1
1
00:00:00,210 --> 00:00:03,000
In this lesson, I want to show you hands on
2
2
00:00:03,000 --> 00:00:06,180
how we use Nmap, by combining some of those commands
3
3
00:00:06,180 --> 00:00:08,700
we learned about in the Nmap usage lecture
4
4
00:00:08,700 --> 00:00:12,930
into a real scan and real information gathering techniques.
5
5
00:00:12,930 --> 00:00:15,120
Now this is really important come test day,
6
6
00:00:15,120 --> 00:00:18,300
because I guarantee you're going to get some Nmap question.
7
7
00:00:18,300 --> 00:00:20,160
I want you to play with Nmap before the exam,
8
8
00:00:20,160 --> 00:00:21,930
I want you to be comfortable with it
9
9
00:00:21,930 --> 00:00:23,970
because these are going to be easy points for you
10
10
00:00:23,970 --> 00:00:26,070
if you've gotten used to doing these scans.
11
11
00:00:26,070 --> 00:00:29,340
Now for this demonstration I've put together this lab.
12
12
00:00:29,340 --> 00:00:32,130
On the left side this is where I'm going to be attacking from
13
13
00:00:32,130 --> 00:00:34,410
which is going to be simulating the intranet.
14
14
00:00:34,410 --> 00:00:36,750
I'm coming in from outside the network
15
15
00:00:36,750 --> 00:00:38,070
and the router has certain things
16
16
00:00:38,070 --> 00:00:40,140
in place to try to keep me out.
17
17
00:00:40,140 --> 00:00:43,230
I'm going to attack from my Kalilinux command line environment
18
18
00:00:43,230 --> 00:00:46,590
which you can see highlighted with the red dash lines,
19
19
00:00:46,590 --> 00:00:48,330
going to come in through the router
20
20
00:00:48,330 --> 00:00:51,120
which is separating the intranet, the outside,
21
21
00:00:51,120 --> 00:00:53,880
versus the target network, which is the inside.
22
22
00:00:53,880 --> 00:00:56,310
And so with our scans we're going to try discover
23
23
00:00:56,310 --> 00:00:58,050
those three servers on the right,
24
24
00:00:58,050 --> 00:01:00,960
the LAMP server, the Metasploitable2,
25
25
00:01:00,960 --> 00:01:04,800
and the Dam Vulnerable Web App or DVWA.
26
26
00:01:04,800 --> 00:01:09,753
Now those all reside inside the 10.10.10.0/24 network.
27
27
00:01:10,770 --> 00:01:13,440
So now that we are in the command line environment,
28
28
00:01:13,440 --> 00:01:14,880
what are we going to do?
29
29
00:01:14,880 --> 00:01:17,430
Well, we first are going to want to find out
30
30
00:01:17,430 --> 00:01:22,170
which things on the 10.10.10.0 network
31
31
00:01:22,170 --> 00:01:24,090
are up and which ones are down,
32
32
00:01:24,090 --> 00:01:26,340
so we want to use that ping scan.
33
33
00:01:26,340 --> 00:01:29,100
Now, do you remember what the command is for a ping scan?
34
34
00:01:29,100 --> 00:01:33,390
That's right, it's nmap-sn, and then the IP address.
35
35
00:01:33,390 --> 00:01:38,010
So for us that's 10.10.10.0/24.
36
36
00:01:38,010 --> 00:01:42,660
It's going to go through and scan all 254 possible IPs
37
37
00:01:42,660 --> 00:01:45,330
and find which ones are up and which ones are down.
38
38
00:01:45,330 --> 00:01:47,250
Now it came back with four hosts.
39
39
00:01:47,250 --> 00:01:48,810
What are those four hosts?
40
40
00:01:48,810 --> 00:01:51,090
Well, the .1 is the router itself,
41
41
00:01:51,090 --> 00:01:53,280
it's the internal interface of the router.
