-: In this video, we're going to take a look at 2 2
some ports and protocols on a remote system. 3 3
What we're going to do is we're going to scan a remote computer, 4 4
in this case, a server, and see what things are open, 5 5
which ports are listening on what services. 6 6
So, for example, if I scan it and find that 7 7
port 21 is open, that means there's an FTP server 8 8
sitting there, listening, and waiting for a connection. 9 9
To do this, I'm going to use a tool known as Nmap, 10 10
which stands for the network mapper. 11 11
Nmap is a very popular command line tool that's used to 12 12
be able to map the network. 13 13
You can do ping sweeps and look at what is up and available. 14 14
You can look at each individual port. 15 15
You can even figure out what operating system 16 16
that remote server is running. 17 17
Now, for our case, we're really focused on 18 18
those open ports for this example, 19 19
and so, I'm going to show you how 20 20
we can do a scan of the network on a particular host 21 21
using its IP and return every single port that's open 22 22
on that machine. 23 23
Nmap is used by network technicians or 24 24
network administrators during troubleshooting, 25 25
as well as by security professionals to 26 26
figure out what is open on a remote system. 27 27
So, as you move into Security+, CySA+, and PenTest+, 28 28
you're going to come back and use Nmap once more. 29 29
Let's jump into the environment and take a look. 30 30
Alright, so here I am at the command prompt 31 31
within my Kali Linux machine. 32 32
This is a machine that's on my local area network, 33 33
and I'm going to go and scan a web server 34 34
that happens to be sitting on my local area network. 35 35
To do that, I'm going to use the command line: 36 36
nmap, the -sS, which tells it to do a 37 37
SYN scan using just those SYN packets from the 38 38
SYN-ACK-SYN-ACK relationship from a 3-way handshake. 39 39
I'm going to use -O, which is going to tell me that 40 40
I want to be able to figure out 41 41
what operating system it's using, 42 42
and then, the IP that I'm going after. In my case, 43 43
10.0.2.6. 44 44
And then, I'm going to put this: pipe more, 45 45
which is just going to give me one screen at a time, 46 46
because sometimes Nmap can give you 47 47
multiple screens worth of text. 48 48
When I hit enter, it's going to go out and 49 49
start scanning that machine. 50 50
And you'll see, it came back in just a couple of seconds, 51 51
and it shows me that out of the 52 52
thousand ports that it looked for, 53 53
977 of those were closed. 54 54
But there are 23 open ports on this machine. 55 55
That means, an attacker has 23 opportunities to 56 56
break into this machine, because 57 57
each of these is running a different service. 58 58
Now, ideally, we would want to minimize that 59 59
just down to the things that we need open. 60 60
For example, if this is a web server, 61 61
we would expect port 80 to be open, and 62 62
in this case, it is. 63 63
If this was an FTP server, we would 64 64
expect port 21 to be open, and 65 65
again, here it is. 66 66
We also see some other common ones, 67 67
like SSH, for remote control. 68 68
This is port 22. 69 69
We can see telnet, which is port 23. 70 70
Now, I'm getting a little ahead of ourselves, 71 71
but when you get into Security+, 72 72
you're going to learn about telnet being very insecure. 73 73
And so, you never want telnet to 74 74
actually be open and listening. 75 75
You want to disable that service. 76 76
In this case, this is one of my servers 77 77
that I use for my pentesting courses, 78 78
so, I have a lot of open things here 79 79
that people can scan and attack. 80 80
Next, you can see SMTP, which is 81 81
our simple mail transfer protocol, port 25. 82 82
That allows the server to send mail. 83 83
I also have DNS open, because it's 84 84
running a DNS server. 85 85
You can see that here, port 53: domain. 86 86
And that's domain name service. 87 87
We have a lot of other ones here as we go down, 88 88
but you get the idea. 89 89
You can see here that there are 23 different ports 90 90
that are all open and waiting for a connection. 91 91
We can see that open state here in the middle column, 92 92
and we can also see that these are TCP or UDP, 93 93
and in my case, all of these are TCP. 94 94
And on the right, we see the service name. 95 95
Now, again, I did use that -O, 96 96
which is going to tell me what type of 97 97
operating system this is running. 98 98
In this case, the operating system is 99 99
running Linux 2.6.X, and that's not 100 100
the operating system being run by my 101 101
Kali Linux machine that you're seeing. 102 102
That's the operating system being run 103 103
by the server I just scanned. 104 104
And then, I can go ahead and we'll see 105 105
