the
ok
0
the next thing we're going to talk about is probably the most useful tool for
scanning
hacker can have and that's in map we're going to go ahead and talk about
in map and i'll show you how to use a tool in this difference which is
in the next segment will go ahead and do a demonstration about the command line
version
in map an the Glee version
now and map is probably the most common most popular network scanner out there
and it's been up there for a number of years basically
if you're hacker or security person was the first things you'll cut your teeth
on is Anne map and learn how to use it now
obviously you want to use command-line utilities for the exam
but I will tell you that over time the front and Vernon map
called Zen map is probably come just as effective so there's no shame in using
the Google whenever you like
now in maps capable of conducting a wide variety of scans
using all the different protocols and talked about TCP
ICMP in UT p and different variations
in fact you have custom oswald targets
n Rangers and customizable scans
you can vary the levels of speed and intensity in order to not be detected
by an IDS you can also alter the type of scan in terms of what packets are set
you might want to do that because you might be targeting a specific
OS or specific type of device and you only need to
send packets specific to that device to get certain things back
now as I mention
in that comes in both the command line and Glee versions and they do is called
Zen map
and you can get that for either Windows or Linux versions
either command or girly now one thing about Inmet
is I mention that there are several dozen other tools out there probably
that you could use for network scanning
one cool thing is that if you know in map you basically know all these other
tools because at most to them will use
in map as they're back in scanning engine to scan the network
now they may give you a different girl you're different financial in a little
bit
more prettier fashion a lot on the news and map
if you can use and met you can use anything else it may take a little bit
to learn how the tool was laid out
and a cute little features that may have but in map is really the way you want to
learn first
in matt has a multitude a switch is an options
in fact I'm going to go in to backtrack right now and show you
what some of those options and switches are okay we're in backtrack 5 released
three
and what I want to do just really quickly shell you
a little bit about in map in what the switches are now we're going to win our
next session actually run in math from command line also show you the
Zen map to go in front and foreign map as well
now to get in map to execute obviously have had the package
download on your box and you can do this for Windows or Linux
if you using backtracked in map is automatically
install on the box in fact in a lot of different Linux distributions
in map is already installed you don't have to do anything so
all we have to really just happen in May up
and will hit inner and we get a lot of information the squirrel up a little bit
and see what we got
now Inmet basically gives you several options it starts with the target
specification
you can give in map hostnames IP addresses an entire network
Rangers if you like in fact a gaysian example here
I love how you can put these different targets
terms and names and IP address ranges into an map
you can also take an input file name:
a list of hosts and networks if you like it's just
at simple text file one IP address per line or one network per line
and that's all you need and you can you see I
elsewhere church daschle on a capital L in the in Makkah man
to tell it to to pull from that list so if you already have a list of targets
you can call the Indian
you can also add to the range tell it to choose when and targets
because a lot of intrusion detection systems will pick up when you
scan sequential IP addresses so if you use random ones within that IP address
range
that might help the help you getting more stealthy skin
as far as host discovery goes again several options here
kind of paying scan where you know scan ports obviously
you can do TCP SYN ACK skins you DP
and so forth so you can really customize the way you scan the box itself
divorce can techniques TCP sinful connects cans
simplex cans and so forth you can also do you DP skins
everything is in the switches and you really should know the switches for the
exam
the common ones the dash St the dash issue
and so forth
some these are particularly interesting touch switches in
options because they can help you ago still
the in a scan so it would be a good idea to learn how some of these techniques
work and some other news multiple switches and options to get a particular
technique to work
can also specify a port ranges if you're standing near the pier TCP
you can get versions
the particular operating system an application you can do
OS detection thats OS fingerprinting
where you grab an urge to see what kind of operating system is out there
you can also guess the operating system based upon replies back you get from
host
there's far wall and ideas in Beijing techniques are out there
again it's a very simple program to use
but it has a lot of complex variations and switches
that to even problem most experts don't use every day so
it's helpful to study some the stuff especially prior to the exam
see configure how this works and definitely practice with Inmet
use different scanning techniques you some other stealthy scanning techniques
in particular can also specify the output
that you get what format you get in if you want to input into something else
and there's other miscellaneous touches which is also
the help gives you different examples
the you can use to construct a good in math query so in our next session
well actually won and maps can from the command line