-: In this lesson, I want to show you hands on 2 2
how we use Nmap, by combining some of those commands 3 3
we learned about in the Nmap usage lecture 4 4
into a real scan and real information gathering techniques. 5 5
Now this is really important come test day, 6 6
because I guarantee you're going to get some Nmap question. 7 7
I want you to play with Nmap before the exam, 8 8
I want you to be comfortable with it 9 9
because these are going to be easy points for you 10 10
if you've gotten used to doing these scans. 11 11
Now for this demonstration I've put together this lab. 12 12
On the left side this is where I'm going to be attacking from 13 13
which is going to be simulating the intranet. 14 14
I'm coming in from outside the network 15 15
and the router has certain things 16 16
in place to try to keep me out. 17 17
I'm going to attack from my Kalilinux command line environment 18 18
which you can see highlighted with the red dash lines, 19 19
going to come in through the router 20 20
which is separating the intranet, the outside, 21 21
versus the target network, which is the inside. 22 22
And so with our scans we're going to try discover 23 23
those three servers on the right, 24 24
the LAMP server, the Metasploitable2, 25 25
and the Dam Vulnerable Web App or DVWA. 26 26
Now those all reside inside the 10.10.10.0/24 network. 27 27
So now that we are in the command line environment, 28 28
what are we going to do? 29 29
Well, we first are going to want to find out 30 30
which things on the 10.10.10.0 network 31 31
are up and which ones are down, 32 32
so we want to use that ping scan. 33 33
Now, do you remember what the command is for a ping scan? 34 34
That's right, it's nmap-sn, and then the IP address. 35 35
So for us that's 10.10.10.0/24. 36 36
It's going to go through and scan all 254 possible IPs 37 37
and find which ones are up and which ones are down. 38 38
Now it came back with four hosts. 39 39
What are those four hosts? 40 40
Well, the .1 is the router itself, 41 41
it's the internal interface of the router. 42 42
There is the .10, which is one of our servers 43 43
the .11 and the .12, which is the other two servers. 44 44
So the .10 is going to represent the LAMP server. 45 45
The .11 is our Metasploitable2 server, 46 46
and the .12 is going to be our DVWA, 47 47
or Dam Vulnerable Web App. 48 48
Now all we have at this point is knowing 49 49
that those three servers are up, and responding to pings, 50 50
we have no other information. 51 51
So we're going to want to take it a step further. 52 52
Let's go ahead and do a sin scan, 53 53
which if you remember the command is nmap-sS 54 54
and then the IP address that we want to look at. 55 55
But I'm going to combine that with port 80. 56 56
So I'm going to figure out what web servers are being run 57 57
out of this network. 58 58
And then we're going to use the 10.10.10.0/24. 59 59
Now as I scan away, going to check all 60 60
of the 254 IPs again, and in this case, 61 61
we found there are four web servers responding. 62 62
There's port 80 responding up as closed on the router, 63 63
it is open on the LAMP server, the .10, 64 64
it is open on the .11, which is Metasploitable2, 65 65
and it is open on .12 which is the Dam Vulnerable Web App. 66 66
So all three of my servers are running at least port 80. 67 67
Now let's dig in deeper on one of those servers 68 68
as we go further in our information gathering. 69 69
Let's go ahead and do a sin scan 70 70
against the LAMP server, which is the .10. 71 71
So we're going to do nmap-sS and then 10.10.10.10, 72 72
and we'll go ahead and search that, 73 73
and you can see now that there are more 74 74
than just the web server running, right? 75 75
There are three services running on this server. 76 76
There's an SSH server on port 22, 77 77
there's the web server on port 80, 78 78
and the web proxy on port 80 80. 79 79
Now that we've found those, what about the versions? 80 80
What if I wanted to figure out what version 81 81
of web server it was running on port 80? 82 82
Well, how would we do that? 83 83
Well, we're going to use nmap-sV and then the 10.10.10.10. 84 84
And now if we run it, you're going to see a little bit 85 85
of a difference here. 86 86
So you're going to see it takes a little bit longer 87 87
to run this, but instead of half a second, 88 88
it's taking almost seven seconds. 89 89
The difference here is that I get the versioning 90 90
associated with each of those services. 91 91
So the same three services are up, 92 92
but I found out that it's running some form of Linux 93 93
and it's running Apache 2.4.18, which tells me 94 94
that I could start associating vulnerabilities associated 95 95
with that and attack this machine. 96 96
Now it tells me it's Ubuntu Linux, 97 97
but it doesn't tell me what version. 98 98
What if I wanted to go deeper and figure out the version 99 99
of this operating system, how would I do that? 100 100
Well, it's not sV because that's the version 101 101
for the service, instead it's -O 102 102
because it's for the operating system. 103 103
So it's nmap-O and then 10.10.10.10. 104 104
And then we'll go ahead and hit enter and away it goes. 105 105
And it comes back in less than two seconds 106 106
and tells me that it is Linux somewhere 107 107
between version 3.2 and 4.6. 108 108
So let's go ahead and take it a step further, 109 109
let's combine some commands. 110 110
Let's go ahead and do an Nmap scan for -sS, 111 111
we're also going to do -sV for the versioning, 112 112
and we're going to go ahead and add the -O 113 113
to get the operating system. 114 114
I'm going to do that against 10.10.10.10 115 115
through 10.10.10.12, those three machines, 116 116
and see what comes back. 117 117
Now you may have noticed that it keeps saying 118 118
it's unable to determine any DNS servers, 119 119
that's an error because I don't have 120 120
this lab environment connected to the internet, 121 121
so there's no DNS being resolved. 122 122
It's not an issue because we're using IP addresses, 123 123
but if I tried to do something 124 124
like scanning google.com right now, 125 125
it wouldn't be able to give me that answer back 126 126
