Original subtitles

Let's talk about this scan before we dive into any enumeration so this scan here we've got these open

ports.

We've got twenty two with SSA age and we've got 80 and 4 for 3 which are hosting Web sites and then

we've got one thirty nine which has got a file share with Samba on it.

And then you've got the one eleven and thirty two 768 which are our P.C. and related to the SMB.

So we need to think about point of attack as an attacker.

Now when I see this scan I light up with 80 and 4 for three and I light up with one thirty nine and

sometimes you'll see four forty five with it as well I light up from those because those are commonly

found with exploits.

If we think back about all of the exploits that have been out there for a Web site for example or if

we think to samba or SMB related exploits just recently right now it's recording in twenty nineteen

in twenty seventeen.

There was malware that went around called want to cry and that was based off of something called Eternal

Blue also known as M.S. 17 0 1 0.

It was a pretty wicked exploit that utilized a flaw in SMB.

S&P has been historically bad and Web sites have been historically bad.

Now when we see something like port twenty two point twenty two as SS age and historically it hasn't

really been that bad.

Now we can try attacks against it like brute force attacks.

We can try something like default credentials or route tor on it for example.

But when we look at it we can maybe enumerate the version but there's not usually what we call remote

code execution on SS H remote code execution being that we can run an exploit against it and get something

called a shell back and we'll talk more about that when we get into the exploitation section.

But for now just know that it's not really common to attack SSA age.

So when I see SSA open we can do some things at it but when we talk about low hanging fruit and that's

really what we're after as an attacker we're gonna see what's juiciest first and kind of go from there.

So you'll develop your own methodology over time but I'm going to drill into your head at least my methodology

why do things and there will be several videos of walkthrough machines in this course.

So you're gonna get to see this over and over and over and I'm just going to explain my methodology

repeatedly so that you can get introduced to new tools and new ideas and ways of thinking.

So from here I do want to dive into my first thought process which is I want to investigate port 80

and 4 or 4 3.

I would either here I would do eighty four for three or I'd go right after one thirty nine so we'll

do eighty four for three and start working towards those.

Now let's go ahead and just do the first step.

This is always my first step if I see a Web site I'm just to go out to the Web site.

So I'm going to go ahead and just copy this here and I'm also going to go into a little hamburger and

go to my preferences and I have not turned off my birth suite settings and it's possible that if you're

just following along you haven't turned it off either.

So go ahead and just select use system proxy settings and we'll just say OK and now we should be able

to navigate to our Web site.

All this opened up a new tab just in case there's something like this good that worked and then we'll

do the p s version because there's also four four three.

You might get something saying your connections aren't secure.

Just go ahead and say advanced and add an exception here confirm it and you'll see this OK.

So what we have here on both of these is we have a default web page now when we talk about performing

a network penetration test or even a web application penetration test.

If we see a default web page like this this is an automatic finding.

Now why is this the finding.

Is it explainable.

No not really.

But it tells us a little bit of something about the architecture that's running behind the scenes and

it tells us a little bit about the client's potential hygiene.

So if we see this well we know that it's running a patchy.

We know that potentially the box is running red hat Linux and we're just getting ideas of what's going

on behind the scenes more so if a client is running a default web page.

It brings up two questions.

One.

Are there other web directories behind this.

So we'll show you something here in a second where we do directory busting and attempt to find a directory

like say we're looking at this and we do having them click on what we say you know slash AB and maybe

that directory is there OK.

Are they hosting a Web site somewhere else.

That's just not at this IP address on this base.

Or maybe they aren't hosting any Web site and they just left for 4 3 and 80 open for no reason and put

those default web page out there.

Now when you think about that that signals to an attacker poor hygiene and I'm gonna think to myself

as an attacker if a company or a client is willing to just put this out there willy nilly.

What else are they doing what potential vulnerabilities might they have if they're doing this.

So this immediately signals poor hygiene.

We would write this up on a test and I'm going to show you guys my notes.

Once we kind of get towards the end of the enumeration so make sure you're taking good notes and we

can do that and like a little notepad here and kind of what we're doing I think this is useful and then

I'll make a nice little keep no or you you can make a cherry tree and make your own notes of this and

we'll show you what it looks like toward the end of the enumeration but we can say something like eighty

four four three.

And then you can put the IP address.

And sometimes people like to put notes like what time they did this so you could see up here it's twenty

to fifty eight or ten fifty eight p.m. nighttime and we could take that and we can just say default

web page and we can say Apache and we could tell that it's running potentially HP and we'll get behind

this as well.

And we just have these little notes so we know that we navigated to it right.

At least this is part of the enumeration here and you don't have to timestamp everything.

I'm just giving you that for an example.

But we can see that it's running this default web page so we have a default web page.

There's nothing really for us to click on.

I mean we've got the documentation.

We can go to.

It looks like the manual might be here and this here we just clicked on a link and it was a bad link.

Now this is also what's called information disclosure.

So this will be another one to bring up but we see here that we have an error page and this error page

is saying hey it's not found.

Now this is typical of what's called a four or four and when you see a for a four you think OK.

It usually redirects you to a page it's like hey we can't find this.

This is giving us a little bit more information than we should be getting.