42
42
00:01:53,280 --> 00:01:56,310
There is the .10, which is one of our servers
43
43
00:01:56,310 --> 00:01:59,670
the .11 and the .12, which is the other two servers.
44
44
00:01:59,670 --> 00:02:02,730
So the .10 is going to represent the LAMP server.
45
45
00:02:02,730 --> 00:02:05,430
The .11 is our Metasploitable2 server,
46
46
00:02:05,430 --> 00:02:09,030
and the .12 is going to be our DVWA,
47
47
00:02:09,030 --> 00:02:11,340
or Dam Vulnerable Web App.
48
48
00:02:11,340 --> 00:02:13,380
Now all we have at this point is knowing
49
49
00:02:13,380 --> 00:02:16,290
that those three servers are up, and responding to pings,
50
50
00:02:16,290 --> 00:02:18,270
we have no other information.
51
51
00:02:18,270 --> 00:02:20,280
So we're going to want to take it a step further.
52
52
00:02:20,280 --> 00:02:23,490
Let's go ahead and do a sin scan,
53
53
00:02:23,490 --> 00:02:27,270
which if you remember the command is nmap-sS
54
54
00:02:27,270 --> 00:02:29,910
and then the IP address that we want to look at.
55
55
00:02:29,910 --> 00:02:32,460
But I'm going to combine that with port 80.
56
56
00:02:32,460 --> 00:02:35,100
So I'm going to figure out what web servers are being run
57
57
00:02:35,100 --> 00:02:36,840
out of this network.
58
58
00:02:36,840 --> 00:02:41,840
And then we're going to use the 10.10.10.0/24.
59
59
00:02:41,910 --> 00:02:45,060
Now as I scan away, going to check all
60
60
00:02:45,060 --> 00:02:48,090
of the 254 IPs again, and in this case,
61
61
00:02:48,090 --> 00:02:51,390
we found there are four web servers responding.
62
62
00:02:51,390 --> 00:02:55,530
There's port 80 responding up as closed on the router,
63
63
00:02:55,530 --> 00:02:59,130
it is open on the LAMP server, the .10,
64
64
00:02:59,130 --> 00:03:02,310
it is open on the .11, which is Metasploitable2,
65
65
00:03:02,310 --> 00:03:06,960
and it is open on .12 which is the Dam Vulnerable Web App.
66
66
00:03:06,960 --> 00:03:10,530
So all three of my servers are running at least port 80.
67
67
00:03:10,530 --> 00:03:12,660
Now let's dig in deeper on one of those servers
68
68
00:03:12,660 --> 00:03:15,030
as we go further in our information gathering.
69
69
00:03:15,030 --> 00:03:16,470
Let's go ahead and do a sin scan
70
70
00:03:16,470 --> 00:03:19,290
against the LAMP server, which is the .10.
71
71
00:03:19,290 --> 00:03:24,290
So we're going to do nmap-sS and then 10.10.10.10,
72
72
00:03:25,860 --> 00:03:27,750
and we'll go ahead and search that,
73
73
00:03:27,750 --> 00:03:29,670
and you can see now that there are more
74
74
00:03:29,670 --> 00:03:31,230
than just the web server running, right?
75
75
00:03:31,230 --> 00:03:34,350
There are three services running on this server.
76
76
00:03:34,350 --> 00:03:37,050
There's an SSH server on port 22,
77
77
00:03:37,050 --> 00:03:39,060
there's the web server on port 80,
78
78
00:03:39,060 --> 00:03:42,390
and the web proxy on port 80 80.
79
79
00:03:42,390 --> 00:03:46,050
Now that we've found those, what about the versions?
80
80
00:03:46,050 --> 00:03:47,790
What if I wanted to figure out what version
81
81
00:03:47,790 --> 00:03:51,180
of web server it was running on port 80?
82
82
00:03:51,180 --> 00:03:52,860
Well, how would we do that?
83
83
00:03:52,860 --> 00:03:57,860
Well, we're going to use nmap-sV and then the 10.10.10.10.
