before you get to the
final tutorial of this chapter and perhaps try to do it yourselves. It
doesn't matter if you fail, or something of a kind, it truly doesn't. What is
important is that you give it a shot. And you try it once, ok, failure. Fine no
problems. Try it twice, thrice, the fourth time you're bound to have some sort of
results, as long as you keep improving yourself it's fine.
In any case, without further ado, let's just type in
nmap - - help, oops I mistyped that of course, nmap,
press ENTER, and there we go. There are a lot of options here, I mean a ton load of
options, way more options than we actually need for some sort of basic
things. However, eventually, over time, you will come to understand that all of
these options are not here for nothing, they are here because they were
needed at some point of time, and they are pretty much all still used. So, what
you need to do is scroll down to the bottom, and here you have examples of how
nmap runs. So you type in nmap - v, and almost always, 99% of the
time, is verbose output. Basically you're telling your system to give you
more information in regards to what it is doing. - A, I'm not sure where this
function is, ok here it is, - A enable OS detection, version detection, script
scanning, and traceroute. I don't think we're gonna need that
immediately. There is - o the function which is just for OS detection.
Anyway, and then you can pass either this one, scanme.nmap.org which is
basically the domain name, which will get resolved to an IP address, or you can
actually pass it an IP address. And if you're wondering what this is, this is a
mask. And it would be very difficult to explain in great detail what this is, but
for the time being, know that this is actually an IP address range. So it goes
from a certain IP address, to a certain IP address, because this goes way
into working, and binary numbers, and so on, and so forth, but you do not
actually need to use this format. Not that many people actually use this
particular format with the mask. They just tend to specify very specific
ranges, because they don't have the permissions to
scan the entire subnet. Rather, instead, they have to create
lists, and then skip certain IP addresses, and then continue again from a certain
point. So they do need to create lists and
can be a problem. Now up here at the top you have another very important
option that's gonna come in handy. You have - iL, input file name. So you can
actually create a list, in a file, a list of IP addresses, and then you can
scan those particular IP addresses. They will also have an
ability to do this, look at what's written here. So
just take a look at this segment and its 10.0, and then this segment here,
this octet here is 0-255, and then the last octet is 1-255. If you're
wondering why I'm calling these things octets, it's
because they have 8 bits, each one of these has 8 bits, and it is represented
in a binary form. So it can have 8 zeros or, I don't know, 8 ones, or a
combination of ones and zeros. But it has 8 bits, so 8 positions. That's why they are
called octets. This is a very common form that people tend to use, and this is what
you will find yourselves using. Either this, this will be a method in which you
will specify the IP addresses, or you will be passing files. So these files
usually people, well they either make them themselves, or they can
find these IP addresses on the internet. So in addition to this site, nmap.org,
you also have this one here, major IP blocks. Let me just see if I've typed in
that correctly. And this is a...yep, there it is. Okay, so, this is a fantastic
website. The entire range of pretty much all the IP addresses are listed here, and
it also says who owns what, it doesn't say for everyone of them who owns which
one, but for example you can search and find, and it's
give you the appropriate IP addresses for that particular country,
and it's gonna give you the owner of those IP addresses. Usually it's just
telecoms, but you also have other people who own them as well. So I'll just
give it a shot. Search, I don't know, let's just type in
Germany or, I don't know, France... whatever. Okay, this is not the first search, but
that's not a problem. Actually, you can find it down here, and I'm not gonna type
it in here. I could control f France, there we go. Down here, just saving
myself a bit of time there. And there we go. So, you have a range, this is a given
range here, it's from 2.0.0.0 to 215.255.255. This is a massive range. This is a
humongous range. Look at how many, this is how many IP addresses you can have in
total, how many of them you can generate within this range. It's quite a lot. It's
French Telecom. I don't know for some reason
they need it. So you can sort them out by the owner, and you can see that a lot of
them are actually not listed here. Wow! France has a lot of IP addresses
assigned to it. They're not free, they cost money. Let's
just go ahead and see down below. Where is it? Where is it? OK, so you see
all of these IP addresses, and this is a pretty massive range, so this is a
telecom in France. Look at how many
IP addresses, IP address ranges they have. So that's quite a lot, and this
site, as I said previously, we can use to figure out which IP address range you
wish to scan, but you usually do not have the permission to scan the entire range.