We're seeing here that we're getting a patchy version one point three point two zero.

So now if we didn't know already we do know that we're running a patchy one point three point to zero

and we got a hostname here capturing stock level one that is a internal information hostname.

Right.

So we can get a naming convention out of a client.

We could potentially know how they are utilizing naming conventions on their internal networks.

And we've got some version enumeration or information disclosure.

So this would be a screenshot as well that would take a picture of.

And you can also notate that in your notes and say something like

you'd say information

disclosure.

And then you could say something like four or four page and then you would just have your your notes

or a screenshot of this and then that would indicate to you what you can write up on the report and

kind of where you've found it.

So we can click around on this page or we can do a little bit of what I like to do which is vulnerability

scanning.

So I'm going to introduce you to a another tool which is called Nick doe.

So let's open up a new tab with close these two tabs out.

If you've got extra tabs like I2 and this tool is called Nick Doe.

It's just like this.

So Nick DOE is what is known as a web vulnerability scanner.

This is a great tool when you're learning the beginning stuff when you're practicing against phone hub

or you're practicing on a CTF or something like a hack the box which I haven't introduced you yet but

it will help you do vulnerability scanning against a Web site.

The issue is that if the Web site is running good security you might run into some issues with that

and it might actually auto block it if it detects.

Nick doe scans not always very commonly.

That's not the case but if they've got good security or a good web application firewall it might actually

block these scans so you have to kind of be wary when you use it and really use your hunch.

If you think that this client is using a web application firewall or not and you'll really get a feel

for the client just as you gain more practice and once you're getting in there and you're starting to

notice vulnerabilities or not you're kind of understand whether or not they're running something like

that.

So from here we're just gonna say Nick DOE and you can always do a dash dash help but it's pretty straightforward.

All we're gonna do is say a dash HD for host and then we're just gonna say something like HBP s and

then we'll just paste are our address some like this and that one did not work.

So let's go ahead and try HBP and see.

There we go.

For some reason it's not picking up the SSL on this.

So I'm not sure why it's not discovering but now we can see our scans kicking back and immediately we

can see that it's doing some detections here.

It's detecting that these server Apache one point three point to zero is running.

It sees this mod SSL with open SSL.

It's giving us some vulnerabilities back.

It's telling us what is missing in terms of protections.

Now these protection headers if we're doing an external penetration test not really that important if

we're doing it without penetration test these become more important but we don't have to worry about

them right now.

So when we come through we keep looking and we see a patchy one point three point two zero appears to

be outdated.

OK man SSL appears to be outdated open SSL appears got data.

These are all findings depending on how outdated it is.

A one point three point two zero to a two point four point thirty seven is pretty outdated.

So these would be findings that we would notate on a report as well.

We can look through and you can see what types of attacks this might be vulnerable to.

So one if you're looking through there's this Apache here that says remote denial of service.

Well typically denial service is out of scope when we're doing a pen test.

So we're not interested in that possible code execution.

So maybe interested in that.

We are also potentially interested in a overflow and rewrite and this one says this is vulnerable to

a remote buffer overflow remote being important which may allow remote shell so remote.

Meaning we do not have to be local.

So I skipped over this one where you see local.

This one is remote meaning we can run that against a site sitting in our pajamas in our house.

And that site's running somewhere else and we can do this all remotely.

So immediately it's found potential vulnerabilities.

So you've got this potential mod SSL vulnerability and it's come down here and it's looking at some

other things you could see that this trace method is active in we're still haven't gotten into a web

app.

So we really don't need to talk about too much but trace is potentially vulnerable when you have something

like cross site scripting which you see up here and that could lead to something called The Cross site

tracing but you kind of need both of those.

But again that's just informational at this point.

You don't have to really be taking notes on that.

So we're coming through.

It does a little bit of directory busting for us.

So what that means is it's just going to come through here and it's going to run like a word list and

that word lists might have like ad man usage manual.

Right.

Test stop BHP.

It's got all these different items that it found doing this word this.

Now we're going to do a little bit of directory busting here in a second.

So we'll save this scan and we'll keep this in our notes and we'll refer back to it here in a little

bit.

But what we need to know is we can all tab and we can get our text editor and we could say something

about let's just copy and paste this line here that potentially this mod SSL is vulnerable.

So let's copy that

and we'll we'll put that into our text editor and we'll we'll make that as a note.

So we're still doing enumeration we're not going to we're not going to do any exploitation till we get

to the exploitation stage.

So what we would do typically is we'll save this out to a file so you might want to like copy this all

this right here to show what you ran.

And if I could copy that would be really useful.

So you copy this and you would just make maybe a directory and you can call this by key objects and

then we can see these into key objects and then you could say gee edit Nick doe that texts and then

you have your Nick does scan save.

So this is part of being good pen Tester is saving all of your scans and having them available in case

need to go back for notes.

So we'll save that.

And then what we're going to do is we're going to pause here.

We're going to call this part 1 and then we'll go into Part 2 and talk a little bit more about directory

busting and look at some other enumeration features that we have for this and then we'll start focusing

on other ports and really enumerate this box thoroughly before we work on exploitation.

So I will catch you over in part 2 of this video and I'll see you when you get over there.