that we had finished that scan, 106 106
we've scanned only one host, one host was up, 107 107
and it took us 1.7 seconds. 108 108
Now, Zenmap is great and it's really powerful, 109 109
and it's fairly easy to use, once you 110 110
get used to the way the command line works. 111 111
But, if you want to do something even easier, 112 112
you can use a program known as Zenmap, which is a 113 113
graphical user interface for Nmap. 114 114
Now, once we're in Zenmap, it's really easy to use. 115 115
You're just going to put in your target, 116 116
which, again, was that server: 10.0.2.6, and then 117 117
you're going to select the profile that you want to scan with, 118 118
and it will create the command line for 119 119
Nmap that you would've used. 120 120
So, here, for example, is what an intense scan looks like. 121 121
If I wanted to go through here, 122 122
and maybe I just want to do a quick scan, 123 123
it'll go ahead and change that for me. 124 124
And then, hit scan, and off it goes, 125 125
and it's going to scan that server. 126 126
In this case, it came back in 127 127
just about a fifth of a second. 128 128
And you can see, again, all of those 129 129
ports and all of those protocols that are being used. 130 130
It also puts it in a nice, graphical format 131 131
where I can click on the ports and see them here 132 132
in the port tab, or I can look the typology and 133 133
see how it looks on the network. 134 134
And, in this case, I only had one host, 135 135
so, it's not very interesting, but 136 136
if I looked at an entire network scope, 137 137
I could see all the different hosts there, 138 138
and then click into them for their details. 139 139
And if I click on host details, I'll be able to 140 140
figure out what information I know about that host. 141 141
Because I did a quick scan, I don't get 142 142
the operating system and other details that 143 143
I would've if I'd done an in-depth scan. 144 144
And so, let's go back here, and we'll 145 145
just change it and do a deeper scan. 146 146
And here, you'll see we'll do an intense scan. 147 147
I'll give it just about a minute here. 148 148
I'm going to fast forward so I can show you the results. 149 149
And now, if I go over here to my ports and hosts, 150 150
you'll see even more details. 151 151
Not only do I have the ports, the protocols, 152 152
the state, whether it's open or closed, and 153 153
the service, but now I know the version 154 154
of the application that's even running there. 155 155
So, before, we were able to find out that FTP was running 156 156
on port 21, but now, I can find out that they're 157 157
actually running the application called vsftp at 158 158
version 2.3.4. 159 159
Now, as a network technician, this probably isn't 160 160
very helpful to me, but as you go into security 161 161
later on, this is really important information 162 162
because it helps you to identify what version is 163 163
running on your different servers, and that version 164 164
can then be tied to different vulnerabilities 165 165
or attack methods. 166 166
So, again, as you get into Security+, and CySA+, and PenTest+, 167 167
these type of details are going to become really 168 168
important to you. 169 169
Next, if I go over here and go to host details, 170 170
we should see the operating system. 171 171
And in this case, we do. 172 172
It's Linux, version 2.6.9 through 2.6.33. 173 173
Somewhere in that range is what this server is running. 174 174
And so, that's the idea here as you're using Zenmap. 175 175
Zenmap just puts it into a nice, graphical 176 176
format for you to see it. 177 177
You can do all the same things using Nmap. 178 178
I hope you've enjoyed this introduction to Nmap and Zenmap. 179 179
They are both very powerful tools that you use 180 180
both in your technician days and administrator days, 181 181
as well as in your security days as you 182 182
progress through your career. 183 183
Now, what I would recommend is downloading Zenmap. 184 184
Go to Google, and type in Zenmap, and you'll 185 185
find it and be able to download it quickly. 186 186
It runs on all platforms, including Windows, Linux, and Mac, 187 187
and you can run it on your network, you can 188 188
run it against your friends, you can even 189 189
run it against scanme.org, which is a server set up 190 190
by Nmap for you specifically to scan and learn 191 191
how to use these tools. 192 192
Play around with them and get comfortable with it. 193 193
It's not something you need to know specifically 194 194
in depth for the Network+ exam, but it is 195 195
a great tool to have in your toolbox 196 196
as you go forth and start working in the real world 197 197
because you're going to see it come up time and time again, 198 198
and it gives you lots of great information that you can use.