because it doesn't know what the IP address is for Google. 127 127
Now this scan is going to take a little bit longer 128 128
so I'm going to fast forward 129 129
to when the scan comes back with the results. 130 130
Now the results have come back, 131 131
it took 140 seconds, so it took almost three minutes. 132 132
so this has come back with a ton of information, 133 133
so much so, that it actually scrolled off my screen. 134 134
So we're going to scroll back up to where I put in the command. 135 135
So there we go, there's the command we put in, 136 136
nmap-sS, a SYN scan, -sV, versioning for the services, 137 137
-: capital O for operating system versioning 138 138
and then 10.10.10.10 through 10.10.10.12. 139 139
Now the first one it comes back with 140 140
is the results for 10.10.10.10, 141 141
which shows that there are 997 closed ports 142 142
'cause by default Nmap is going to scan 143 143
the top 1000 commonly open ports. 144 144
You'll notice here there was those same three ports 145 145
that we found earlier, port 22, port 80, and port 80 80. 146 146
And you'll notice it tells us what version 147 147
of SSH and what version of Apache is being run. 148 148
And again, the versioning of Linux was somewhere 149 149
between 3.2 and 4.6, not very accurate. 150 150
Now if we look at the bottom of the screen 151 151
I'm going to scroll it up to the top here. 152 152
This is the scan report for 10.10.10.11. 153 153
Notice this one has a ton of open stuff. 154 154
It only has 979 closed ports, 155 155
which means that there are 21 open ports, 156 156
and you'll see them all shown on the screen there. 157 157
Things like FTP and SSH and Telnet and HTTP 158 158
and RPCbind and port 139 and 445 for NetBIOS-ssn 159 159
which is Samba for Windows file sharing 160 160
between a Linux machine and a Windows machine. 161 161
All of these different things 162 162
with all of these different versions. 163 163
Now this is a great machine that we can target 164 164
because we have a lot of vulnerable apps on it. 165 165
Things like Apache 2.2.8, 166 166
there's exploits that exist for that. 167 167
There's VSFTPD 2.3.4 for the FTP service, 168 168
that's a vulnerable version we can attack. 169 169
There's proFTPD 1.3.1, 170 170
there's MySQL version 5.0.51, right? 171 171
Lots of different pieces of information 172 172
that we can use to then later exploit it. 173 173
Now it does say that one service was unrecognized 174 174
even though it gave back data, 175 175
and they weren't really sure what it was 176 176
because there wasn't a valid fingerprint 177 177
and you can submit it to Nmap 178 178
for them to try to figure it out better. 179 179
If you know what the service is, you could tell it, 180 180
and then they can add that to the next version of Nmap. 181 181
Now as we scroll out a little bit further 182 182
we'll go through that signature that they gave us, 183 183
and you can see that the version of Linux here 184 184
was again version 3.2 to version 4.6. 185 185
And so that again wasn't real helpful. 186 186
And the reason why we're getting that wide range 187 187
of operating systems is because this 188 188
is all actually being run in a Docker environment, 189 189
so they're all sharing the same operating system. 190 190
This is a container based virtualization. 191 191
Now as I scroll on down, 192 192
we're going to see the results for 10.10.10.12. 193 193
And this one only has one port that's open, 194 194
and it's running Apache version 2.4.10. 195 195
So again, we can go and look for something 196 196
that would be able to be exploited 197 197
and go after that server using that. 198 198
So that's the idea here as we start scanning 199 199
and figuring out all this information. 200 200
Now all that was a lot of information to put on the screen. 201 201
Wouldn't it have been helpful 202 202
if I output that into a grepable file? 203 203
Well, certainly it would. 204 204
For any of these commands we could have output this 205 205
to a file and that way we'd have it 206 206
for our reference later on, 207 207
because when you go back a couple days from now, 208 208
you're not going to remember what ports were open 209 209
on any of these machines, right? 210 210
That's why having these files will be helpful. 211 211
So instead I'm going to use nmap-sS-P port 80 212 212
and I want to get the versioning of that, 213 213
and I'm going look at that on 10.10.10.10 214 214
through 10.10.10.12, and I want to output that 215 215
to a grepable format, and I'll just call that, 216 216
output nmap.txt. 217 217
We'll go ahead and hit enter, it will run that scan. 218 218
And in addition to putting it to the screen 219 219
that I can see it, it will also save it 220 220
into that grepable file. 221 221
Now, how do I find that grepable file? 222 222
Well, let me go ahead and clear my screen here. 223 223
And if we do LS in Linux, that will list our directory. 224 224
And you'll see here output Nmap is listed right there. 225 225
And so I can just use a Pico, which is an editor, 226 226
and just type in output nmap.txt and hit enter, 227 227
and there it is to the screen. 228 228
Notice it looks different here because it's grepable. 229 229
They removed a lot of those new lines, 230 230
they removed a lot of the special formatting, 231 231
and they made it really easy for us 232 232
to find the information we want. 233 233
For example, we have the hosts on the left, 234 234
very clean, status was up or status was down. 235 235
And then we have the ports that were open, right? 236 236
Port 80, it's open, it's tcp, and it was an HTTP service 237 237
running this version of Apache. 238 238
So you can see why this grepable format 239 239
is very, very useful. 240 240
Now, from here I want you to download Nmap. 241 241
I want you to play with it. 242 242
Scan things inside your network, 243 243
scan things like scan me.nmap.org. 244 244
Try these things out, get used to it, 245 245
because it's going to be essential to your success 246 246
on the CYSA Plus exam. 247 247
To be able to understand how to create these commands 248 248
and how to read the output from these commands 249 249
is going to be crucial for your job 250 250
as a cybersecurity analyst.