Hello everybody and welcome to this tutorial.
Today I will do some actual scanning
and for that, I have picked a domain outside of my local area network.
You can find this on the nmap official site, so it's scanme.nmap.org
This domain they have given, and you can feel free to scan it.
Well not as much as you wish, because you know a hundred times a day is not okay
but a couple of times a day is okay
and you can test out whether your nmap works and how it works.
So I need to take this domain.
You cannot use Ctrl C or Ctrl V in the terminal
primarily because Ctrl C is the universal interrupt and Ctrl V will simply not work.
You will need to use a mouse and manually do it.
In any case, we need to trim this down.
We don't need any of these things, we just want the domain name to remain
and now I'm gonna go ahead and type in nmap, space, and there we go.
We're gonna now scan this domain.
However, if I just press enter like this, it's gonna conduct some scanning
It will do the job, I assure you, but it will give us no output whatsoever.
So this will be continuously empty until the scan is actually complete
Now on short scans, such as these, that's probably okay
but if you're conducting a scan that can last up to a day or something of a kind
it's pretty worrying to see that there is nothing here
I mean, you're not sure whether it's working, is it bugged or what not.
That's why it is always better to pass a V option for verbose output.
I have a preference to pass the VV option for extra verbose output pretty much.
It tells me pretty much everything that it is doing and how it is functioning
and I can see it as it goes on
and I can see that some ports are open a bit earlier prior to the completion of the scan.
Let's just go ahead and start to scan
and you can see immediately before it finished the scan
it has told me that the port 22 and port 80 are open.
Now by default, nmap will scan for 1000 ports.
You can tell it to scan for more ports, no problems.
You can tell it to scan for the maximum range of ports -- It's 65,000 something
I'm not exactly sure what the end number is
but it's 65,000 something, and you can find it on the net if you wish.
You can pass an option to nmap to do a full port scan, so all of the ports will be scanned
although rarely anybody does that.
It's time-consuming
Usually you have an idea of what sort of services you want to target
and then you scan for the ports on which the services are likely to run
For example, port 22, that would be ssh
and port 25, that's sntp
If you don't know what that is, it's a mail server 80 http
and you have nping-echo as well, on port 9929
and now the states of these ports are rather clear.
So it's open open open, and you can also get a state closed
because it says here "Not shown: 996 closed ports"
and when it says "filtered", well usually there's a firewall setting which is dropping the packets.
It's not closing the port perhaps, but it's definitely doing something to the packets coming on that port.
It's perhaps blocking them from a certain IP of something of a kind.
There can be a lot of options here.
In any case, the general meaning of this filtered flag here
is that the nmap can not determine whether the port is open or closed.
Usually you want to stay away from those ports
or you can do some extra research and find out how you can access them.
Maybe they require a particular app or particular protocol or something of a kind to be accessed
and that's why nmap cannot actually figure pretty much anything out of it.
That can be a bit problematic.
I would definitely, as I said, advise to stay away from them.
Stick to the open ones and see what you can do with the open ports here.
Now nmap also has a option to create grep full output.
Basically what that means is that you can sort whatever you results you get into a file
you can store it and sort it as well
and then you gain an ability to actually extract pretty much separate bits and pieces of information
For example, you just want the IP addresses of hosts that are up
or you want the IP addresses of hosts that have port 22 open or filtered
or that are running a certain service, like ssh or sntp or http or something of a kind.
However, I won't be doing that for scanme.nmap.org
I believe I have used their system enough
and for this example, I require a range of IP addresses to to give you a meaningful result.
So what I'm going to do is scan my local subnet, and if you don't know what yours is
well it's most likely configured as mine is, but if it's not, clear the screen and type in "ifconfig"
and you will get a result here for eth0 or for whatever interface you are using.
Just take a look at this IP address that has been assigned to this interface.
So the lowest and the maximum value of the first octet here will be the range of your local summits.
So from 0 to 255
Let me just show you how that looks like, in case you do not understand here.
Type in "nmap -oG - 192.168.1.0-255"
So it's gonna scan for all the IP addresses that have this and that go from 0 to 255.
