1 1 00:00:00,090 --> 00:00:01,920 In this lesson, we're going to talk about 2 2 00:00:01,920 --> 00:00:03,960 the Angry IP Scanner. 3 3 00:00:03,960 --> 00:00:07,290 Now, the Angry IP Scanner is a popular open source tool 4 4 00:00:07,290 --> 00:00:09,030 that's used by cybersecurity analysts 5 5 00:00:09,030 --> 00:00:11,430 for network scanning and reconnaissance. 6 6 00:00:11,430 --> 00:00:14,040 This tool can be used to quickly scan an IP range 7 7 00:00:14,040 --> 00:00:15,930 to determine which hosts are active, 8 8 00:00:15,930 --> 00:00:18,690 as well as gather information about the hosts that are found 9 9 00:00:18,690 --> 00:00:20,940 such as their host name, operating system, 10 10 00:00:20,940 --> 00:00:23,190 open ports and running services. 11 11 00:00:23,190 --> 00:00:24,630 This information is crucial 12 12 00:00:24,630 --> 00:00:26,550 for identifying potential vulnerabilities 13 13 00:00:26,550 --> 00:00:29,400 and planning security measures to protect a network. 14 14 00:00:29,400 --> 00:00:32,190 Now, one of the main uses of the Angry IP Scanner 15 15 00:00:32,190 --> 00:00:34,590 is for reconnaissance and enumeration. 16 16 00:00:34,590 --> 00:00:36,450 This is the process of gathering information 17 17 00:00:36,450 --> 00:00:39,000 about a target network such as the IP address, 18 18 00:00:39,000 --> 00:00:40,980 the host names, and the open ports 19 19 00:00:40,980 --> 00:00:43,260 before attempting to exploit any vulnerabilities 20 20 00:00:43,260 --> 00:00:46,470 as a penetration tester or cybersecurity analyst. 21 21 00:00:46,470 --> 00:00:48,780 By using a tool like the Angry IP Scanner, 22 22 00:00:48,780 --> 00:00:50,700 cybersecurity analysts can quickly and easily 23 23 00:00:50,700 --> 00:00:54,330 scan a target network to identify live hosts and open ports, 24 24 00:00:54,330 --> 00:00:55,830 which can then be further investigated 25 25 00:00:55,830 --> 00:00:57,930 for potential vulnerabilities. 26 26 00:00:57,930 --> 00:01:00,300 Now, another use of the Angry IP Scanner 27 27 00:01:00,300 --> 00:01:02,880 is in identifying rogue or unauthorized devices 28 28 00:01:02,880 --> 00:01:04,380 on a given network. 29 29 00:01:04,380 --> 00:01:06,060 By regularly scanning a network, 30 30 00:01:06,060 --> 00:01:08,340 a cybersecurity analyst can identify devices 31 31 00:01:08,340 --> 00:01:10,050 that are not supposed to be connected, 32 32 00:01:10,050 --> 00:01:12,330 such as unauthorized wireless access points 33 33 00:01:12,330 --> 00:01:14,220 or unauthorized servers. 34 34 00:01:14,220 --> 00:01:17,040 This can help to prevent security breaches and data breaches 35 35 00:01:17,040 --> 00:01:19,140 by identifying and removing these devices 36 36 00:01:19,140 --> 00:01:21,480 before they can be used to gain unauthorized access 37 37 00:01:21,480 --> 00:01:23,070 to a given network. 38 38 00:01:23,070 --> 00:01:25,770 In addition to identifying live hosts and open ports, 39 39 00:01:25,770 --> 00:01:28,740 the Angry IP Scanner can also be used to gather information 40 40 00:01:28,740 --> 00:01:32,400 about operating systems and running services on a network. 41 41 00:01:32,400 --> 00:01:34,230 This information can be used to identify 42 42 00:01:34,230 --> 00:01:36,300 potential vulnerabilities that are specific 43 43 00:01:36,300 --> 00:01:38,520 to a particular operating system or service, 44 44 00:01:38,520 --> 00:01:41,910 such as Windows or Linux, or Apache or IIS 45 45 00:01:41,910 --> 00:01:43,620 in terms of web services. 46 46 00:01:43,620 --> 00:01:45,690 For example, if a cybersecurity analyst 47 47 00:01:45,690 --> 00:01:47,430 discovers that a network has several hosts 48 48 00:01:47,430 --> 00:01:49,590 that are running an outdated version of Windows, 49 49 00:01:49,590 --> 00:01:52,200 they can take steps to update and patch those systems 50 50 00:01:52,200 --> 00:01:54,990 to protect them against known vulnerabilities. 