Instructor: Nmap fingerprinting scans. 2 2
In this lesson, 3 3
we are going to talk a little bit more in depth 4 4
about fingerprinting scans. 5 5
So, we've talked about ports 6 6
and we've talked about port states, 7 7
but there's more information that you can get 8 8
by doing your fingerprinting. 9 9
When you do fingerprinting, 10 10
this is a technique that gets a list 11 11
of all the resources on the network, the host, 12 12
or the system as a whole, 13 13
to identify potential targets for future attack. 14 14
Now, this is the idea here with fingerprinting. 15 15
As an attacker, 16 16
I'm trying to find out all about your system 17 17
so I can figure out a way to penetrate it 18 18
and a way to exploit it. 19 19
You, as a defender, want to know that same information 20 20
so you can put defenses in place to stop me from doing that. 21 21
Now, once you start identifying the open ports 22 22
and you've discovered those, 23 23
we're then going to use Nmap to probe them intensely. 24 24
Now, what I mean by intensely? 25 25
Well, there's two ways of doing this. 26 26
You can use the command nmap -sV or nmap -A. 27 27
Both of these will do an intensive port scan. 28 28
Now, these scans do differ just a little bit. 29 29
When you're using sV, 30 30
you're going to be able to get 31 31
some basic versioning information, 32 32
but -A is going to do it more intensely 33 33
and discover even more data. 34 34
This intensive fingerprint scan 35 35
can provide you with a lot of detailed information. 36 36
Things like the protocols in use, 37 37
the application name and version, 38 38
the operating system type and version, 39 39
the host name, 40 40
and the device type. 41 41
All of this is great information. 42 42
So once your scan is complete, 43 43
you're going to see something that looks like this. 44 44
You're going to receive a list of the ports and their states. 45 45
Notice there are different states that a port can be in. 46 46
We talked about those. 47 47
We had open, and closed, and filtered, right? 48 48
And so here, I see the first port is port 53. 49 49
It's a TCP port and it's open. 50 50
Now, what service does this run? 51 51
It runs domain service, domain name service. 52 52
Now, I also see the fingerprinting strings here, 53 53
and it shows me what version 54 54
of the bind request TCP was being used. 55 55
In this case, it couldn't identify the exact version 56 56
but it does know it's using bind. 57 57
Then, I see the next port, port 80. 58 58
This again is TCP, and it was open. 59 59
This is running our unclassified web service, HTTP. 60 60
What version is being run here? 61 61
Microsoft Internet Information Services. 62 62
That's running the HTTP daemon, 63 63
which is running on version 10.0. 64 64
Now, as I look into that, 65 65
it gives me even more information, 66 66
gives me some basic methods of how it's done that, 67 67
and the information it knows about it. 68 68
And as you go through this, 69 69
you're getting more and more details. 70 70
As you go further, 71 71
you can see the MAC address, 72 72
you can see what operating system it's using, 73 73
in this case, Windows Server 2016, 74 74
and all those types of details are things you can find out 75 75
by doing this type of in-depth, intensive probing 76 76
of those different ports and seeing what the responses are. 77 77
So you may be wondering, 78 78
how does Nmap fingerprint 79 79
what services and versions are running on this server? 80 80
How does it know all this information? 81 81
Well, it does it using what's known as a CPE, 82 82
which is the common platform enumeration. 83 83
This is a scheme 84 84
for identifying hardware devices, operating systems, 85 85
and applications developed by the MITRE corporation. 86 86
Essentially, this CPE 87 87
is a database of different fingerprint signatures 88 88
and what Nmap does is it compares the response it's getting 89 89
from these ports when it sends that SYN packet, 90 90
what it gets back as the SYN-ACK, 91 91
it looks at that packet 92 92
and determines which operating systems it is 93 93
and which versions, 94 94
because each one answers just a little bit differently. 95 95
That's the idea of using the CPE. 96 96
Now, Nmap is also a really powerful tool, 97 97
and it's even more powerful 98 98
when you can use scripting with it. 99 99
Nmap even comes with its own scripting engine. 100 100
It's known as the Nmap Scripting Engine, or NSE. 101 101
This allows scripts 102 102
that are written in the Lua scripting language 103 103
to be used to carry out detailed probes. 104 104
This includes things 105 105
like OS detection and platform enumeration, 106 106
Windows user account discovery, 107 107
identifying the logged-on Windows users against the system, 108 108
performing some basic vulnerability detection 109 109
to figure out what software's in use 110 110
and what might be vulnerable. 111 111
It can also be used to probe web servers to gather HTTP data 112 112
and identify web applications in use. 113 113
And you can even add geolocation 114 114
to your different traceroute probes. 115 115
All of this can be done using the NSE, 116 116
the Nmap Scripting Engine. 117 117
And if you go to nmap.org, 118 118
there are lots of scripts out there that you can use 119 119
and pass them directly into your Nmap, 120 120
so you don't even have to write these scripts yourself. 121 121
They already exist 122 122
for you to do all your work 123 123
as a cybersecurity analyst.