Original subtitles

1

Hello everybody and welcome to this tutorial.

2

Today I will start a chapter on footprinting.

3

So I have explained what the act of footprinting is before

4

but now we will actually go ahead and conduct a few scans to see how it all works

5

and introduce you to the tools that we will be using.

6

So first off, we need to find ourselves a target to scan.

7

Of course I could just scan myself or something of a kind

8

but that would not be a realistic thing really

9

because I already know what the results are going to be, plus on top of that

10

I'm not scanning long range over the Internet or something of a kind.

11

I would be scanning within my own local network

12

so the speeds of the scan would not be realistic

13

as it would be a lot faster then, say, when you conduct a scan over the net

14

some distant and remote server.

15

So what I did was I went online, and you can do the same

16

and I found on the official Nmap website

17

they have a section devoted to actually allowing people to scan them to test their tool out.

18

Now here I am selecting the permission.

19

There is a written permission here that you can actually scan this website

20

and they basically say you can scan it to test it out.

21

A few scans a day here is fine, but do not scan a hundred times a day

22

or use this to test your ssh brute-force password cracking tool, etc.

23

So that's definitely something you don't want to do

24

but you can run a few scans on this site per day

25

and according to them, that's perfectly fine.

26

You're not breaking any laws or anything of a kind

27

and I am just emphasizing one more time that you do have a written permission right here on the site

28

which is fantastic, because it gives us an opportunity to actually simulate real time circumstances

29

and see how Nmap behaves.

30

Now Nmap is an unescapable tool of pretty much any pen tester out there.

31

Many people say today that it's pointless to port scan

32

it doesn't do you much good, and so on and so forth.

33

Well, perhaps in terms of exploiting the services running on the port themselves

34

it doesn't do you much good

35

but just by seeing which ports are open and which ports are closed

36

you can, to a fairly good extent

37

determine what operating system or what platform is being used on the other side

38

and then you can find weaknesses of that same platform.

39

Of course, there are some other ways of doing this.

40

I will show them to you, like banner grabbing or something of a kind

41

but let's just see how Nmap really works.

42

Now Nmap is known to basically trigger quite a lot of alarms

43

quite a lot of firewall red flags, so to say

44

and you want to make sure that your Nmap scans are as quiet as possible.

45

Now there are tools to actually figured this out

46

but I will show you here how to actually do it by a terminal.

47

There's also something called zenmap.

48

Now zenmap is basically a graphical user interface of nmap, but we will not be using that.

49

Rather instead, I want to teach you how to use a terminal version

50

So nmap is the one most commonly used

51

and it is always used in the terminal text format.

52

Rarely anybody uses the actual graphical user interface.

53

In the previous chapter, we have also discussed how to stay anonymous.

54

So at the end of this chapter, I will be combining these things --

55

The act of scanning and anonymizing your scans.

56

However, you might think about that before you get to the final tutorial of this chapter

57

and perhaps try to do it yourselves.

58

It doesn't matter if you fail or something or kind, it truly doesn't.

59

What is important is that you give it a shot and you try it once.

60

Okay, failure. Fine. No problems.

61

Try it twice, thrice

62

The fourth time you're bound to have some sort of results.

63

As long as you keep improving yourselves, it's fine.

64

In any case, without further ado, let's just type in "nmap - -help"

65

Whoops, I mistyped that of course

66

"nmap - -help", press ENTER, and there we go.

67

There are a lot of options here.

68

I mean, a ton load of options.

69

Way more options than we actually need for some sort of basic things.

70

However, eventually over time

71

you will come to understand that all of these options are not here for nothing.

72

They are here because they were needed at some point of time

73

and they are pretty much all still used.

74

So what you need to do is scroll down to the bottom

75

and here you have examples of how nmap runs

76

So you type in "nmap -v" almost always

77

99% of times

78

99% of time is verbose output.

79

Basically you're telling your system to give you more information in regards to what it is doing.

80

"-A" -- I am not sure what this function is...

