All language subtitles for 001 Theory Behind Scanning_en

Instructor: Welcome back.

Here we are ready to start our scanning phase.

We have covered the information gathering

which was first phase

of penetration testing and now we'll proceed

with the second stage by scanning our target

in trying to get even more information about it.

Now, the difference between information gathering

and scanning is that scanning is performed

on a much deeper level.

And also while in the first phase we gathered all kinds

of information such as emails, phone numbers,

and bunch of other things.

In the scanning, we are mainly focused on technology side,

so we want to find out as much as we can

about our target's Technical aspect.

We're going to talk about in just a second

as to what exactly are we looking

for in this stage and what are all the goals of this stage.

But first you could be wondering what are we going to scan.

Since remember that scanning is something

that we are not allowed to do

on any target that we want.

Don't worry, for this stage

and any future stage from now on

we're going to be using vulnerable virtual machines.

There are lots of paid vulnerable virtual machines

that you can buy and test on,

but for this course I will be showing the free ones so all

of us can download them, install them

and then try to hack them.

All of these virtual machines are going to

be running some outdated vulnerable software

that we will be able to exploit in the third stage

and they will also require very little hardware power.

So all of us will be able to run them

while also running Cal Linux.

And keep in mind

that penetration testing process will look exactly

like it will look in real world

if you were to test some website or some network.

The only difference is that right now.

we know that these machines are vulnerable

since I just told you and in real world

you wouldn't essentially know that before testing them.

However, just knowing they're vulnerable doesn't really

help us as we need to figure out in what way are

they vulnerable and how can we take advantage of that.

Scanning will help us with this.

We'll be using our Cal Linux machine to scan these machines

and by scanning these machines, what they really

mean is we're going to directly exchange packets

with our target and once that target sends packets back

to us, hopefully it'll discover something about the target

machine that we will find useful.

And what we will be sending

to the target are TCP and UDP packets.

TCP and UDP are just protocols that are used

for sending bits of data, also known as packets

and we will discuss them in a little more detail

in the next video.

For now, just think of them as different protocols

that will allow us to get information from our target.

I keep talking about information and scanning and all

of that without actually explaining what do I mean

by scanning and getting information?

What are the goals of this?

What are we looking for exactly?

Well, we are looking for open ports

and I don't mean USB ports or some physical ports.

I mean we're looking

for virtual open ports that every machine has

and it uses them to host their software

and communicate with other machines over internet.

For example, you watching this

over internet on a website means that the machine

that's hosting this website has port 80 open.

Why port 80?

Well port 80 is used to host a web server

it is used for HTP and it's also known as HTP port.

So every time you visit a website

you are essentially making a connection

to that machine hosting that website on port 80

or on port 443.

Since port 80 is used for htp and Port 443

is used for HTPs and HTPs is just a secure version of http.

These are the two most usual ports that target

that you're scanning externally will have open.

And by externally scanning, I mean that you are scanning it

while not being in the same network as the target.

An example would be you scanning some website

from your home and a port that could sometimes

be open if you're scanning internally

which means either scanning machines on your network

or you're performing network penetration testing

inside of some company.

You could, for example, find port 21 to be open.

This is an FTP port and it's used for file transferring.

FTP stands for file transfer protocol.

These is just two of the ports and there are a lot of them.

You could, for example, have port 22 open

which is SSH port or secure shell port.

It is used to log

into the target machine and execute commands on it remotely.

We could also have, for example, port 53 open

which is DNS port

or we could have port 25 open, which is SMTP port.

So there are are a lot of ports.

Matter of fact, every machine has 65,535 ports

for both DCP and udp, and if there is just one open port

with one vulnerable software running on that open port

then that target is vulnerable and it could be exploited.

Now the highest secured machines are the ones

that have all ports closed.

These are usually your home devices such

as laptops or computers that you use just

for browsing online or playing video games or something.

They don't need to be hosting any software

since they're not a server that someone will connect

to for a certain service.

They're just home devices that you use.

But websites, for example, must have port 80

or port 443 open since they're hosting a webpage there.

Also in companies, their machines could have some port open.

Maybe they use that port on all their machines

within that company to internally transfer files

between different machines.

It could be anything basically.

Now the problem occurs if that software they use

on their open ports is outdated and has a vulnerability

then our job as a hacker is to scan that machine

for open ports and exploit that machine

through that vulnerable software running on that open port.

But the goal for now

in the scanning section is only to scan the target

for the open ports.

Then we want to discover what software are they running

on those open ports.

And we want to go as deep as discovering what version

of software is on that open port.

Are you ready?

We're going to be covering a lot in this section.

And in this section we will cover one

of the most important tools that a hacker must master.

That tool is called and enmap.

Let's dive into scanning.