- So, we discussed our act of reconnaissance methodology.
We're gonna do the port scanning, web service review,
and vulnerability scanning,
but let's look at some tools that can actually
help us accomplish each of these tasks.
For port scanning, we have to start with NMAP
because it is the most versatile and stable port scanner,
and it is also the most popular port scanner around.
This tool has been around for a very long time,
and it is in everybody's tool book.
So, it is a lot of documentation.
There's an entire NMAP book dedicated to using this tool,
and it does everything from port scanning
to service detection, operating system detection,
and even starts going into vulnerability scanning.
We're gonna get into more details as I'll show a demo
later on how NMAP actually works.
Masscan.
We have to cover Masscan because
if you're scanning a lot of IP addresses and a lot
of services, this is the fastest scanner in the world.
So, you can scan the entire internet
for a single port in just minutes,
and it operates similar to NMAP.
It has a similar look and feel to how NMAP works,
but it is a lot faster.
It doesn't have all the service detection that NMAP has
and it's not as versatile as NMAP,
but if you're just looking for speed,
then this is your tool to use.
The Udpprotoscanner.
I really like this tool because it is
a fast UDP port scanner.
Usually when we do our post scanning,
we tend to focus on TCP ports,
but if you're just looking for something
that quickly can scan a network for UDP services,
this is really a great tool to use and it's very easy.
We'll show it in the demo.
Okay, let's see NMAP in action.
So, to run NMAP, if you just type in the NMAP command,
it outputs all the different options that you can use
when you run the scanner.
You can see we're running NMAP version 7.25 Beta.
And basically you type "nmap", you put the different types
of switches that you want, the different options,
and then at the end, you put the target specifications,
so, whatever IP addresses that you are targeting.
So, let's try scanning a particular host.
We're doing the "-sS" command, which is a TCP send scan,
which is also referred to as a half open connection.
So, you send the initial send scan.
You're gonna receive a response
from the server if the port is open,
and you are not gonna respond
to the response from the server.
It's a really fast scan.
You don't do the full TCP connection,
and it is probably one of the most popular scans
because of its speed.
We're doing the "-vv", which means
it's gonna output verbose information,
so you'll know exactly what's happening during the scan.
And we're doing "-T4", which is increasing the speed
of our scan even further.
The "-A" basically is going to enable
operating system detection and version detection
and some minor script scanning.
And we are scanning 192.168.3.1.
You can see the scan is really fast.
So, as we can see from scanning the 192.168.3.1,
right in the middle of the screen,
it shows three open ports.
It says, "Discovered open port 443,
"Discovered open port 53", discovered port 80.
So, 443 is HTTPS,
80 is HTP,
and port 53 is DNS,
which are all open on this one system.
And also, it says at the bottom
that it's probably running some type
of Linux operating system,
which this system actually is.
So, it does a pretty good job
at operating system detection as well.
So, let's look back at some
of these options again for NMAP.
The "-Pn" switch is really important.
It's especially important from external hosts.
Basically, the "-Pn" means treat all hosts as online.
So, if you're running your scan from the internet,
it's really important to have this switch
because oftentimes firewalls will block
most ports except for specific ones
that the server is listening in on.
So, if you do not treat all hosts as online,
then the scan might skip over this one particular host
because it thinks it's offline.
So, when you're scanning from the internet,
"-Pn" is a recommended switch for NMAP.
Output is also important for NMAP.
Basically what the output does is allows you
to output your information into different types
of text files, and this is especially helpful
if you're scanning a large number of hosts.
It's nice to put that information into a text file
that you can refer to later on.
It's not as big of a deal for single hosts,
but it's very handy for actually tracking
what you've been doing.
And the port ranges is also really important.
So, by default, NMAP will scan the most common ports,
but you can specify certain port ranges.
So you can say, "-p22", like it says there,
which is only scanning for SSH.
Or you can do "-p1-65535" which is scanning
every single port on the system.
You can also scan for UDP ports and TCP ports,
and just specify those.
And you can choose to scan
the ports randomly or consecutively.
Randomly can be used to avoid different types
of intrusion-prevention systems.
And you can see how we can do
different types of UDP or TCP scans.
Now, let's take a look at Masscan.
While NMAP is the most popular port scanner,
Masscan is definitely the fastest.