81

Oh here is -- "-A: Enable OS detection, version detection, script scanning, and traceroute"

82

I don't think we're going to need that immediately.

83

There is -o function, which is just for OS detection.

84

Anyway. and then you can pass either this one -- scanme.nmap.org

85

which is basically the domain name, which will get resolved to an IP address

86

or you can actually pass it an IP address

87

and if you're wondering what this is, this is a mask

88

and it would be very difficult to explain in great detail what this is

89

but for the time being, know that this is actually an IP address range.

90

So it goes from a certain IP address to a certain IP address

91

because this goes way into networking and binary numbers, and so on and so forth

92

but you do not actually need to use this format.

93

Not that many people actually use this particular format with the mask.

94

They just tend to specify very specific ranges

95

because they usually don't have the permissions to scan the entire subnet.

96

Rather instead, they have to create lists

97

and then skip certain IP addresses, and then continue again from a certain point.

98

So they do need to create lists, and that can be a problem.

99

Now up here, at the top, you have another very important option that will come in handy.

100

You have "-iL

101

So you can actually create a list in a file, a list of IP addresses

102

and then you can scan those particular IP addresses.

103

You also have an ability to do this

104

Look at what's written here

105

So just take a look at this segment --It's 10.0

106

and then this segment here, this octet -- It's 0.255

107

and then the last octet is 1 - 254

108

If you're wondering why I'm calling these things octets

109

it's because they have eight bits.

110

Each one of these has 8 bits and it is represented in a binary form.

111

So it can have eight zeros or, I don't know, eight ones or a combination of ones and zeros

112

but it has eight bits...so eight positions.

113

That's why they're called octets.

114

This is a very common form that people tend to use

115

and this is what you will find yourselves using.

116

Either this -- This will be a method in which will specify the IP addresses

117

or you will be passing files.

118

So these files, usually people either make them themselves

119

or they can find these IP addresses on the internet.

120

So in addition to this site -- nmap.org

121

you also have this one here...

122

This is a fantastic website.

123

The entire range of pretty much all the IP addresses are listed here

124

and it also says who owns what

125

it doesn't say for every one of them who owns which one

126

but for example, you can search and find

127

and it's gonna give you the appropriate IP addresses for that particular country

128

and it's gonna give you the owner of those IP addresses.

129

Usually just telecoms, but you also have other people who own them as well.

130

So let's just give it a shot

131

Let's just type in Germany or, I don't know, France...

132

Okay, this is not the proper search, but not a problem.

133

You can actually can find it down here

134

or I could CTRL F France

135

and there we go.

136

So you have a range -- This is a given range here

137

It's from 2.0.0.0 to 2.15.255.255

138

This is a massive range. This is a humongous range.

139

This is how many IP addresses you can have in total.

140

How many of them you can generate within this range.

141

It's quite a lot

142

It's French telecom

143

For some reason they need it, so you can sort them out by the owner

144

and you can see that a lot of them are actually not listed here.

145

France has a lot of IP addresses assigned to it.

146

They're not free, they cost money.

147

Let's just go ahead and see down below...

Where is it? Where is it?

148

Okay, so you see all of these IP addresses

149

and this is a pretty massive range...

150

So this is a telecom in France.

151

Look at how many IP addresses ranges they have.

152

That's quite a lot

153

and this site, as I said previously, you can use to figure out which IP address range do you wish scan

154

but you usually do not have the permission to scan the entire range.

155

You can scan certain IP addresses within that range for which you have a permission

156

but also very nice site to determine where the IP address is from or something like that.

157

However, always remember --

158

Once you get an IP address, your search engines on the net are your best friends.

159

This is one of the major components of footprinting.

160

You can do the following --

161

You can type in "who is" and then type an IP address.

162

I'm just gonna type in this random IP address.

163

So if you don't want to see it here, you can have a look at it here.

164

Somebody is going to tell me who this guy is

165

There we go

166

So I've typed in "who is" and I've picked the first website out that I could find

167

and here I have all the information in regards to that particular IP address.

