- [Instructor] So lets talk more about the recon phase.
Some of the things we might do in a recon phase are
running an NMAP scan to identify the open ports
that are listening on the target server.
We need to first know which doors are available
before we can start picking the locks essentially.
We might also scan using tools like niKto
to identify the version of the server
and some information about the code that's running
and if there's any insecure methods being used.
Of course automated scanners can also pick up
this kind of information for us.
In the following demo we will show how
to run a quick NMAP scan against our target server.
The results will tell us what ports the server
is listening on as well as the service type.
Then we'll also run a niKto scan to get a quick dump
of information about the web server and the application.
So we're going to do this in our be kali VM.
Let's start with the simple NMAP scan.
First, we need a terminal window because
NMAP we're going to run from the command line.
NMAP of course comes installed by default on Kali.
If you run an NMAP dash dash help it will give you a list
of some of the common commands and options
that can be used with NMAP.
There's many more options as well as scripts to explore
the NMAP.org website is a great reference
for that type of information and there is also tutorials
on how to use the scripts.
What we're going to run here is a SynScan
so at the command line we'll run the command
NMAP dash lower case s
capital s which tells it
to run a SynScan dash lower case p which specifies
the ports and then we're going to tell it to
scan every port available.
The target is
hackazon.net
The SynScan is a very quick and fairly
quiet scan since it never actually completes
the TCP connection.
We ran it against our target website hackazon.net
and the reason why we specified all the TCP ports
as an attacker we want to leave no stone unturned.
We're looking for a port that may have been left open
or a running service that the target does not know about.
So after we run the scan we can see that the only
opening listening port is port 80 which
is typically used for HTP web servers.
To verify this we can simply browse to that port
on the web server, so we'll fire up IceWeasel
which is our browser in Kali and we'll type in
hackazon.net, we'll specify port 80
and of course we see there is a web server running there.
We now want to gather more information about
that specific web server and the application
that is running on port 80.
So for this we are going to use a simple tool called Nikto.
This tool is also installed in Kali be default.
We'll again run this from the command line.
Let's start again with running the help command.
This gives us some information on how the commands work
you can see there's options for specifying the host
and the port as well as credentials
so for instance if you have a web application
that required authentication we would need to provide
the tool the credentials to log into the application
to scan it, so what we're going to do is
to just run a simple scan here.
niKo will take a few minutes to run but we can see
the information that is gathering as it's running
through in the terminal.
Some of the initial information that it gives us
is the type of operating system as well as
the web server version.
We can see here that version is Apache 247.
The rest of the results can also give us hints
to possible vulnerabilities.
So what we're going to do is we're going to
record this information for use in later phases
of our attack.