- [Narrator] Active reconnaissance attacks
are attacks that include the scanning of the network
to find out which IP addresses respond
and then to further scan those devices
to see which ports of the devices,
those IP addresses are actually open.
Active scans are carried by tools called scanners.
So pretty self explanatory.
I'm shown here a few commercial
and open source application and vulnerability scanners.
One of the most popular ones is actually, Nmap.
I'm gonna show you Nmap in a few minutes.
There's also another one called Nessus
by Tenable Network Security.
They actually have a commercial entity or license for it,
but you can download it for free as well.
There's a very popular one called NeXpose by Rapid7.
That's actually very popular among penetration testers.
Qualys scan is another scanner
that also includes web application scanning,
is developed by Qualys.
There are many, many others, especially for application
and web application vulnerability scanning
such as AppScan from IBM, Burp Suite.
Burp actually has free and a commercial version.
That's a great tool to actually look for vulnerabilities
in a web application, ParosPro.
The list goes on and on as you can actually see here.
So this is for your reference.
So be aware that these attacks are not launch
only from individuals outside of the company
but they're also launch from people and devices
inside of your company sometimes, right?
So it is what we call the insider threat.
So in a lot of places actually,
you see scanning actually being done not only by humans,
but compromised machines that are already in the network
that are trying to actually find all the devices
that they can actually compromise
and steal information from.
So this vector is of particular concern these days
with the proliferation of organizations allowing employees
to even bring their own devices,
what we call BYOD that allows them to access
data applications and devices in the corporate network.
Some of those devices may actually be compromised, right?
So as soon as actually they come into the network
they actually start scanning and looking for vulnerabilities
that they can actually exploit.
Perhaps the user is also curious, right?
So these applications are actually commonly used
for even troubleshooting, right?
So you can scan to see what IP addresses
actually are available in the network
and what type of ports are actually open
and things like that.
So it may be used by a non-malicious user of course as well,
or maybe of course a backdoor is installed on the computer
which the user is actually logged into
and then in that case an outsider attacker
can be actually launching an attack in stealth mode.
So in either case it's important to implement
a security policy that takes nothing for granted, right?
So that's very important.
Don't take anything for granted
and be prepared to mitigate risk at several levels
including insider threat, right?
Now there are different types of port
and network scanning techniques.
The following are some of the most common ones.
First one is basic port scan.
It actually involves the scanning of a predetermined
TCP or UDP port by sending a specifically configure packet
that contains the port number of the port
that was actually selected.
So this is typically used to determine
what ports are actually open or available in a given system.
There's also a TCP scan,
which of course is a TCP-based scan to a series ports
on the machine to determine
the port availability within TCP.
There's also many different variances of it, right?
So you can do a TCP SYN scan
which is one of the most common types of TCP scanning
that is also referred to as a half-open scanning.
And that's because it never actually opens
a full TCP connection.
So it doesn't do a full TCP three way handshake.
So the scanner sends a SYN packet,
if the target responds then with a SYN-ACK
then the scanner typically says,
this port is actually open
and it may actually even reply back with a RST packet.
So another TCP scan type is a TCP ACK.
So this type of scan does not actually
or exactly determine the TCP ports
that are open or closed however,
it checks if the port is filtered or unfiltered
by that application or system.
So TCP ACK scans are typically used
when trying to see if a firewall is deployed
and its rule sets are taking effect, right?
So there are also TCP FIN packets that in some cases
they can bypass legacy firewalls since closed ports
may cause a system to reply to a FIN packet
with a corresponding RST packet
because the nature of TCP.
Now there's a type of scanning
that is called a UDP scan.
Now, UDP is a connectionless protocol.
So it doesn't have a three way handshake like TCP.
So the UDP scans have to rely on ICMP port
on reachable messages to determine
if the port is actually open.
So when the scanner sends a UDP packet
the port is actually not open on the victim site
or the victim system,
that system will respond back with an ICMP port
on reachable message.
And this type of scanning will definitely be affected
by firewalls and devices that actually
rate limit or blocked ICMP, right?
So that's the reason that a lot of people actually say that
UDP scanning is not that effective.
Now there's another type of scan called strobe scan.
And typically it's used by an attacker
to find the ports that he or she already knows
how to actually exploit.
So he already knows there's an open port
but they actually want to strobe scan to execute
on a more confined level of scanning.
Now there's a stealth scan and basically a stealth scan
is any scan that is designed to go undetected
by network auditing tools.
So, again there's many different type of scanning mechanisms
that we actually have in here.
The first example that I'm showing here
is the Nmap scanner.
And basically here I'm actually just doing what we call
a ping sweep to network with the IP addresses of
192.168.78.0 with the 24 bit mask.
And as you can see here actually it scans the network
and finds what devices are actually up.
And it actually even provides a little bit more information.
So it provides the MAC address.
If we can determine what type of devices,
some of them maybe Cisco devices,
other ones like I'm seeing here....
This is actually my house.
I have a couple of Google Chromecast.
I have a smart home device,
several Cisco devices in my house,
even Raspberry Pi that actually you're seeing here
you can determine that of course there's a Raspberry Pi
in that specific network.
So again this this is actually what we call
the ping scan or ping sweep
and basically just ICMP package to see
what devices are there and gathers information from that.
Then after that you can launch a more specific scan, right?
So in this case I'm actually just doing a light scan
for TCP for a host of 191.68.78.8.
That's a Linux host that I have in this network.
And if you can see here that device actually has
SSH open support 22, port 25 for mail SMTP actually open,
has a bind DNS server as well,
is running actually the HTTP server and a port 80.
It's running again a mail server
which supports POP3 and IMAP.
You can even see the OS type and the kernel version.
So it was actually able to do
what we call OS fingerprinting.
So the operating system fingerprinting.
It actually has a whole bunch of other information
about the device itself.
So again, this is a type of fairly basic scanning
that provides you with a lot of information, right?
So there's also a GUI or graphic user interface for Nmap
called Zenmap.
And that's what I'm actually showing here.
So basically I launched the same attack
that you saw in the CLI,
but in this case I'm doing it through the GUI.
In there you can actually see the Nmap output
with the ports that we went over already.
You can see if you click on the port and host a tab
you can see those in a little bit more graphical interface.
You can see a topology in this case,
I'm actually just going directly connected
to that device and so I'm in the same network
but if I was not in the same network
perhaps you would be able to actually see
a better graphical every representation of the network.
You can also see the host details,
TCP sequencing information,
other information that you can gather
from the system itself,
even the one with last boot.
So again you can actually this type of scanning
through the GUI or through the CLI.
And here I'm actually just showing you a reference
of an Nmap cheat sheet or tutorial that actually goes over
a lot of different command examples or scanning examples
using the Nmap scanner.
Again, this is actually a free scanner
I will probably suggest for you as you prepare for the exam
to actually use it, downloaded and use it.
Just use it in your network against your own machine
just become familiar of the actual output, right?
So this is one of the first steps
that in a lot of cases actually pen testers and attackers
actually use to gather information
about a network and a system
and then once it enumerates this type of ports
then it can carry over potentially
a more sophisticated attacks, right?
So it can look for vulnerabilities in the system,
exploit those vulnerabilities.
Once the vulnerabilities are actually compromised
or exploited and the system is actually compromised
they can launch other attacks throughout their organization.
So they can do lateral movement
and potentially exfiltrate information
from your organization.