Original subtitles

1

So now that I've figured out what the IP address of my target is the next step is to figure out what

2

services are running or what ports are open on my target machine.

3

And we've seen one of our favorite tools before that we can use to do that which is unmap and I'm going

4

to be introducing you now to a couple new options and unmap the first one is the minus minus V is for

5

their boats which means give me more detailed output showed me what's going on in the background.

6

Don't leave me in the dark.

7

If you're on unmap without the verbose option you'll find yourself staring at the blank screen quite

8

often.

9

If you're like me you just want to know what's going on.

10

Every second of this can't.

11

Then you want to use the minus v option or you can use the minus Vee-Vee or minus.

12

The more ways you use the more verbose it will be.

13

So I'm going to do my A.V..

14

The second option is minus B minus.

15

And this is the same as saying minus a.p 0 6 5 5 3 5 which tells unmap that I would like it to scan

16

every single report of and then minus capital A so unmap has additional options more than or in addition

17

to port scanning.

18

It does other inspections or scans such as what operating system is being used.

19

What version of the operating system what's the patch level of the operating system.

20

The service that is detected.

21

What kind of service is it.

22

What version is it.

23

Is it vulnerable to any known attacks and so on.

24

So it does a lot more probing than just auto scanning and if we want to combine all these probings together

25

we use the minus 8 option.

26

Now keep in mind that the minus option would take a lot more time than just a regular CT scan.

27

And because now we're trying to hack this machine we want to know as much information as we possibly

28

can about it.

29

So I am going to be using the NSA option.

30

Next I will specify the IP address of my target and last but not least I want to specify the outputs.

31

I do not want to just display the output on the screen I want it to be saved to a file.

32

And as we have discussed before and map has three different types of output there is the regular and

33

mapped output which is very similar to a text file and it is just a copy of the output of the screen.

34

There is the Geonim up file output which is the grab the bull and map.

35

We talked about this in previous videos.

36

And lastly there's the X output and that is used to be fed into other tools which is something we talk

37

about in other courses.

38

For now what I want to do is I want to save the three formats of this output.

39

The map and map and the XML file and to do that I do minus OFL output and minus capital A For all which

40

means save the output and all the different file formats and I named the output file.

41

In this case I'm calling it methods too and I enter.

42

You'll notice that and that immediately starts to discover open ports but because I am going to be scanning

43

every single port plus doing the version scanning and the one ability scans and so on which I'm doing

44

using the minus option.

45

This is going to be taking a significant amount of time.

46

You can see it on the screen and map telling me there's five minutes remaining and then that jump to

47

9 and 14.

48

And now I'm stopping at 37 minutes remaining.

49

That's 37 minutes to scan one IP address.

50

That's a lot of time.

51

Imagine if you're doing that against 20 or 50 or 100 IP addresses and a penetration testing.

52

What I think a hacking project so I stopped the scan here using the keyboard shortcuts to see which

53

we talked about in previous videos as well.

54

And I'm going to introduce you to another option in a map which has the timing option and this is the

55

minus capital-T followed by a number.

56

The number can be anything from 1 to 5 one being the slowest.

57

And this is used to avoid intrusion detection systems for example but that can be very very slow and

58

minus 5 is the insane scan which is insane.

59

First the problem with insanely fast though is that it's not extremely reliable.

60

Obviously Bacos and map just blasts out packets scanning packets and waits for a very limited amount

61

of time for the response so we can only use that if we know for sure that the network that we're using

62

is extremely reliable.

63

Because I am using a virtual environment and both machines are in my computer I know that the network

64

is very reliable.

65

I'm going to go with the minus the option the scan will start running and you can immediately see a

66

warning that says and map is giving up on scanning one point because there's a transmission cap hit

67

so.

68

So this is one of the liability issues that I talked about.

69

However on the positive side you can see that the scan is considerably faster it it's going to take

70

another one minute or half a minute to finish.

71

And now the scan is done.

72

You can see that and map scans 6 5 5 3 6 sports in total.

73

And the next step now and map is doing is a service scan.

74

So it's going to be scanning every single service that it's found running on the open ports.

75

This is part of the minus Kapatid a option

76

now that the scan is complete.

77

I can scroll up and down to have a very quick look but obviously that's not a very convenient way to

78

look at it.

79

I'll do a quick s and you can see that the files were stored where I'm working in the current directory.

80

So I want to tidy things up a little bit.

81

Let me create a directory called Target and then I want to move all the maps and files into the target

82

directory.

83

And we learn how to do that using the M.V. commands.

84

And the name of the file with a wildcard if you're unfamiliar with what that means go back to the wild

85

card videos.

86

Now if I do a listing of the target activate I can see that the map upload files have been successfully

87

moved that now to view the content of the output file.

88

I have one option which we've seen which is the cat commands.

89

What that outputs the entire file on my screen which is not very convenient.

90

It's a big file with a lot of output.

91

And I want to be able to go through that by bit and to do that I'm going to be using another command

92

that we talked about which is the less commands.

93

And now I can use my keyboard to navigate slowly through this file and go through it bit by bit.

94

So this covers the scanning bit as you can see there's a lot of what's open on the target machine.

95

There's a lot of services running on the target machine.

96

And now we get to the exciting part of trying to hack these services and get our weight end and hopefully

97

get through Access AXS.