- [Instructor] Now that we have been able to locate things
like names, phone numbers,
addresses, some DNS information, IP addresses, and so on.
Let's take a look
at how to perform a overall network footprinting.
Now this is going to be, you know, the initial step
for things related to network footprinting.
In Lesson 3, we'll go over the details
of network scanning and the network scanning concepts,
the different scanning tools, understanding host discovery,
understanding port and service discovery,
and scanning beyond the traditional security capabilities
like the firewalls and IPS, and so on.
So here, let's take a look at a few examples.
The first thing that I want to do
is do a quick host resolution,
so DNS resolution using the host command
to the domain hacker.org, that I own with the number 4
and as you see, you have different IP addresses
that are resolving to hacker.org,
because it's actually doing DNS round-robin,
DNS low balancing
and also you see the information
around the different mail entities
so the MX records for hacker.org
but let's actually do a quick whois,
to the first IP address in the results.
Now, a lot of information is being displayed here
related to the organization.
However, take a look at this, you know,
if you look the results we getting, the organization GitHub.
Why are we getting GitHub
if we did a resolution for hacker.org
and then of course, we selected an IP address
that came back as, you know, the DNS resolution,
the IP associated to hacker.org,
why are we getting GitHub?
Well, in this case, actually, you know,
hacker.org is being hosted in GitHub pages
and you see a lot of different information
about the organization, not only, you know,
of course, the different address
but also the autonomous system numbers
and the block of IP address and the network range
that the first address that we selected it belongs to.
In this case, this means that the target network
has a total of 254 addresses
because it's a 24 bit mask, a class C network
and the attacker can now focus his efforts
or her efforts on the range
from the 185.199.111.0,
so from .1 all the way to 254.
Now, of course, as a pen tester,
you can use a plethora of different tools
to gather information from the network.
You can use things as simple as a trace route
to that IP address
so, you know the path and all the devices
that are in the path from your machine
all the way to that IP address.
Now, if you're doing an internal pen testing,
in other words you're actually are on site,
on premise performing a pen test,
you know, trace route becomes a little bit more relevant
because now you are seeing things
that maybe in between,
probably firewalls that maybe blocking,
you know the trace route
or you know, the different structures like routers
or layer three switches and so on
that may be in between your PC
or your machine all the way to the target device.
Now lesson 3 is dedicated to network scanning
but here I'm going to do a quick introduction
to a very popular port scanner
that can be used for overall network discovery
that is called Nmap.
Now Nmap can be used for a quick network discovery
or a ping sweep to see what host may be available
in the network and in my case,
I'm actually doing a quick scan
for any device that may reside
in the 10.6.6.0 network /24.
So that means a class C or a, you know,
subnet of the 10 network represented here.
So if I launch the tool,
it allows me to actually see
what devices are available in the network.
Then of course, we can go into a lot more detail
like performing DCP scans, UDP scans, and so on
but we will cover that in lesson 3.