Now keep in mind that I can customize the range anyway I want.
For example, here where it says one, I can type in "-67"
So it's gonna use this octet and this octet in combination
and it's gonna scan for all possibilities
although that might take a lot of time because that's a lot of IP addresses.
Anyway, I'm not just done yet.
What I need to do is actually cause a redirect
Before I cause a redirect, I'm just gonna give it a double verbose mode
and why am I redirecting my standard output?
Well I don't want all the information to just be printed out on the terminal screen
where eventually it will be lost pretty much as soon as I close a terminal
or as soon as enough commands are passed
that the cache needs to be rewritten for the terminal or something of a kind.
Furthermore, if it's written out in standard output on the terminal itself
I can't do anything else with it.
I cannot manipulate it.
It's not a file I can take or something of a kind.
Rather instead, it's just standard output.
What I want to do is cause a redirect with a greater-than sign into some sort of a file.
So I'm just gonna go ahead and type in "home" and I don't know...maybe not home
Well no, maybe that's a good idea. Let's just leave it at "home". That's better.
I'm gonna name this file "scan"
So all the results that nmap gathers now will be stored into this file here
and this is the path to the file
and since I have passed a good amount of hosts here
I mean, I've given it 255 hosts
because I'm in lan, it's gonna go faster
but when you're doing this over the Internet
a very good idea is to pass a port, or at least a port range.
Don't let it scan all 1000 ports or even worse, do not specify that it should scan a full port range
primarily because, regardless of what sort of internet connection you have
it will take a good amount of time to finish.
I mean, you're bound to trigger some red flags or something of a kind.
So you should define a port here, in order to save yourself a lot of time
and I mean, generally you will know which service you want to attack.
You will have some sort of an idea there.
I am going to go ahead and pass port 22.
That is the port that I wish to scan for
and press Enter and hope to god that it works.
There we go
It is functioning
It has finished rather fast, but even though I passed double verbose mode
everything here is being redirected here, so I will see nothing.
If this scan takes longer when you're doing it over the internet
and it will take longer if you're doing it over the Internet
don't think immediately that something is bugged just because because nothing is being written below.
If we just change to home and list what is there...
There we go
We have the scan, so let's just do this.
Now look what I'm doing here -- I'm gonna do a very similar thing with our scan file
I'm going to type in "grep SCAN", press Enter, there we go.
I have now passed the ls command to list pretty much everything within the home directory
and then I have piped the output of ls to grep.
Basically pipe means just pass it.
I've passed the output to grep, and what grep does is basically pulls whatever you specify here.
It just pulls it from the output.
I have told it to pull whatever is in there
that has a name scan or that has a string scan within it.
So I could have had a name like "AAA SCAN BBB"
It would still pull it, no problems.
This is one of the ways in which you can make sure that the file is located within a certain folder
especially in situations where you have hundreds of files in a single folder
and you just can't go through them all manually.
Use a grep, if you know the name
or if you know partial name, in order to figure out what is where.
So let's just go ahead and clear the screen
and let me just show you what is located within our scan files
So "less SCAN", press Enter, and there we go.
So we have pretty much all the hosts within my LAN network
within my local subnet
They're all down of course, because I don't have 255 computers or devices within my home network.
Rather instead, you see what it has found.
It has found this is the router IP
The router that I am using for this test
and it says "Ports: 22/filtered/tcp//ssh///"
That one has an open port of 22
Also, its status is up
and I also have on 100 status is up, 22 is closed, 102 is up, it's filtered, and so on and so forth.
So let me just go ahead and quit this
and I'm gonna do a very similar thing here
because I want to leave it on the screen so I can explain it to you.
The less command is very nice, but when you exit, it disappears.
Cat, however, just brings everything within a file to standard output
and it stays here pretty much for the duration of the terminal
The reason why I did this will become apparent quite soon.
So what you want to do now is type in "cat SCAN" as before
and now we want to pipe the output of scanned grep in order to pull something out of here.
Some sort of useful information.
Let's say that I want to pull all the hosts that are up.
I want to pull all live hosts.
I want to see their IP addresses
and when I type in grep
what is the universal marcation for all the hosts that are up?