168

I have a country, I have the username of the admin I suppose

169

I have its status, remarks, source

170

There's actually an address, a physical address of the IP, which is ridiculous.

171

So as I said, search engines are your best, absolutely best, friends.

172

If you want to find pretty much anything on the net or something like that

173

in regards to an IP address, to do any sort of research.

174

Those are the two tools that I have showed you, actually three of them

175

well, one tool, one website, and one search method

176

which you can use in order to determine where the IP address is from or who is using it

177

and even to determine its physical location, although its physical location can be assigned to a telecom

178

and that telecom can assign it to a city, to a specific region in the city, or something of a kind

179

and then you can find it on Google Earth or something of a kind

180

but usually those things are not that precise.

181

What is precise, however, is that the IP address belongs to telecom or something or kind

182

and they keep rotating them in between the cities

183

So if you have like a hundred thousand IP addresses that you scan, and you wish to sort them out by the city

184

you will like 70% to 90% accuracy, depending for which country did you do it.

185

This can be problematic because you're gonna miss out on some things

186

but you don't need 100% accuracy.

187

You can get your sorting done pretty well.

188

There are databases which you can update.

189

I will show you these things.

190

They are called goip lookups

191

but before we do that, you also have something called "nslookup"

192

and I'm just going to use this generic name here -- scanme,nmap.org

193

paste it, and here we go

194

I have basically said I want to look up files on scanme.nmap.org

195

and okay, this is my DNS server, which is basically my router.

196

You see it says port 53

197

You know immediately that it's DNS because all the units traffic runs on port 53

198

and then we have the results.

199

So this is the domain name, and you get the IP address down below.

200

So this is also one of the ways in which you can get the IP address of a site within a domain

201

because once you know the domain

202

you don't actually know the IP address until you look it up or something like that

203

but there is a far simpler method.

204

You don't need to use nslookup.

205

Oh, by the way, nslookup also works in reverse.

206

Just type in "nslookup", and you can type in the IP address.

207

So let's just go ahead and press Enter

208

Okay, so this has run through a process of some sort down below.

209

These are authoritative answers from the name server.

210

Basically what that means they're DNS servers

211

and they're giving you responses and telling you who the domain belongs to

212

and so on and so forth

213

Ignore this part, and for the time being we can also ignore this part

214

until we get into spoofing the DNS and changing it

215

and so on and so forth.

216

What I want to show you here is that you can actually get a domain name by typing in nslookup

217

and then the IP address

218

and here, where it says "Non-authoritative answer"

219

you get the IP address and then you get the name, which the domain name.

220

However, you might notice that there was a problem here --

221

That this IP address does not match this one.

222

Well guess what? It actually does.

223

Try looking it in reverse.

224

So it's 74, 74 here

225

207, 207 here, 244, 244 here, 221 here, and 221 here.

226

So when you do an nslookup and when you pass in an IP address

227

it's gonna do a reverse lookup in the DNS MX records or something of a kid.

228

It's gonna query the DNS servers and the DNS servers are going to give it a response

229

but in the MX records, this is basically how things are written.

230

You write an IP address in reverse and then you put this in "in-addr.arpa"

231

but this part really is not that interesting to us.

232

This is more interesting to server admins who configure the DNS servers or something of a kind.

233

In any case, for the time being

234

but don't worry, we will get to DNS servers in the later stages of this tutorial

235

once we are done with these things.

236

In any case, what is important for you here is you've typed in an IP address

237

you've use tool called nslookup and you have gotten a domain name in return

238

and now you can start doing some other things as well

239

but we will be dealing primarily with nmap.

240

Nmap as a tool in order to scan networks and retrieve information from them

241

but this what I've showed you now is some basic information retrieval

242

and some basic external sources that you can use.

243

In any case, I'll see you in part two of nmap introduction

244

and there, we're going to actually conduct some scans and see how it all works.

245

Thank you for watching and I hope to see you next time.