84
84
00:04:01,200 --> 00:04:03,600
And now if we run it, you're going to see a little bit
85
85
00:04:03,600 --> 00:04:04,650
of a difference here.
86
86
00:04:04,650 --> 00:04:06,450
So you're going to see it takes a little bit longer
87
87
00:04:06,450 --> 00:04:09,390
to run this, but instead of half a second,
88
88
00:04:09,390 --> 00:04:11,340
it's taking almost seven seconds.
89
89
00:04:11,340 --> 00:04:14,010
The difference here is that I get the versioning
90
90
00:04:14,010 --> 00:04:16,050
associated with each of those services.
91
91
00:04:16,050 --> 00:04:18,030
So the same three services are up,
92
92
00:04:18,030 --> 00:04:20,760
but I found out that it's running some form of Linux
93
93
00:04:20,760 --> 00:04:25,050
and it's running Apache 2.4.18, which tells me
94
94
00:04:25,050 --> 00:04:27,090
that I could start associating vulnerabilities associated
95
95
00:04:27,090 --> 00:04:29,310
with that and attack this machine.
96
96
00:04:29,310 --> 00:04:31,260
Now it tells me it's Ubuntu Linux,
97
97
00:04:31,260 --> 00:04:33,300
but it doesn't tell me what version.
98
98
00:04:33,300 --> 00:04:35,790
What if I wanted to go deeper and figure out the version
99
99
00:04:35,790 --> 00:04:38,133
of this operating system, how would I do that?
100
100
00:04:39,180 --> 00:04:41,370
Well, it's not sV because that's the version
101
101
00:04:41,370 --> 00:04:43,800
for the service, instead it's -O
102
102
00:04:43,800 --> 00:04:45,420
because it's for the operating system.
103
103
00:04:45,420 --> 00:04:50,190
So it's nmap-O and then 10.10.10.10.
104
104
00:04:50,190 --> 00:04:53,610
And then we'll go ahead and hit enter and away it goes.
105
105
00:04:53,610 --> 00:04:55,530
And it comes back in less than two seconds
106
106
00:04:55,530 --> 00:04:57,990
and tells me that it is Linux somewhere
107
107
00:04:57,990 --> 00:05:00,290
between version 3.2 and 4.6.
108
108
00:05:01,470 --> 00:05:03,660
So let's go ahead and take it a step further,
109
109
00:05:03,660 --> 00:05:05,640
let's combine some commands.
110
110
00:05:05,640 --> 00:05:10,640
Let's go ahead and do an Nmap scan for -sS,
111
111
00:05:11,010 --> 00:05:15,090
we're also going to do -sV for the versioning,
112
112
00:05:15,090 --> 00:05:17,760
and we're going to go ahead and add the -O
113
113
00:05:17,760 --> 00:05:19,890
to get the operating system.
114
114
00:05:19,890 --> 00:05:23,790
I'm going to do that against 10.10.10.10
115
115
00:05:23,790 --> 00:05:28,500
through 10.10.10.12, those three machines,
116
116
00:05:28,500 --> 00:05:29,853
and see what comes back.
117
117
00:05:31,560 --> 00:05:33,180
Now you may have noticed that it keeps saying
118
118
00:05:33,180 --> 00:05:35,940
it's unable to determine any DNS servers,
119
119
00:05:35,940 --> 00:05:38,400
that's an error because I don't have
120
120
00:05:38,400 --> 00:05:40,620
this lab environment connected to the internet,
121
121
00:05:40,620 --> 00:05:42,600
so there's no DNS being resolved.
122
122
00:05:42,600 --> 00:05:44,880
It's not an issue because we're using IP addresses,
123
123
00:05:44,880 --> 00:05:45,900
but if I tried to do something
124
124
00:05:45,900 --> 00:05:48,330
like scanning google.com right now,
125
125
00:05:48,330 --> 00:05:50,400
it wouldn't be able to give me that answer back
126
126
00:05:50,400 --> 00:05:53,463
because it doesn't know what the IP address is for Google.
