All language subtitles for 1. Theory Behind Scanning

Welcome back.

Here we are ready to start our scanning phase, we have covered the information gathering, which was

first phase of penetration testing, and now we will proceed with the second stage by scanning our target

and trying to get even more information about it.

Now, the difference between information gathering and scanning is that scanning is performed on a much

deeper level.

And also, while in the first phase, we gathered all kinds of information, such as emails, phone

numbers and bunch of other things in the scanning, we're mainly focused on technology side.

So we want to find out as much as we can about our target's technical aspect.

We're going to talk about in just a second as to what exactly are we looking for in this stage and what

are all the goals of this stage.

But first, you could be wondering, what are we going to scan since remember that scanning is something

that we are not allowed to do on any target that we want?

Don't worry, for this stage and any future stage from now on, we're going to be using vulnerable virtual

machines.

There are lots of paid, vulnerable virtual machines that you can buy and test on, but for this course,

I will be showing the free ones so all of us can download them, install them, and then try to hack

the.

All of these virtual machines are going to be running some outdated, vulnerable software that we will

be able to exploit in the third stage, and they will also require very little hardware power.

So all of us will be able to run them while also running Linux.

And keep in mind that penetration testing process will look exactly like it would look in the real world

if you would test some website or some network.

The only difference is that right now we know that these machines are vulnerable, since I just told

you.

And in real world, you wouldn't essentially know that before testing them.

However, just knowing they are vulnerable doesn't really help us as we need to figure out in what way

are vulnerable and how can we take advantage of that.

Scanning will help us with this.

We will be using our Linux machine to scan these machines.

And by scanning these machines, what they really mean is we're going to directly exchange packets with

our target.

And once that target sends packets back to us, hopefully it will discover something about the target

machine that we will find useful.

And what we will be sending to the target, our DCP and UDP packet, DCPI and UDP are just protocols

that are used for sending bits of data, also known as Becket's.

And we will discuss them in a little more detail in the next video.

For now, just think of them as different communication protocols that will allow us to get information

from our target.

I keep talking about information and scanning and all of that without actually explaining what do I

mean by scanning and getting information?

What are the goals of this?

What are we looking for exactly?

Well, we're looking for open ports, and I don't mean U.S. ports or some physical ports.

I mean, we are looking for virtual open ports that every machine has, and it uses them to close their

software and communicate with other machines over the Internet.

For example, you watching this over Internet on a website means that the machine that's hosting this

website has bought 80 open wide port at well, 48 is used to host a Web server.

It is used for HDB and it's also known as HTP Port.

So every time you visit a website, you are essentially making a connection to that machine, hosting

that website, one point eighty or one port, four for three since Port 80 is used for HTP and Port

four for three is used for DP's and HTTPS is just a secure version of HTP.

These are the two most usual ports that target that you're scanning externally will have open and by

external scanning, I mean that you're scanning it while not being in the same network as the target.

An example would be you scanning some website from your home.

And a report that could sometimes be open if you're scanning internally, which means either scanning

machines on your network or your performing net for penetration testing inside of some company, you

could, for example, find Port 21 to be open.

This is an nifty port and it's used for file transferring, FPP stands for file transfer protocol.

These are just two of the ports and there are a lot of them.

You could, for example, have for 20 to open, which is SSA port or secure port.

It is used to log into the target machine and execute commands on it remotely.

We could also have, for example, Port 53 open, which is DanceSport, or we could have Port twenty

five open, which is SMTP port.

So there are a lot of ports.

Matter of fact, every machine has sixty five thousand five hundred and thirty five ports for both DCPI

and UDP.

And if there is just one open port with one vulnerable software running on that open port, then that

target is vulnerable and it could be exploited.

Now the high secure machines are the ones that have all ports closed.

These are usually your home devices, such as laptops or computers that you use just for browsing online

or playing video games or something.

They don't need to be hosting any software since they are not a server that someone will connect to

for a certain service.

They're just home devices that you use.

But websites, for example, must have Port 80 or port four for three open since they are hosting a

Web page there.

Also in companies, their machines could have some port open.

Maybe they use that port on all their machines within that company to internally transfer files between

different machines.

It could be anything, basically.

Now, the problem, of course, if that software they use on their open ports is outdated and has a

vulnerability, then our job as a hacker is to scan that machine for open ports and exploit that machine

through that vulnerable software running on the open port.

But the goal for now in the scanning section is only to scan the target for the open ports.

Then we want to discover what software are running on those open ports, and we want to go as deep as

discovering what version of software is on that open port.

Are you ready?

We are going to be covering a lot in this section and in this section we will cover one of the most

important tools that the hacker must master.

That tool is called and map.

Let's dive into scanning.