Hello, guys, welcome, welcome to this video, and it is where we are going to be going over and map
and and map, it's free.
So it's really good because it's free and it's an open source network scanner and map is used to discover
host and services and a computer network by sending packets and analyzing the response that we get back
from servers or computers.
An inmate provides a number of features to get information from a computer network, including host
discovery and servers and operating system detection as well.
So that's what we're going to be using and the IP or the IP that we're going to be scanning to see if
we can find something vulnerable that we can get into, it is going to be one way to isolate that one,
that 50 all the way to that 55.
So we have six servers are going to be taking a look at us if we find a hanging and low hanging fruit
that we can potentially.
You know, exploit and get access to it.
So with that in mind, let's go ahead and open a new section and I'm going to let me zoom in.
Let's go ahead and do you zoom in a couple of times so and map comps install by default on Collinet,
Linux or OS.
So you don't we don't need to install it if you have that.
But if you have a one two you will have to install it.
So let's go to a basic and map scan the first one that I'm going to be doing and just call in and map
and talent and map that I want to scan these six IP addresses.
And what this is going to do is it's going to go out there and it's going to send packets and it's going
to analyze the response that we get back from those servers.
Right.
So as you can see in here, we have only three servers showing up.
Right.
Hmmm, only through service.
So what about, uh, are we able to paying one or two states that want that 50?
Yeah, so it's up fifty one if one seems like it's not working.
Let's go out and see what as what's the other one.
Fifty one fifty.
Two is up to three is up.
OK, so what we could do now is that we can go ahead and do a plan.
And with this option, the PEN option skips the hostess discovery stage altogether because a lot of
time this gets blocked by firewalls or, you know, buy, buy, buy something that's in between or something
that the computer has turned on like like a firewall, you know.
So we are going to run the pin and see if we can get more information, at least from the other servers.
So we have.
OK, so you can see now we have.
We got it from the fifty fifty one fifty two or so, give us information for the with the four and fifty
five.
So we got it from all of it.
So we are going to be doing is we are going I'm going to put all this information in Cherry Tree, so
let's see if I can open Cherry Tree.
So.
Territory, it's actually a you can put all your notes in it, and that's where I'm going to be doing
so I'm going to be copying all my notes on territory.
So the first one is that I want to.
Let's say I'm going to add one which just wanted to say H that one, that 50.
That's going to be one of the other ones going to 51, so all the information that I gather I'm going
to put in here so I can keep track of what I have.
And, you know, it's a lot better to save all your other information that you gather.
And it's going to be a lot easier because you don't want to you know, if you found something today
and then you forgot later, you can always go back to your notes.
So then I'm going to add as I.
Some notes in here and in that they're going to just put em up so we can at the ANNE-METTE scans that
we did.
You can also use Excel sheet if you want to, but I always use and territory, so that's why I'm using
it.
So I'm going to put in here all the information that we got from the map.
I scan for the storm over here so we can see what it looks like.
We have a lot of stuff in here, like the it looks like this one is the one that is running.
You see Kerberos security, MSNBC, the HDP, see Nable.
So this one looks like it is a domain controller.
This one looks like it's only running down in here.
So let's go in and copy that.
So that's not going to be a hanging fruit.
Fifty two, fifty two, looks like it is another domain controller.
So we can put that in here.
Fifty three does not look like it is.
A domain controller, but it's one in Iran, it's one SBL Dobias Dappy fact on on that 53.
We can take a look at that.
See what we can find.
54.
Microsoft, the stock.
I'm just copy and paste everything that I got with the five.
Running.
OK, so let's go ahead and copy this on territory, and I can show you my notes.
You can see over here that our pace, that everything.
That I got in here, you know, just taking notes, it's really good to take notes.
So now.
What I want to do next is that I want to do a.
Some other scandals.
Like, I want to do a scan to or I can show you a scan that, well, you could do is let me see where
we are less or less going into my documents.
See the documents?
They're going to make a directory and call ad.