127
127
00:05:54,810 --> 00:05:56,490
Now this scan is going to take a little bit longer
128
128
00:05:56,490 --> 00:05:57,570
so I'm going to fast forward
129
129
00:05:57,570 --> 00:05:59,820
to when the scan comes back with the results.
130
130
00:06:01,290 --> 00:06:02,760
Now the results have come back,
131
131
00:06:02,760 --> 00:06:07,410
it took 140 seconds, so it took almost three minutes.
132
132
00:06:07,410 --> 00:06:09,750
so this has come back with a ton of information,
133
133
00:06:09,750 --> 00:06:12,240
so much so, that it actually scrolled off my screen.
134
134
00:06:12,240 --> 00:06:15,240
So we're going to scroll back up to where I put in the command.
135
135
00:06:16,620 --> 00:06:18,780
So there we go, there's the command we put in,
136
136
00:06:18,780 --> 00:06:23,780
nmap-sS, a SYN scan, -sV, versioning for the services,
137
137
00:06:25,405 --> 00:06:28,740
capital O for operating system versioning
138
138
00:06:28,740 --> 00:06:32,953
and then 10.10.10.10 through 10.10.10.12.
139
139
00:06:34,440 --> 00:06:36,030
Now the first one it comes back with
140
140
00:06:36,030 --> 00:06:38,820
is the results for 10.10.10.10,
141
141
00:06:38,820 --> 00:06:42,120
which shows that there are 997 closed ports
142
142
00:06:42,120 --> 00:06:44,250
'cause by default Nmap is going to scan
143
143
00:06:44,250 --> 00:06:47,550
the top 1000 commonly open ports.
144
144
00:06:47,550 --> 00:06:49,980
You'll notice here there was those same three ports
145
145
00:06:49,980 --> 00:06:54,000
that we found earlier, port 22, port 80, and port 80 80.
146
146
00:06:54,000 --> 00:06:55,680
And you'll notice it tells us what version
147
147
00:06:55,680 --> 00:06:58,950
of SSH and what version of Apache is being run.
148
148
00:06:58,950 --> 00:07:01,110
And again, the versioning of Linux was somewhere
149
149
00:07:01,110 --> 00:07:05,280
between 3.2 and 4.6, not very accurate.
150
150
00:07:05,280 --> 00:07:06,870
Now if we look at the bottom of the screen
151
151
00:07:06,870 --> 00:07:09,240
I'm going to scroll it up to the top here.
152
152
00:07:09,240 --> 00:07:11,733
This is the scan report for 10.10.10.11.
153
153
00:07:13,950 --> 00:07:16,500
Notice this one has a ton of open stuff.
154
154
00:07:16,500 --> 00:07:19,740
It only has 979 closed ports,
155
155
00:07:19,740 --> 00:07:22,200
which means that there are 21 open ports,
156
156
00:07:22,200 --> 00:07:24,420
and you'll see them all shown on the screen there.
157
157
00:07:24,420 --> 00:07:28,470
Things like FTP and SSH and Telnet and HTTP
158
158
00:07:28,470 --> 00:07:33,470
and RPCbind and port 139 and 445 for NetBIOS-ssn
159
159
00:07:33,480 --> 00:07:35,730
which is Samba for Windows file sharing
160
160
00:07:35,730 --> 00:07:38,430
between a Linux machine and a Windows machine.
161
161
00:07:38,430 --> 00:07:39,720
All of these different things
162
162
00:07:39,720 --> 00:07:41,520
with all of these different versions.
163
163
00:07:41,520 --> 00:07:43,680
Now this is a great machine that we can target
164
164
00:07:43,680 --> 00:07:46,230
because we have a lot of vulnerable apps on it.
