Original subtitles

Now looking at our assessment notes so far so you can make this however you want to make it whatever

makes sense for you is how you should do this.

Now this is just a basic example of how I might take notes on an assessment.

Now this is just one machine.

You might be scanning against hundreds of machines sometimes and that's OK.

You just make the notes against the machines and what findings you have.

So for example here I've got this machine and it's all under this one tab and we've got some and mapped

results.

And then on the end MAP results we've got the different parts that I found open.

I did leave off the pieces but we can see our IMAP poll results here.

We can see OK on twenty two I found open SSA each on 80.

Here's some interesting items I may have had.

You know again this is just from our notes looks familiar.

And then I put it in the nick doe scan under here and on one thirty nine I've got the samba here and

this is just notes for us again could anonymously connect to the IPC with S and B clients and our admin.

Your client is never gonna see these.

So make sure you make good notes for yourself how you can understand it and importantly make sure that

if somebody goes through here they can also understand it because sometimes somebody else might need

to go through your report or through your notes or somebody might be helping you write your report.

And it's important to be clear and concise with what you're doing.

Now I've got an exploitation tab here.

We have not explained anything yet but I do have a findings tab here as well.

So we've got a couple of findings already.

We've got this wonderful default test page and it's hard to see because I've got it on my screen that's

blown up.

But you saw it once and make sure that you have the IP address of the hostname in your pictures that's

important and then information disclosure here with the four a four page and we've got the server header

information disclosure.

Now these are both taken in green shot and a couple of things to point out.

Just for details I've got borders added around these and I've highlighted where exactly the finding

is.

OK.

So it's best to point out because if these screenshots are going in a report it's best to find out and

just point out to the client exactly where it is where they need to be looking.

And again make sure you have your identifier here if you can have it.

And then here is a response from the Web site.

And again with the information disclosure.

So that's just a quick example of how your notes should start to form and how they should look and then

we'll do another one after the initial exploitation to kind of show how we exploit this machine and

how we might take some notes for the client as well.

And then you'll get to see this all over again in the sample report we cover.

Report writing towards the end of the course.

So that's it.

Just a quick lesson just to make sure you're still keeping up with your notes.

Going to harp on this throughout because it's very very important.

So I will catch you in the next videos next.

Little mini chapter on some additional scanning tools we'll get right into exploitation.