1 1 00:00:00,510 --> 00:00:03,210 Nmap fingerprinting scans. 2 2 00:00:03,210 --> 00:00:04,080 In this lesson, 3 3 00:00:04,080 --> 00:00:05,790 we are going to talk a little bit more in depth 4 4 00:00:05,790 --> 00:00:07,650 about fingerprinting scans. 5 5 00:00:07,650 --> 00:00:08,820 So, we've talked about ports 6 6 00:00:08,820 --> 00:00:10,020 and we've talked about port states, 7 7 00:00:10,020 --> 00:00:11,970 but there's more information that you can get 8 8 00:00:11,970 --> 00:00:13,620 by doing your fingerprinting. 9 9 00:00:13,620 --> 00:00:14,730 When you do fingerprinting, 10 10 00:00:14,730 --> 00:00:16,290 this is a technique that gets a list 11 11 00:00:16,290 --> 00:00:18,810 of all the resources on the network, the host, 12 12 00:00:18,810 --> 00:00:20,790 or the system as a whole, 13 13 00:00:20,790 --> 00:00:23,670 to identify potential targets for future attack. 14 14 00:00:23,670 --> 00:00:25,770 Now, this is the idea here with fingerprinting. 15 15 00:00:25,770 --> 00:00:26,603 As an attacker, 16 16 00:00:26,603 --> 00:00:28,680 I'm trying to find out all about your system 17 17 00:00:28,680 --> 00:00:30,630 so I can figure out a way to penetrate it 18 18 00:00:30,630 --> 00:00:32,160 and a way to exploit it. 19 19 00:00:32,160 --> 00:00:34,770 You, as a defender, want to know that same information 20 20 00:00:34,770 --> 00:00:37,950 so you can put defenses in place to stop me from doing that. 21 21 00:00:37,950 --> 00:00:40,260 Now, once you start identifying the open ports 22 22 00:00:40,260 --> 00:00:41,400 and you've discovered those, 23 23 00:00:41,400 --> 00:00:44,640 we're then going to use Nmap to probe them intensely. 24 24 00:00:44,640 --> 00:00:46,410 Now, what I mean by intensely? 25 25 00:00:46,410 --> 00:00:48,180 Well, there's two ways of doing this. 26 26 00:00:48,180 --> 00:00:53,180 You can use the command nmap -sV or nmap -A. 27 27 00:00:53,280 --> 00:00:56,190 Both of these will do an intensive port scan. 28 28 00:00:56,190 --> 00:00:58,830 Now, these scans do differ just a little bit. 29 29 00:00:58,830 --> 00:01:00,420 When you're using sV, 30 30 00:01:00,420 --> 00:01:01,253 you're going to be able to get 31 31 00:01:01,253 --> 00:01:02,880 some basic versioning information, 32 32 00:01:02,880 --> 00:01:05,040 but -A is going to do it more intensely 33 33 00:01:05,040 --> 00:01:07,260 and discover even more data. 34 34 00:01:07,260 --> 00:01:08,730 This intensive fingerprint scan 35 35 00:01:08,730 --> 00:01:11,670 can provide you with a lot of detailed information. 36 36 00:01:11,670 --> 00:01:13,440 Things like the protocols in use, 37 37 00:01:13,440 --> 00:01:15,300 the application name and version, 38 38 00:01:15,300 --> 00:01:17,340 the operating system type and version, 39 39 00:01:17,340 --> 00:01:18,270 the host name, 40 40 00:01:18,270 --> 00:01:19,950 and the device type. 41 41 00:01:19,950 --> 00:01:22,350 All of this is great information. 42 42 00:01:22,350 --> 00:01:23,880 So once your scan is complete, 43 43 00:01:23,880 --> 00:01:25,980 you're going to see something that looks like this. 44 44 00:01:25,980 --> 00:01:28,710 You're going to receive a list of the ports and their states. 45 45 00:01:28,710 --> 00:01:31,140 Notice there are different states that a port can be in. 46 46 00:01:31,140 --> 00:01:32,310 We talked about those. 47 47 00:01:32,310 --> 00:01:35,040 We had open, and closed, and filtered, right? 48 48 00:01:35,040 --> 00:01:38,490 And so here, I see the first port is port 53. 49 49 00:01:38,490 --> 00:01:41,310 It's a TCP port and it's open. 50 50 00:01:41,310 --> 00:01:42,630 Now, what service does this run? 51 51 00:01:42,630 --> 00:01:45,540 It runs domain service, domain name service. 52 52 00:01:45,540 --> 00:01:47,850 Now, I also see the fingerprinting strings here, 53 53 00:01:47,850 --> 00:01:49,290 and it shows me what version 54 54 00:01:49,290 --> 00:01:51,600 of the bind request TCP was being used. 55 55 00:01:51,600 --> 00:01:54,240 In this case, it couldn't identify the exact version 56 56 00:01:54,240 --> 00:01:56,460 but it does know it's using bind. 57 57 00:01:56,460 --> 00:01:58,890 Then, I see the next port, port 80. 58 58 00:01:58,890 --> 00:02:01,320 This again is TCP, and it was open. 59 59 00:02:01,320 --> 00:02:05,280 This is running our unclassified web service, HTTP. 60 60 00:02:05,280 --> 00:02:07,020 What version is being run here? 61 61 00:02:07,020 --> 00:02:09,330 Microsoft Internet Information Services. 62 62 00:02:09,330 --> 00:02:11,280 That's running the HTTP daemon, 63 63 00:02:11,280 --> 00:02:14,040 which is running on version 10.0. 