Well, you have a flag here next to the status, and then flag up.
So just go ahead and type in "Up" and press Enter.
Excellent
I'll just give you a bit of clarity
There we go
You have these flags which are up.
So I all the hosts here that are currently up and running, that are alive on the network
but this is not what I want.
If I wanted to pass these IP addresses to another program or something of a kind
I wouldn't be able to pass this whole line because it would make no sense
if the other program is requesting only the IP address of the host
because you can do one nmap scan to see just to see which hosts are alive
and then once you've figured out which hosts are alive
then you can do a more detailed scan on those particular hosts
and in such a way you would save a lot of time.
So we have these hosts here
but we want to pull these IP addresses, and I'm afraid I just can't do that with grep.
Perhaps I even could, but it would be just too complicated and too complex
and it really wouldn't be practical.
That is why Linux has something that is called awk.
It's basically used for formatting text
and pulling out certain parts of a file that you need or something of a kind.
Now you can make a separate tutorial on awk.
You can have hundreds of hours and there would still be features of it that you would not know.
I would strongly advise you to familiarize yourselves with awk.
Take a look at the man pages for awk.
However, for the time being and for the purposes of this tutorial
we will be using some basic awk commands, which pretty much everybody uses
and which are a necessary part of pen testing
primarily because you need to do stuff of a kind that we're gonna do here.
So cat SCAN, print everything to standard output, grep up
grep all lines that contain the word "Up"
and then what I want to do here is eliminate this part, leave this part in, and eliminate this part.
Now how shall I do that?
Well, the first thing that we need to specify is a field delimiter.
What a field delimiter is
Basically if you say that the colon here is a field delimiter, this will be one field
this will be another field, and this would be yet another field.
So you will have three fields in total.
However, that doesn't really work for us, does it?
Because if we say that the colon is a delimiter
this entire section that I've highlighted will be considered a field
and we will have parentheses and status - The parts that we don't really want.
What you can use as a field delimiter here is a space.
So space here
This is one field, this is gonna be another
and this is gonna be, again, a field delimiter because there's a space
and this will be the third one, and then you have again space
and the forth one, and so on and so forth.
So in order to specify a field delimiter to be space
well, simply leave an empty space in between the quotation marks.
Generally you would put quotation marks and you would specify a field delimiter in between them.
If you wanted to a colon, this is how you would do it
but we don't want a colon, we just want a space and that's it.
Open single quotation marks, open curly brackets
type in "print", space, dollar sign
and then you just need to type in the number of the field that you would like to print out.
So we would like to print out the second field
2, close curly brackets, close quotation marks list, press ENTER, and there we go.
We have all the IP addresses listed of the hosts that are up, without anything else.
Now what you can do with this is pass it to another file.
It's called SCAN2
press ENTER
and then you can type in "nmap -iL SCAN2"
and then you can do a full nmap scan for just four hosts.
So now you can so a full scan for just four hosts instead of doing it for all 255 hosts.
Just figure out which hosts are alive
and you don't need to do that port 22 or something of a kind.
Just do a ping sweep and that's going to be it.
You will be able to figure out which hosts are alive, perform detailed analysis of this particular host
and you can see I'm already receiving information here.
It says port 21...
Yeah, that's not the best of ideas, but this is my home router that using for these testing purposes.
It is filled with holes
and don't worry about it, I'm gonna switch it as soon as I'm done with the tutorial.
I have 431 on 102
so I probably have some ssl going on there
Port 80 here, port 23
We will soon see what all these services mean
However, you can experience these flags here and usually you will get them delays
because, you know, there are some packets that are being dropped
some that are being refused by the servers on the other side.
You can also have time limiters and so on and so forth.
So here you can see the scans and what they have revealed thus far.
They've given me details scans
and they can tell me pretty much everything that I want to know in regards to the local area network.
It even gives out the MAC addresses, which I'm gonna cover up and you won't be able to see them
but in any case, you see how much information do you get
and how much time you can save.
Now I'm going to call the tutorial here and we will move on to the next one.
I hope that you enjoyed this one
and I'll see you next time.