So, if you just type "masscan" by itself
at the command line, you get some basic usage.
You should be familiar with how that works
because it's pretty similar to NMAP,
so pretty similar command line switches,
you can see the port specifications.
Pretty much the same.
If you type in "man masscan",
you get the manual page for Masscan,
which says it's a fast scan of the internet,
which is really underestimating its ability
because it's the fastest scan.
You can see in this description
it can scan the entire internet in three minutes
for one port, and it can go as fast
as 25 million packets per second.
So, this is really useful for very large surveys
or if you have large networks that you have to scan.
I encourage you to get used to the different options
that it offers, the same with all these scanners, NMAP, too.
So, let's scan for port 80 and 443
on the same host that we just scanned.
Actually, we're gonna scan the entire network this time.
Whereas before, we only scanned a single host,
we're gonna scan the whole network.
And, as you can see, really quickly,
it scanned that entire network.
The waiting period is just waiting
for more information to come back,
but it's pretty much already done at this point.
So, you can see, in just a few seconds,
it scanned that whole entire network just
for those two ports, port 80 and 443.
Now let's take a look at UDP.
While we spend most of our time scanning TCP ports,
UDP is often overlooked, and you can get some
really good information from open UDP ports.
So, as you can see right here, our UDP pro scanner,
we're scanning an entire network,
and it runs pretty quickly.
You can see it immediately receive
some UDP port 53 responses.
Also, 137 and 123, so NTP.
And you can see the different types of requests
that it's sending out to the network,
and it's hoping for some types of responses from there.
So this scanner, unlike the others, is just fine tuned
to specifically UDP, and it does a really great job
of doing that very quickly and letting you know
what the exact response is.
For web service review, EyeWitness is the tool
that we recommend that you check out.
EyeWitness really helps if you have a lot
of web services that are available.
Let's say you're scanning a entire network,
and you find a hundred different websites
that you need to attack.
Instead of individually going to every single one
and figuring out which one to prioritize,
a tool like EyeWitness can quickly show you which ones
that you should prioritize, and it does this
by visiting every single one of these websites
for you, taking a screenshot of those, and gives you
some details about some of the header information,
and you can quickly look at the website report
that this outputs and you can look at all the screenshots
and determine which one you want to prioritize.
Sometimes you'll see a system
that looks like an obvious test system.
Maybe you'll see a system with a login page.
You know, tend to focus on some of those instead
of focusing on some of the ones
that really don't have much on there.
Okay, now that we have described how EyeWitness works
on paper, let's actually see it in action.
We'll start by doing an NMAP scan of the local network
for two web ports: port 80, which is HTTP,
and port 443, which is HTTPS.
We can see that there are three systems on the network
that have either one of those ports open.
So, we'll take those three systems,
and what we need to do for EyeWitness is
put them all into a text file, and then we could run
EyeWitness just by itself.
If you just run EyeWitness, you can see
that it says you did not specify a file,
and you need to basically specify a file name
when you run the tool.
So, EyeWitness "--web", which means we're going to
scan for systems listening in on port 80 and 443.
"-f", which is the file name, and we have our
three systems that are listening in on port 80 or 443
in that "ip_list.txt".
So we'll run EyeWitness against that,
and you can see it's sending requests to three hosts.
It's attempting to take screenshots of these systems.
And it says "Finished in 16 seconds".
And it's asking if we'd like to open the report.
So, we'll say, "yes", and it opens this report.
So, you can see those three systems that we scanned,
it took screenshots for them.
We see the first system looks like a PF Sense box,
which is a firewall.
It makes sense the .1 one address is the firewall.
The .11 is some secret admin site page,
which is interesting.
And then the third one, .12,
looks like a generic Ubuntu box.
I think the one that we would focus on
would be this secret admin site.
You could see that it has user name
and password field for that, and the title of the system,
you can see over to the left side,
is "sec-training", so you can imagine this is
probably a more vulnerable site on the network.
And you could really see the true power of this tool now.
If we have several hundred sites that we wanted
to figure out which ones to focus on,
if we can just run EyeWitness against it,
against the network, and it'll take screenshots
of all the websites, then we can quickly look
at the websites in this nice report
to see which ones we want to focus on first.
And that's much faster than browsing
to each individual website manually,
and taking up valuable time.