You can scan certain IP addresses within that range for which you have a
permission. But, also a very nice site to determine where the IP address is from,
or something like that. However, always remember. Once you get an IP address, your
search engines on the net are your best friends. This is one of major
components of footprinting. You can do the following...
you can type in who is, and then type in an IP address. I don't know, I'm
just gonna type in this random IP address. So if you don't want to see it
here you can have a look at it here. Who is 82.120.0.0. I don't know, somebody's gonna
tell me who this guy is, or whom this is. There we go. So, I've typed in who is
and I've picked the first website out that I could find, and here I have all
the information in regards to that particular IP address. I have a country. I
have the username of the admin I suppose. I have the status, remarks, source, I
even have a, yep, there we go, there's actually an address, a physical address,
of the IP address, which is ridiculous. Yeah, so, as I said, search engines are
your best, and I mean absolutely best friends. If you want to find pretty much
anything on the net, or something like that, in regards to an IP address to do
any sort of research. So those are the two tools that I have showed you.
Actually, three of them, well one tool and two websites that you can...one tool, one
website, and one search method which you can use in order to determine where the
IP address is from, or who is using it, and even to determine its physical
location. Although, its physical location can be assigned to a telecom, and that
telecom can assign it to a city, and to a specific region in the city, or something
of a kind. And then you can find it on google maps, on google earth, or something
of a kind, but usually those things are not that precise. What is precise, however,
is that the IP address belongs to a telecom, or something or a kind, and they
keep rotating them in between the cities. So, if you have let's say a hundred
thousand IP addresses that you scanned, and if you wish to sort them out by the
city, you will get like seventy to ninety percent accuracy depending
on which you do it. It can be problematic because you're gonna
miss out on some things, but if you don't think 100% accuracy you can get your
sorting done pretty well. There are databases which you can update, I will
show you these things, they're called geoip lookups. But before
we do that, you also have something called nslookup.
And I'm just gonna use this generic name here, scanme.nmap.org. Let's
paste it, and there we go. I have basically said I want to look up
this, I want to look up files on scanme.nmap.org, and, okay, this is my DNS
server which is basically my router. You see it says port 53. You know immediately
that it's a, you know immediately that it's a DNS because all DNS traffic runs on port
53. And then we have the results. So, this is the domain name and you get the
IP address down below. So this is also one of the ways in which we can get the
IP address off of the site with a domain. Because once you know the
the domain, you don't actually know the IP address until you look it up, or
something like that, but there's a far simpler method. You don't need to use in
this lookup. Oh, by the way, nslookup also works in reverse. So
type in nslookup, and you can type in the IP address, so just go ahead and
press Enter. Okay, so, this has run through a process of some sort. Down below these
are authoritative answers from the name servers. Basically, what that means
there are DNS servers and they are giving you responses, and telling you to
whom the domain belongs to, and so on, and so forth. But, look, ignore this part, and
for the time being we can also ignore this part until we get
into spoofing the DNS, and changing it, and so on, and so forth. What I want to
show you here is that you can actually get a domain name by typing in nslookup,
and then the IP address, and here where it says non authoritative
answer you get the IP address, and then you get the name, which is the domain
name. However, you might notice that there was a problem here, that this IP address
does not match this one. Well, guess what? It actually does. Try looking at it in
reverse. So it's 74, 74 here, 207, and 207 here, 244, and 244 here, and 221 here, and 221
here. So when you do an nslookup, and when you pass in an IP address, it's
gonna do a reverse lookup in the DNS MX records, or something of a kind. It's
gonna query the DNS servers and the DNS servers are gonna give it a
response, but in the mx records this is basically how things are written. You
write an IP address in reverse and then you put this in-addr.arpa, but
this part really is not that interesting to us. This is more interesting to server
admins who configure the DNS servers, or something of a kind. In any case, for the
time being, but don't worry we will get to DNS, DNS servers in the later stages
of this tutorial once we are done with these things. In any case, what is
important for you here is we've typed in an IP address, you've used the tool
called nslookup, and you have gotten a domain name in return. And now you can
start doing some other things as well, but we will be dealing primarily with
nmap. Nmap is a tool in order to scan networks and to retrieve information
from them. But what I've showed you now is some basic information, retrieval,
and some basic external resources that you can use. In any case I'll see you in the
second part, or part 2, or the second tutorial of this nmap introduction, and
there we're gonna actually conduct some scans and see how it all works. Thank you
for watching, and I hope to see you next time.