165
165
00:07:46,230 --> 00:07:48,270
Things like Apache 2.2.8,
166
166
00:07:48,270 --> 00:07:50,280
there's exploits that exist for that.
167
167
00:07:50,280 --> 00:07:54,810
There's VSFTPD 2.3.4 for the FTP service,
168
168
00:07:54,810 --> 00:07:56,730
that's a vulnerable version we can attack.
169
169
00:07:56,730 --> 00:07:59,820
There's proFTPD 1.3.1,
170
170
00:07:59,820 --> 00:08:03,270
there's MySQL version 5.0.51, right?
171
171
00:08:03,270 --> 00:08:05,850
Lots of different pieces of information
172
172
00:08:05,850 --> 00:08:08,700
that we can use to then later exploit it.
173
173
00:08:08,700 --> 00:08:11,730
Now it does say that one service was unrecognized
174
174
00:08:11,730 --> 00:08:13,260
even though it gave back data,
175
175
00:08:13,260 --> 00:08:15,180
and they weren't really sure what it was
176
176
00:08:15,180 --> 00:08:16,980
because there wasn't a valid fingerprint
177
177
00:08:16,980 --> 00:08:19,110
and you can submit it to Nmap
178
178
00:08:19,110 --> 00:08:21,240
for them to try to figure it out better.
179
179
00:08:21,240 --> 00:08:23,100
If you know what the service is, you could tell it,
180
180
00:08:23,100 --> 00:08:25,980
and then they can add that to the next version of Nmap.
181
181
00:08:25,980 --> 00:08:27,600
Now as we scroll out a little bit further
182
182
00:08:27,600 --> 00:08:29,993
we'll go through that signature that they gave us,
183
183
00:08:31,410 --> 00:08:34,590
and you can see that the version of Linux here
184
184
00:08:34,590 --> 00:08:37,670
was again version 3.2 to version 4.6.
185
185
00:08:38,976 --> 00:08:41,490
And so that again wasn't real helpful.
186
186
00:08:41,490 --> 00:08:43,620
And the reason why we're getting that wide range
187
187
00:08:43,620 --> 00:08:45,540
of operating systems is because this
188
188
00:08:45,540 --> 00:08:47,730
is all actually being run in a Docker environment,
189
189
00:08:47,730 --> 00:08:50,040
so they're all sharing the same operating system.
190
190
00:08:50,040 --> 00:08:52,770
This is a container based virtualization.
191
191
00:08:52,770 --> 00:08:54,450
Now as I scroll on down,
192
192
00:08:54,450 --> 00:08:57,780
we're going to see the results for 10.10.10.12.
193
193
00:08:57,780 --> 00:09:00,240
And this one only has one port that's open,
194
194
00:09:00,240 --> 00:09:04,170
and it's running Apache version 2.4.10.
195
195
00:09:04,170 --> 00:09:06,390
So again, we can go and look for something
196
196
00:09:06,390 --> 00:09:07,830
that would be able to be exploited
197
197
00:09:07,830 --> 00:09:10,470
and go after that server using that.
198
198
00:09:10,470 --> 00:09:13,080
So that's the idea here as we start scanning
199
199
00:09:13,080 --> 00:09:15,060
and figuring out all this information.
200
200
00:09:15,060 --> 00:09:17,850
Now all that was a lot of information to put on the screen.
201
201
00:09:17,850 --> 00:09:18,960
Wouldn't it have been helpful
202
202
00:09:18,960 --> 00:09:21,690
if I output that into a grepable file?
203
203
00:09:21,690 --> 00:09:22,830
Well, certainly it would.
204
204
00:09:22,830 --> 00:09:24,990
For any of these commands we could have output this
205
205
00:09:24,990 --> 00:09:26,580
to a file and that way we'd have it
206
206
00:09:26,580 --> 00:09:28,470
for our reference later on,
207
207
00:09:28,470 --> 00:09:30,600
because when you go back a couple days from now,
208
208
00:09:30,600 --> 00:09:31,980
you're not going to remember what ports were open
209
209
00:09:31,980 --> 00:09:33,540
on any of these machines, right?
