Hello everybody and welcome to this tutorial.
Today I will start a chapter on footprinting.
So I have explained what the act of footprinting is before
but now we will actually go ahead and conduct a few scans to see how it all works
and introduce you to the tools that we will be using.
So first off, we need to find ourselves a target to scan.
Of course I could just scan myself or something of a kind
but that would not be a realistic thing really
because I already know what the results are going to be, plus on top of that
I'm not scanning long range over the Internet or something of a kind.
I would be scanning within my own local network
so the speeds of the scan would not be realistic
as it would be a lot faster then, say, when you conduct a scan over the net
some distant and remote server.
So what I did was I went online, and you can do the same
and I found on the official Nmap website
they have a section devoted to actually allowing people to scan them to test their tool out.
Now here I am selecting the permission.
There is a written permission here that you can actually scan this website
and they basically say you can scan it to test it out.
A few scans a day here is fine, but do not scan a hundred times a day
or use this to test your ssh brute-force password cracking tool, etc.
So that's definitely something you don't want to do
but you can run a few scans on this site per day
and according to them, that's perfectly fine.
You're not breaking any laws or anything of a kind
and I am just emphasizing one more time that you do have a written permission right here on the site
which is fantastic, because it gives us an opportunity to actually simulate real time circumstances
and see how Nmap behaves.
Now Nmap is an unescapable tool of pretty much any pen tester out there.
Many people say today that it's pointless to port scan
it doesn't do you much good, and so on and so forth.
Well, perhaps in terms of exploiting the services running on the port themselves
it doesn't do you much good
but just by seeing which ports are open and which ports are closed
you can, to a fairly good extent
determine what operating system or what platform is being used on the other side
and then you can find weaknesses of that same platform.
Of course, there are some other ways of doing this.
I will show them to you, like banner grabbing or something of a kind
but let's just see how Nmap really works.
Now Nmap is known to basically trigger quite a lot of alarms
quite a lot of firewall red flags, so to say
and you want to make sure that your Nmap scans are as quiet as possible.
Now there are tools to actually figured this out
but I will show you here how to actually do it by a terminal.
There's also something called zenmap.
Now zenmap is basically a graphical user interface of nmap, but we will not be using that.
Rather instead, I want to teach you how to use a terminal version
So nmap is the one most commonly used
and it is always used in the terminal text format.
Rarely anybody uses the actual graphical user interface.
In the previous chapter, we have also discussed how to stay anonymous.
So at the end of this chapter, I will be combining these things --
The act of scanning and anonymizing your scans.
However, you might think about that before you get to the final tutorial of this chapter
and perhaps try to do it yourselves.
It doesn't matter if you fail or something or kind, it truly doesn't.
What is important is that you give it a shot and you try it once.
Okay, failure. Fine. No problems.
Try it twice, thrice
The fourth time you're bound to have some sort of results.
As long as you keep improving yourselves, it's fine.
In any case, without further ado, let's just type in "nmap - -help"
Whoops, I mistyped that of course
"nmap - -help", press ENTER, and there we go.
There are a lot of options here.
I mean, a ton load of options.
Way more options than we actually need for some sort of basic things.
However, eventually over time
you will come to understand that all of these options are not here for nothing.
They are here because they were needed at some point of time
and they are pretty much all still used.
So what you need to do is scroll down to the bottom
and here you have examples of how nmap runs
So you type in "nmap -v" almost always
99% of times
99% of time is verbose output.
Basically you're telling your system to give you more information in regards to what it is doing.
"-A" -- I am not sure what this function is...
Oh here is -- "-A: Enable OS detection, version detection, script scanning, and traceroute"
I don't think we're going to need that immediately.
There is -o function, which is just for OS detection.
Anyway. and then you can pass either this one -- scanme.nmap.org
which is basically the domain name, which will get resolved to an IP address
or you can actually pass it an IP address
and if you're wondering what this is, this is a mask
and it would be very difficult to explain in great detail what this is
but for the time being, know that this is actually an IP address range.
So it goes from a certain IP address to a certain IP address
because this goes way into networking and binary numbers, and so on and so forth
but you do not actually need to use this format.
Not that many people actually use this particular format with the mask.
They just tend to specify very specific ranges
because they usually don't have the permissions to scan the entire subnet.
Rather instead, they have to create lists
and then skip certain IP addresses, and then continue again from a certain point.
So they do need to create lists, and that can be a problem.
Now up here, at the top, you have another very important option that will come in handy.
You have "-iL
So you can actually create a list in a file, a list of IP addresses
and then you can scan those particular IP addresses.
You also have an ability to do this
Look at what's written here
So just take a look at this segment --It's 10.0
and then this segment here, this octet -- It's 0.255
and then the last octet is 1 - 254
If you're wondering why I'm calling these things octets
it's because they have eight bits.
Each one of these has 8 bits and it is represented in a binary form.
So it can have eight zeros or, I don't know, eight ones or a combination of ones and zeros
but it has eight bits...so eight positions.
That's why they're called octets.
This is a very common form that people tend to use
and this is what you will find yourselves using.
Either this -- This will be a method in which will specify the IP addresses
or you will be passing files.
So these files, usually people either make them themselves
or they can find these IP addresses on the internet.
So in addition to this site -- nmap.org
you also have this one here...
This is a fantastic website.