51 51 00:01:54,990 --> 00:01:57,210 Another feature that makes the Angry IP Scanner 52 52 00:01:57,210 --> 00:02:00,630 quite useful is its ability to perform a ping sweep. 53 53 00:02:00,630 --> 00:02:02,070 Now, a ping sweep is a technique 54 54 00:02:02,070 --> 00:02:04,980 that's used to detect active hosts on a given network. 55 55 00:02:04,980 --> 00:02:07,710 It's done by sending an ICMP echo request packet, 56 56 00:02:07,710 --> 00:02:10,680 known as a ping, to each IP address in a range 57 57 00:02:10,680 --> 00:02:12,210 and if a response is received, 58 58 00:02:12,210 --> 00:02:14,520 that host is considered to be active. 59 59 00:02:14,520 --> 00:02:15,990 This is a really quick and easy way 60 60 00:02:15,990 --> 00:02:17,970 to identify live hosts on the network 61 61 00:02:17,970 --> 00:02:19,830 and can be really useful in identifying hosts 62 62 00:02:19,830 --> 00:02:22,560 that are not responding to other types of scans. 63 63 00:02:22,560 --> 00:02:24,720 Another great use of the angry IP Scanner 64 64 00:02:24,720 --> 00:02:26,640 is during an incident response. 65 65 00:02:26,640 --> 00:02:28,230 For example, if you're working 66 66 00:02:28,230 --> 00:02:30,810 as a cybersecurity analyst or incident responder, 67 67 00:02:30,810 --> 00:02:32,550 your goal during the containment phase 68 68 00:02:32,550 --> 00:02:33,660 is to limit the damage 69 69 00:02:33,660 --> 00:02:35,880 and prevent the incident from escalating. 70 70 00:02:35,880 --> 00:02:37,800 By using the Angry IP Scanner, 71 71 00:02:37,800 --> 00:02:40,470 you can quickly identify which systems and network segments 72 72 00:02:40,470 --> 00:02:42,780 are being affected, and this will more quickly allow you 73 73 00:02:42,780 --> 00:02:44,760 to isolate them from the rest of your network, 74 74 00:02:44,760 --> 00:02:46,380 which prevents the spread of the malware 75 75 00:02:46,380 --> 00:02:49,770 or other malicious code to those other active systems. 76 76 00:02:49,770 --> 00:02:52,470 Finally, the Angry IP Scanner can also be used 77 77 00:02:52,470 --> 00:02:54,660 during the recovery phase of an incident response 78 78 00:02:54,660 --> 00:02:56,580 if you're working as a cybersecurity analyst 79 79 00:02:56,580 --> 00:02:59,220 or incident responder to restore normal operations 80 80 00:02:59,220 --> 00:03:01,230 and then remediate all those vulnerabilities 81 81 00:03:01,230 --> 00:03:02,880 that may have been discovered. 82 82 00:03:02,880 --> 00:03:05,700 With the information you get from the Angry IP Scanner, 83 83 00:03:05,700 --> 00:03:08,040 you're going to be able to determine which systems and services 84 84 00:03:08,040 --> 00:03:10,350 need to be restored and in which order 85 85 00:03:10,350 --> 00:03:11,880 in order to minimize the disruption 86 86 00:03:11,880 --> 00:03:13,680 to your business operations. 87 87 00:03:13,680 --> 00:03:15,240 So as you can see, 88 88 00:03:15,240 --> 00:03:17,970 the Angry IP Scanner is a really powerful tool 89 89 00:03:17,970 --> 00:03:20,550 that can be used to aid in our reconnaissance, enumeration 90 90 00:03:20,550 --> 00:03:22,140 and incident response efforts 91 91 00:03:22,140 --> 00:03:25,560 to quickly identify live hosts and open ports on a network, 92 92 00:03:25,560 --> 00:03:27,960 identify rogue or unauthorized devices, 93 93 00:03:27,960 --> 00:03:29,940 gather information about operating systems 94 94 00:03:29,940 --> 00:03:32,160 and running services, perform ping sweeps 95 95 00:03:32,160 --> 00:03:35,400 and aid in the incident containment and recovery phases. 96 96 00:03:35,400 --> 00:03:37,200 By using the Angry IP Scanner 97 97 00:03:37,200 --> 00:03:39,120 a cybersecurity analyst can more effectively 98 98 00:03:39,120 --> 00:03:41,400 identify and respond to security incidents, 99 99 00:03:41,400 --> 00:03:43,350 minimize the impact on business operations 100 100 00:03:43,350 --> 00:03:46,233 and restore operations back to normal once again.