64 64 00:02:14,040 --> 00:02:15,090 Now, as I look into that, 65 65 00:02:15,090 --> 00:02:16,680 it gives me even more information, 66 66 00:02:16,680 --> 00:02:18,960 gives me some basic methods of how it's done that, 67 67 00:02:18,960 --> 00:02:20,880 and the information it knows about it. 68 68 00:02:20,880 --> 00:02:21,840 And as you go through this, 69 69 00:02:21,840 --> 00:02:23,490 you're getting more and more details. 70 70 00:02:23,490 --> 00:02:24,330 As you go further, 71 71 00:02:24,330 --> 00:02:25,800 you can see the MAC address, 72 72 00:02:25,800 --> 00:02:27,510 you can see what operating system it's using, 73 73 00:02:27,510 --> 00:02:30,270 in this case, Windows Server 2016, 74 74 00:02:30,270 --> 00:02:32,880 and all those types of details are things you can find out 75 75 00:02:32,880 --> 00:02:36,060 by doing this type of in-depth, intensive probing 76 76 00:02:36,060 --> 00:02:39,030 of those different ports and seeing what the responses are. 77 77 00:02:39,030 --> 00:02:40,320 So you may be wondering, 78 78 00:02:40,320 --> 00:02:42,000 how does Nmap fingerprint 79 79 00:02:42,000 --> 00:02:44,730 what services and versions are running on this server? 80 80 00:02:44,730 --> 00:02:46,800 How does it know all this information? 81 81 00:02:46,800 --> 00:02:50,130 Well, it does it using what's known as a CPE, 82 82 00:02:50,130 --> 00:02:52,740 which is the common platform enumeration. 83 83 00:02:52,740 --> 00:02:53,573 This is a scheme 84 84 00:02:53,573 --> 00:02:55,980 for identifying hardware devices, operating systems, 85 85 00:02:55,980 --> 00:02:58,950 and applications developed by the MITRE corporation. 86 86 00:02:58,950 --> 00:03:00,660 Essentially, this CPE 87 87 00:03:00,660 --> 00:03:03,600 is a database of different fingerprint signatures 88 88 00:03:03,600 --> 00:03:06,630 and what Nmap does is it compares the response it's getting 89 89 00:03:06,630 --> 00:03:09,030 from these ports when it sends that SYN packet, 90 90 00:03:09,030 --> 00:03:10,890 what it gets back as the SYN-ACK, 91 91 00:03:10,890 --> 00:03:12,030 it looks at that packet 92 92 00:03:12,030 --> 00:03:14,400 and determines which operating systems it is 93 93 00:03:14,400 --> 00:03:15,510 and which versions, 94 94 00:03:15,510 --> 00:03:18,450 because each one answers just a little bit differently. 95 95 00:03:18,450 --> 00:03:20,730 That's the idea of using the CPE. 96 96 00:03:20,730 --> 00:03:23,010 Now, Nmap is also a really powerful tool, 97 97 00:03:23,010 --> 00:03:24,540 and it's even more powerful 98 98 00:03:24,540 --> 00:03:26,430 when you can use scripting with it. 99 99 00:03:26,430 --> 00:03:28,770 Nmap even comes with its own scripting engine. 100 100 00:03:28,770 --> 00:03:32,130 It's known as the Nmap Scripting Engine, or NSE. 101 101 00:03:32,130 --> 00:03:33,000 This allows scripts 102 102 00:03:33,000 --> 00:03:34,800 that are written in the Lua scripting language 103 103 00:03:34,800 --> 00:03:37,320 to be used to carry out detailed probes. 104 104 00:03:37,320 --> 00:03:38,153 This includes things 105 105 00:03:38,153 --> 00:03:41,010 like OS detection and platform enumeration, 106 106 00:03:41,010 --> 00:03:42,960 Windows user account discovery, 107 107 00:03:42,960 --> 00:03:46,050 identifying the logged-on Windows users against the system, 108 108 00:03:46,050 --> 00:03:48,120 performing some basic vulnerability detection 109 109 00:03:48,120 --> 00:03:49,500 to figure out what software's in use 110 110 00:03:49,500 --> 00:03:50,850 and what might be vulnerable. 111 111 00:03:50,850 --> 00:03:54,090 It can also be used to probe web servers to gather HTTP data 112 112 00:03:54,090 --> 00:03:56,340 and identify web applications in use. 113 113 00:03:56,340 --> 00:03:58,380 And you can even add geolocation 114 114 00:03:58,380 --> 00:04:00,240 to your different traceroute probes. 115 115 00:04:00,240 --> 00:04:02,520 All of this can be done using the NSE, 116 116 00:04:02,520 --> 00:04:04,140 the Nmap Scripting Engine. 117 117 00:04:04,140 --> 00:04:05,520 And if you go to nmap.org, 118 118 00:04:05,520 --> 00:04:07,980 there are lots of scripts out there that you can use 119 119 00:04:07,980 --> 00:04:09,840 and pass them directly into your Nmap, 120 120 00:04:09,840 --> 00:04:11,430 so you don't even have to write these scripts yourself. 121 121 00:04:11,430 --> 00:04:12,510 They already exist 122 122 00:04:12,510 --> 00:04:13,650 for you to do all your work 123 123 00:04:13,650 --> 00:04:15,123 as a cybersecurity analyst.