210
210
00:09:33,540 --> 00:09:35,520
That's why having these files will be helpful.
211
211
00:09:35,520 --> 00:09:40,520
So instead I'm going to use nmap-sS-P port 80
212
212
00:09:41,490 --> 00:09:44,130
and I want to get the versioning of that,
213
213
00:09:44,130 --> 00:09:48,240
and I'm going look at that on 10.10.10.10
214
214
00:09:48,240 --> 00:09:52,530
through 10.10.10.12, and I want to output that
215
215
00:09:52,530 --> 00:09:55,653
to a grepable format, and I'll just call that,
216
216
00:09:56,550 --> 00:10:00,450
output nmap.txt.
217
217
00:10:00,450 --> 00:10:03,480
We'll go ahead and hit enter, it will run that scan.
218
218
00:10:03,480 --> 00:10:05,340
And in addition to putting it to the screen
219
219
00:10:05,340 --> 00:10:07,380
that I can see it, it will also save it
220
220
00:10:07,380 --> 00:10:09,120
into that grepable file.
221
221
00:10:09,120 --> 00:10:11,790
Now, how do I find that grepable file?
222
222
00:10:11,790 --> 00:10:13,620
Well, let me go ahead and clear my screen here.
223
223
00:10:13,620 --> 00:10:17,220
And if we do LS in Linux, that will list our directory.
224
224
00:10:17,220 --> 00:10:20,670
And you'll see here output Nmap is listed right there.
225
225
00:10:20,670 --> 00:10:24,060
And so I can just use a Pico, which is an editor,
226
226
00:10:24,060 --> 00:10:29,060
and just type in output nmap.txt and hit enter,
227
227
00:10:29,340 --> 00:10:30,930
and there it is to the screen.
228
228
00:10:30,930 --> 00:10:33,090
Notice it looks different here because it's grepable.
229
229
00:10:33,090 --> 00:10:35,160
They removed a lot of those new lines,
230
230
00:10:35,160 --> 00:10:37,020
they removed a lot of the special formatting,
231
231
00:10:37,020 --> 00:10:38,280
and they made it really easy for us
232
232
00:10:38,280 --> 00:10:39,750
to find the information we want.
233
233
00:10:39,750 --> 00:10:41,490
For example, we have the hosts on the left,
234
234
00:10:41,490 --> 00:10:44,700
very clean, status was up or status was down.
235
235
00:10:44,700 --> 00:10:46,770
And then we have the ports that were open, right?
236
236
00:10:46,770 --> 00:10:50,910
Port 80, it's open, it's tcp, and it was an HTTP service
237
237
00:10:50,910 --> 00:10:52,820
running this version of Apache.
238
238
00:10:52,820 --> 00:10:54,510
So you can see why this grepable format
239
239
00:10:54,510 --> 00:10:56,340
is very, very useful.
240
240
00:10:56,340 --> 00:10:59,070
Now, from here I want you to download Nmap.
241
241
00:10:59,070 --> 00:11:00,330
I want you to play with it.
242
242
00:11:00,330 --> 00:11:02,130
Scan things inside your network,
243
243
00:11:02,130 --> 00:11:05,130
scan things like scan me.nmap.org.
244
244
00:11:05,130 --> 00:11:07,050
Try these things out, get used to it,
245
245
00:11:07,050 --> 00:11:09,210
because it's going to be essential to your success
246
246
00:11:09,210 --> 00:11:11,160
on the CYSA Plus exam.
247
247
00:11:11,160 --> 00:11:13,200
To be able to understand how to create these commands
248
248
00:11:13,200 --> 00:11:15,630
and how to read the output from these commands
249
249
00:11:15,630 --> 00:11:17,460
is going to be crucial for your job
250
250
00:11:17,460 --> 00:11:18,873
as a cybersecurity analyst.