The entire range of pretty much all the IP addresses are listed here
and it also says who owns what
it doesn't say for every one of them who owns which one
but for example, you can search and find
and it's gonna give you the appropriate IP addresses for that particular country
and it's gonna give you the owner of those IP addresses.
Usually just telecoms, but you also have other people who own them as well.
So let's just give it a shot
Let's just type in Germany or, I don't know, France...
Okay, this is not the proper search, but not a problem.
You can actually can find it down here
or I could CTRL F France
and there we go.
So you have a range -- This is a given range here
It's from 2.0.0.0 to 2.15.255.255
This is a massive range. This is a humongous range.
This is how many IP addresses you can have in total.
How many of them you can generate within this range.
It's quite a lot
It's French telecom
For some reason they need it, so you can sort them out by the owner
and you can see that a lot of them are actually not listed here.
France has a lot of IP addresses assigned to it.
They're not free, they cost money.
Let's just go ahead and see down below... Where is it? Where is it?
Okay, so you see all of these IP addresses
and this is a pretty massive range...
So this is a telecom in France.
Look at how many IP addresses ranges they have.
That's quite a lot
and this site, as I said previously, you can use to figure out which IP address range do you wish scan
but you usually do not have the permission to scan the entire range.
You can scan certain IP addresses within that range for which you have a permission
but also very nice site to determine where the IP address is from or something like that.
However, always remember --
Once you get an IP address, your search engines on the net are your best friends.
This is one of the major components of footprinting.
You can do the following --
You can type in "who is" and then type an IP address.
I'm just gonna type in this random IP address.
So if you don't want to see it here, you can have a look at it here.
Somebody is going to tell me who this guy is
There we go
So I've typed in "who is" and I've picked the first website out that I could find
and here I have all the information in regards to that particular IP address.
I have a country, I have the username of the admin I suppose
I have its status, remarks, source
There's actually an address, a physical address of the IP, which is ridiculous.
So as I said, search engines are your best, absolutely best, friends.
If you want to find pretty much anything on the net or something like that
in regards to an IP address, to do any sort of research.
Those are the two tools that I have showed you, actually three of them
well, one tool, one website, and one search method
which you can use in order to determine where the IP address is from or who is using it
and even to determine its physical location, although its physical location can be assigned to a telecom
and that telecom can assign it to a city, to a specific region in the city, or something of a kind
and then you can find it on Google Earth or something of a kind
but usually those things are not that precise.
What is precise, however, is that the IP address belongs to telecom or something or kind
and they keep rotating them in between the cities
So if you have like a hundred thousand IP addresses that you scan, and you wish to sort them out by the city
you will like 70% to 90% accuracy, depending for which country did you do it.
This can be problematic because you're gonna miss out on some things
but you don't need 100% accuracy.
You can get your sorting done pretty well.
There are databases which you can update.
I will show you these things.
They are called goip lookups
but before we do that, you also have something called "nslookup"
and I'm just going to use this generic name here -- scanme,nmap.org
paste it, and here we go
I have basically said I want to look up files on scanme.nmap.org
and okay, this is my DNS server, which is basically my router.
You see it says port 53
You know immediately that it's DNS because all the units traffic runs on port 53
and then we have the results.
So this is the domain name, and you get the IP address down below.
So this is also one of the ways in which you can get the IP address of a site within a domain
because once you know the domain
you don't actually know the IP address until you look it up or something like that
but there is a far simpler method.
You don't need to use nslookup.
Oh, by the way, nslookup also works in reverse.
Just type in "nslookup", and you can type in the IP address.
So let's just go ahead and press Enter
Okay, so this has run through a process of some sort down below.
These are authoritative answers from the name server.
Basically what that means they're DNS servers
and they're giving you responses and telling you who the domain belongs to
and so on and so forth
Ignore this part, and for the time being we can also ignore this part
until we get into spoofing the DNS and changing it
and so on and so forth.
What I want to show you here is that you can actually get a domain name by typing in nslookup
and then the IP address
and here, where it says "Non-authoritative answer"
you get the IP address and then you get the name, which the domain name.
However, you might notice that there was a problem here --
That this IP address does not match this one.
Well guess what? It actually does.
Try looking it in reverse.
So it's 74, 74 here
207, 207 here, 244, 244 here, 221 here, and 221 here.
So when you do an nslookup and when you pass in an IP address
it's gonna do a reverse lookup in the DNS MX records or something of a kid.
It's gonna query the DNS servers and the DNS servers are going to give it a response
but in the MX records, this is basically how things are written.
You write an IP address in reverse and then you put this in "in-addr.arpa"
but this part really is not that interesting to us.
This is more interesting to server admins who configure the DNS servers or something of a kind.
In any case, for the time being
but don't worry, we will get to DNS servers in the later stages of this tutorial
once we are done with these things.
In any case, what is important for you here is you've typed in an IP address
you've use tool called nslookup and you have gotten a domain name in return
and now you can start doing some other things as well
but we will be dealing primarily with nmap.
Nmap as a tool in order to scan networks and retrieve information from them
but this what I've showed you now is some basic information retrieval
and some basic external sources that you can use.
In any case, I'll see you in part two of nmap introduction
and there, we're going to actually conduct some scans and see how it all works.
Thank you for watching and I hope to see you next time.