I want to see the ad.
They're going to clear.
So here, what I want to do is I want to run this scan again.
But what I'm going to do is I'm going to save it because you can also save it into and the way that
you do that is by doing away.
And we are going to save basic basic scan.
There you go.
So what's going to happen is it is going to run the scan and then it's going to save it in these basic
scan file after it is done.
And it's also.
You know, going to the place so you can either just save it as a, you know, say whatever you want
or you can also just put it on territory.
But I like to do both just in case, you know, charity does not work for you.
So now you can do a cat to Bassie basic skin and you can just do the smell one and you can see everything
that I did.
And this one is an X amount.
So ximo you want to open that where
you can open that with X.
So let's go ahead and take a look at the map one.
You can see the map, one, it looks a lot better, it looks just just the same or what it gave us at
the end.
OK, let's go ahead and clear this out.
So we found a lot of good information.
So what I want to do next or if you want to, because this one, right, this command only scans the
top one thousand ports if we want to do a scan.
Which goes higher than one thousand, or if you want to scan all the ports where you want to do it,
you want to A-T or you want to order like that, if you at that command is going to scan all the ports.
And that takes a lot because there is sixty five thousand and five hundred thirty five ports.
It is a lot of ports and that's going to take a while to do that.
OK, so we're not going to do that, just letting you know how to do that.
And another one that I really want to do is the O and the O.
It is going to basically enables the detection because I want to know what version of those servers
like, what other versions of those servers.
So I want to do this.
Oh, and then I want to do the oh so we can save it and we are going to say OS detection.
So we need to run this as route, so do you want to do Souto
and you enter your password?
Debbie.
Run it now.
So let's go out and give us some time.
So, like I said, what are we doing right now?
We are scanning those six servers and we are doing a pin, which means that it is going to skip the
whole discovery stage.
But then we want to actually do the the host discovery anyways later to see if we can find what person
we are running on.
So you can see we found some better.
Information, good information doesn't look the same as so 55, I want to see.
If it was the same.
So 55, yeah, we found four for five, which is a low hanging fruit.
She go for that first four, four, five, four, four, five, open somewhere else.
That is open for fifty three to.
Three.
Four, four, five, so we've got to take a look at that, because that's our low hanging fruit.
So as you can see in here, we did the OS.
So this one looks like it is like 2016.
You know, it's not on our server.
A lot of people are still running this.
So let's go ahead and copy this and put it for four to five.
We're going to save it in my.
Territory, this one is 54, but the force seems like this one and also.
You know, dozens, 16.
Because they all run in 2016.
Look at this one.
Fifty three fifty three is running.
Looks like he's running Windows seven or Windows eight.
Looks like it's going to start with twenty eighteen espie one, hmm?
Here's a low hanging fruit over here.
Let's go ahead and copy that.
And put a four fifty three, save that, then we have 2016 over here again.
Copy that and I'm going to say that information and then we have to do one.
It is running every bit as these just guessing.
Hmm, let's go ahead and.
Copy that and put it in the fifty one map scans and then the last one is that 50 and it's just guessing
98 percent.
It thinks it's one and I take that.
OK, so what we're going to be doing is we're going to go for the low hanging fruit.
Basically low hanging fruit is we are going to go for SMB.
So we are going to do more SMB scans just to target SMB.
So basically whoever has SMB open, so ports for four or five import one three nine, we are going to
be attacking those.
So we are going to be attacking one two, one state, that one, the 55 one only to that one, six eight,
54 was we also going to be taking a look at that and was it looks like they all have four, four or
five open.
OK, but the one that I want to concentrate on is going to be the Windows Server.
It looks like I win the server 2008 because that is a there's a lot of attacks that we can do when it
is when the server batter all that over two thousand eight.
And if it has four, four or five, it is we can do some internal blue, we can do a lot of damage with
that.
So we are going to be concentrated on this one.
And if we don't find anything on this one, then we are going to go to another server.
So thank you guys for watching and I will see you on the next video.