Hello everybody and welcome to this tutorial.
Today I will show you a little bit more stuff that you can do Nmap
but more importantly than that
I will show you a tool which you can use to assign a physical location, namely a city, to an IP address.
It's relatively precise and it's relatively good
but the downside of it is that you can only make 1000 queries per day
which is still very reasonable
I mean, 1000 queries per day is a pretty good thing.
However, if you're doing some sort of mass scanning or something like that
it won't really help you.
You will need to go online and download the libraries for that
but 1000 is a very good number
and let me just show you how it actually works.
So here I have a command
This is the command that I've used to scan scanme.nmap.org and to get some information from it.
So it's "curl ipinfo.io/ ", and then you get an IP address here.
It's a curl script
So let me just copy/paste that here
and this is the command -- curl
This is the argument that you are passing through it, along with the IP address.
Once you press ENTER, it queries the server
and there you go.
You have an IP and you have a host.
You get a host name as well.
You get a city -- It's Fremont
It's region is California, country is US
you even get some coordinates here
organization, postal code, and so on and so forth.
So you get some really useful information here, in regards to an IP address
but as I said, the downside is that you can make 1000 queries per day
So you're not doing anything illegal here or anything of a kind.
You are simply querying a database somewhere in the world
to give you a specific information on an IP address.
You could have done this by simply typing on the net "Who is"
However, I wish to teach you how to do these things in the terminal
so that you will be less dependent on the browser or things of a kind.
Anyway, let me just go ahead and clear this.
Now what I wanted to discuss with you today are some external resources
which you can use in combination with Nmap.
Nmap has a wide variety of scripts that are applicable to it
and then you will be able to use nmap
in order to scan for particular vulnerabilities on the servers elsewhere in the world.
So just go ahead and open up your browser.
Okay, so I have this website -- scanme.nmap.org
open here
and on that website, there is a link
It's nmap.org
and then some link here.
You can just copy/paste this if you wish, or something of a kind.
Just read through it and then navigate over on their website
but it's not really that hard.
I'm here on nmap's website
and I have a list of categories of what sort of scripts can I run with nmap
in order to scan for particular vulnerabilities.
So there are 490 scripts, which is a lot.
For DoS, for denial of service attacks
those sort of vulnerabilities
for exploits
for, I don't know, for brute forcing, for identification. etc.
Anyway, let's just go and click on one of them.
Pretty much any will do. It's not a problem.
I'm gonna go ahead and click on vuln...some general thing
and now I have all these things here.
So if you're wondering "Well, how can I bypass firewall rules?"
Well, simply use a script.
It says "firewall-bypass"
Detects vulnerabilities in netfilter and other firewalls that use helpers to dynamically open ports for protocols...
...such as ftp and sip.
So this is going to help in a good amount of cases.
You can go ahead and open new tab
and once you click on it, you'll get the exact syntax how to use it.
"Example Usage"
It gives you the exact syntax.
There is nothing different that you need to do here.
Instead of , just type in the IP address, and that's it.
Literally that is only thing that you need to change here.
Just copy this command
and then just change the last thing into the IP address that you wish to scan.
Now I'm not going to go through all of them.
As I said, there are 490 scripts.
We will be using some of them, however, in the later tutorials
where you will get some clear demonstrations, once we actually start attacking particular services
and start exploiting their vulnerabilities.
However, again, I won't go through all 490 of them
because the course would be ridiculously long
but you can go to the Nmap website, find this...
So look -- You have security tools, security list, scanners, etc
There are so many resources here that you can use
and I strongly advise you to go on to this website and check it out
but just take a look...
This is probably the most important part for you and for everybody on this website
is the availability of these scripts.
So just take a look at what they do and what you can do with them
primarily because you can save yourself a ton load of time
by just conducting a scan for certain types of exploits.
If I click on exploits, it gives me all sorts of exploits.
So for example, if I'm attacking a very secure file transfer protocol
just read through it.
It explains in great detail what it does
Literally the exact syntax which you need to use.
Right next to it, you just type in the IP address of whatever host you want and that's it.
There are no changes, there is nothing else that you need to do
you just copy/paste this and change the name here.
Anyway, I'm just gonna go scroll up
and then I have yet another website that I wish to show you.
It's called ExploitDB
So just type in "exploitdb"
and the first sighted that pops up -- Exploit Database by Offensive Security
Click on it
This is pretty much one of the largest databases out there, in regards to vulnerabilities.
You can find them all in one place here.
There are literally here.
There are some very nice Wireless tricks that you can do here --
Reverse shells, privilege escalation...pretty much everything.
We will be using this site extensively in the follow-up tutorials
in other chapters as well
but I just wanted to mention it here, primarily so that you can explore it a little bit
and I strongly do advise you to do it.
Just go through the website.
For example, take a look at the router did you are using.
Just see what sort of a router you're using.
See what sort of a router was provided to you by the ISP provider
and then go ahead and click on Search in the top menu
and search for the vulnerabilities of your home router.
See what you can do with it.
You can look at by port.
There is a free text search, description, author
Look how many platforms are down there.
If you don't know what platform it is, just try a free search thing
type in the name of your router
type that in free search text
and it's bound to give you some vulnerabilities
because pretty much all the home routers have more vulnerabilities than they should.
So that is a task that I leave you with.
I want you to open up this website -- Exploit Database
find the vulnerability of your home router
figure out which one it is first.
Usually you can do this by just looking at the box of the router
and once you found the vulnerability, there will be a description on how to use it.
Try using it, try exploiting it
If it fails, and it probably won't
because all you need to do is copy/paste things into the Linux terminal
and we're gonna do some demonstrations later on along the way
as we do some more complex stuff
but before we do it, I want you to try it
and if you have any questions, post them in the question section.
I will be more than happy to not only answer them, but also to help you through the process as well
in terms of instructing you or something like that.
You don't need to pay anything extra for that.
I will do it gladly and help you out
but please give it a shot.
Try it first and then continue up the tutorial, see what I do
then perhaps you can fix your technique and improve yourselves.
Before I leave, just one more time
Over here, you have scripts that you can use with Nmap to detect particular vulnerabilities.
Just click on it.
Once you click on it, you will get the exact syntax.
All you need to do is change the IP address and type in "exploitdb"
Use this website extensively.
It is very good and there are lots of vulnerabilities on it.
Pretty much all of them are located there.
It is completely free.
You don't need to pay anything for any of the services that I have mentioned here.
Open, free, anybody can access
no registration required
and with that, I will leave you today
and one more time, I will urge you to try it yourselves
and then continue on with the course where I do it myself
and then you can see the particularities and the fine details of how it is done.
I bid you farewell and until next time.