Instructor: In previous videos, we've talked about Nmap,
and how it can be used for scanning of networks.
So in this video, I wanted to give you
just a little lab demonstration
of how those things actually work.
So I'm gonna use a version here of Kali Linux,
and I'm gonna open up the terminal,
and in there I'm gonna go ahead and use Nmap,
which is a command prompt tool.
Now, the first thing I wanna do is,
I wanna identify what I wanna scan,
so I'm gonna type in Nmap,
which is the tool we're gonna use,
I'm gonna do it for an OS scan,
to figure out what operating system is being used.
So I'll do dash, capital O,
and then the IP address of the target,
and my target is actually gonna be a Windows 2012 server,
which is located at 10.3.2.3.
If I hit enter, it will go ahead and do that scan,
going against that target, and it will return
any ports that are found,
in this case you can see port 135, 139, 445,
and then several other ports
that we don't exactly know what they are,
and you can see that right here, in the unknown.
Now, when you look at the OS,
it's gonna tell you what it thinks it is.
It thinks it's Windows 7 or Windows 2008.
Now, why does it think it's one of those two things?
Well, when it does a scan, it looks at the responses
that it receives, and based on the response that it receives
it determines what version of Windows it is,
because Windows responds differently to requests,
depending on what version it is, now,
the reason it can't tell between Windows 7
and Windows 2008, is because they share a common code base.
So, the same thing would happen if you have a Windows XP
or Windows 2003 machine,
and I can show you that here as well,
if we do an Nmap scan against another target on my network,
which is at 10.3.1.6,
which is a Windows 2003 server.
Now, it's gonna show up that it's Windows XP,
or Windows 2003, because again,
those two share a common code base as well.
As you look at some of the newer versions of Windows,
such as Windows 2012, it shares a code base with Windows 8,
and so you'll see that it can have a hard time
differentiating between those two operating systems,
but at least it gives you an idea of
where it is at this point.
Then, based off the ports that are open,
we can figure out what it's possibly being used for.
So I'm gonna go ahead and clear the screen here,
and we're gonna do another scan using Nmap.
The other one that we talked about was the DASH SV.
And that stands for service version.
So again, I'll do Nmap, we're gonna go ahead and do
DASH s capital V, and then the target we want,
we'll go ahead and use that Windows 2003 server again,
and see what comes up here.
Now, as it goes through, by doing the DASH SV,
it is gonna go and do banner grabs,
as well as packet analysis of the responses it receives,
to try to determine the versions of the services,
and what ports those services are running on.
Now once it's complete doing the scan,
the results will show up here.
Now notice the difference, before,
when we did the -O scan,
and I'll put that back here on the screen,
just to make it clear, you can see that we used to have
only the port, the state, and the service,
but now, we have this version as well being added,
because of the DASH SV that we used in our command.
That's gonna allow us to do further numeration,
because now we know not only is it,
port 135 that's open, not only that it's running the
Microsoft remote procedure call,
but we might actually go to find the version of it.
Now in this case, the version didn't come back very well,
but if we were running something like an Apache server,
we might get some more detailed information.
So let's go ahead and do this against a Linux host,
that I have in my network here,
and we'll just do that by doing Nmap,
-: 0, -O, again, and then we're gonna use the
-: sV, and we'll go ahead and,
go after the 10.3.1.1,
which is a Linux web server that I have on my network.
It's gonna go ahead and do a scan of this pretty quickly,
usually it takes about a minute,
and when the results come back,
we'll see what ports are open,
and if it can identify the actual versions.
So you can see that right here.
Port 80 was open, is an HTTP which is a web server,
and it is running Apache, and it even gives us
the version number of the Apache, 1.3.28.
Now why is this useful?
Because using this in our numeration,
we can now figure out what vulnerabilities
exist for version 1.3.28.
If we're doing this from a defensive posture,
from our risk analysis and threat management mode,
we would know that if there's a new vulnerability
for Linus 1.2, that doesn't affect us,
but if there's one for 1.3.28,
we have to get that patch installed,
because again, this will give us the specific
version numbers that we're dealing with.
Now, the last piece here that I wanted to talk about with
Nmap, is when we're doing a scan,
there are 3 different types of scans.
You can do the -sS, which is a syn scan,
and then you would target whatever you're gonna target,
you can also have one, that instead of using just syn scans,
you can do a full connect scan, which is -sT,
that's gonna do the full three way handshake,
to figure out what is going on on that system.
And the third kind you can do is the acknowledgment scan,
which just is a -s capital A,
so sS for syn, sT for full connect,
and sA for acknowledgement.
By doing those, it's just,
sending a different way of doing your scans because,
sometimes depending on the intrusion detection systems,
or the intrusion protection systems
in place between you and the victim you're trying to scan,
it's gonna be different based on those things,
so you'll use those different criteria.
And that's all I wanted to show ya,
it's just a quick introduction to Nmap,
this by no means is gonna teach you everything about Nmap,
in fact there's hour long courses,
one, two, three hour long courses
on getting very proficient with Nmap.
But I just wanted to give you a quick introduction
so you can see this tool in action,
so you'll be ready when you're starting to use it yourself.
(electronic tone)