-: We've already covered the concept
of a vulnerability assessment earlier in this course.
Now you might remember that a vulnerability assessment
is the baselining of your network,
to assess the current security state of the computers,
the servers, the network devices
and the entire network in general.
Now in this lesson instead of focusing
on the concept of a vulnerability assessment,
we're instead going to focus on the types of tools
that are used to conduct these assessments.
Now this includes tools for network mapping,
vulnerability scanning, network sniffing
and password analysis.
Network mapping tools are used for discovery
and documentation of your physical and logical
connectivity that exists within your network.
By using these tools you can determine
how the network is set up, how the data is going to flow
over that network, and all sorts of other things like that.
This is usually one of the first tools that's used
when you conduct a vulnerability assessment,
because you have to understand how all these
different network connections are,
so you can understand the vulnerabilities
that are going to lie within the network.
Now there are a lot of commercial and free
network mapping tools available.
For the exam you don't need to know specific tools,
but you should understand the concept of a network map.
For example, SolarWinds is a very popular
commercially available network mapping tool.
As you can see here on the screen,
it's going to search your network and create
a graphical representation of it for you.
A good open source and free option you can use
is known as Zenmap.
Zenmap is going to allow you to create a graphical
topology of your network, as you can see here.
Now when we covered our wireless lessons,
a few chapters ago, we also covered how wireless
network mapping tools can be used to identify
the hotspots that are in your network
and you can also see the coverage area
that exists from those hotspots.
This is another type of network mapping
that can be done too.
Now I've seen people who map out their networks
using an old school method too, that's pen and paper.
That's right, they'll take pen and paper
and create their network diagrams
and figure out exactly how things are done
by looking at the network manually.
It doesn't matter what tool you use,
as long as you understand what devices are on your network
and how they're logically and physically connected.
Once we have a good network map we can then dive deeper
into our vulnerability assessment,
by using vulnerability scanning tools.
A vulnerability scan is a technique that's going to be used
to identify threats that exist on the network,
but it doesn't exploit those threats.
Now vulnerability scanners can vary greatly
in their complexity and their level of detail.
Some are very basic and only do a scan for open ports.
Others can probe those open ports and determine
the exact service and software
that's being run by the server.
Now, for example, Nmap is a port scanner
that can perform a basic port scan or a more in-depth
vulnerability scan of those ports,
once it finds one that's open.
I'm going to show you that in a demonstration later on.
Now once you find these open ports,
you can then identify the services and you can
attempt to enumerate them to determine
the exact version being run, any network shares
that might exist, and you can get a list
of all the user accounts on the machine and much more.
So if I wanted to do this vulnerability scan manually,
I can do that.
I might use something like Netcat to open a port
on a web server, like port 80,
query it for it's header information,
as shown in this image, and then, based on that information,
I can see what kind of server it is.
Now notice here I sent the command of HTTP 1.1
to the server and the server didn't even understand
that command and so it sent back an error.
And that's fine, because even in that error message
I can see information about the server,
specifically what type it is, in this case nginx,
and the version it is, version 1.14.1.
This is the concept of performing a banner grab.
Banner grabbing is where you can manually enumerate
a server to gain additional information
and inventory the systems or services that it uses.
Now if I used a commercially available
or more in-depth vulnerability scanning tool,
I wouldn't've had to stop there.
There is very complex vulnerability scanning suites
out there, things like Nessus and Qualysguard,
and these can scan for open ports, enumerate the services
on those ports and then determine if a vulnerability
exists on those services by checking if they've been
patched for known exploits.
I'm even going to show you a demonstration of this
by using Nessus to scan a sample network and look at
a server and a workstation on that network
and determine which one is more
vulnerable to attack than the other.
Our next category of tools is known as network sniffers.
Network sniffing is the process of finding
and investigating other computers on the network
by analyzing the active network traffic,
or capturing the packets as they're going across
the network for later analysis.
Network sniffing tools are also called packet sniffers,
or protocol analyzers, because all three of these
can conduct the concept of packet capturing on the network,
but a protocol analyzer has the ability
to give you much more information than just
a network sniffer or a packet sniffer does.
With a protocol analyser you can actually capture,
reassemble and analyze those packets
that have gone across the network,
look at them as packets, frames or even at the bit level.
The most commonly used protocol analyzer
is the open source program known as Wireshark.
Wireshark is free, available on just about
every operating system out there,
and it is really, really powerful.
For example, here you can see a packet capture
that I was able to create in Wireshark of an FTP session.
I was able to capture the communications
going between a client and that server.
In the top third of the screen you're going to see
the packet in the sequence, and currently we see
packet one through packet 10, and we can do that
as it goes all the way through the communication,
if I was going to scroll down through this list.
Now as you can see each packet you can also see
the time it was sent, the source who sent it,
the destination that received it, what type of protocol
was used during the transmission of it,
the length of that packet and some information
about the particular packet.
In this case I have packet one selected.
Now if we look at the middle panel inside Wireshark,
this is where the packet can be viewed as a packet
at layer three or layer four, the network layer
or the transport layer, or be further broken down
into layer two, the data link layer,
where those network frames were captured.
Now at the bottom portion of the screen
you actually can see the hexadecimal representation
of the binary code as it was sent at the physical layer
of the OSI model across the network.
Now as I said, Wireshark is truly powerful.
Now, if you remember, earlier in the course
I said FTP was insecure, right?
Because it sends all of its data
across the network without encryption.
Now if you remember that, I'm going to prove it to you
at this point, because you're going to be able to see
the entire conversation between the FTP server
and the client inside this packet capture.
If I right click on the packet and I click
follow the stream, we get to see the raw data
that was sent over the network in a human readable format.
This is going to follow the stream and reconstruct
the entire conversation, as you can see here.
Notice the username and password
can be seen here too, right?
This is why encryption is needed for any communications
that are going over your network.
Because anything you send over the network
can be seen by somebody who is sniffing it
and doing a packet capture.
So if you have confidential information,
like usernames and passwords, you have to encrypt them
before sending them across the network.
The final category of tools that we're going to discuss
is called password analysis tools,
but that's a fairly large category that we have to cover,
so I'm going to save that for its own lesson.
Let's go to the lab environment first
and see some demonstrations.
(electronic crackling)