‫One of the very first steps in any network reconnaissance mission is to reduce a set of IP ranges into
‫a list of active or interesting hosts, scanning every port of every single IP address is slow and usually
‫unnecessary in no port scan option using Essent option, which was known as Espie and previous releases,
‫you tell and map not to do a port scan after host discovery and only print out the available hosts that
‫responded to the host Discovery probes.
‫This scan type is often known as a ping scan.
‫Systems administrators often find this option valuable as well, it can easily be used to count available
‫machines on a network or monitor server availability.
‫This is often called a ping suite and is more reliable than pinging the broadcast address because many
‫hosts do not reply to broadcast queries.
‫The default host discovery done with SSN is executed by a privileged user.
‫It sends.
‫And ICMP Echo request.
‫TCP, CINCPAC into Port 443.
‫TCP backpack at the Port 80.
‫And an ICMP time stamp request by default.
‫When executed by an unprivileged user, only send packets are sent using a connect call deports 80 and
‫443 on the target when a privileged user tries to scan targets on a local Ethernet network.
‫Our requests are used unless send IP was specified.
‫Let's perform the first unmap scans of the course using Bing scan, also known as no port scan and map,
‫is embedded in Collie and defined in the path.
‫So you can run and map from anywhere just by typing and map in a terminal screen.
‫When you type in map and hit enter, you get the help page of the map.
‫You can also look at the man page by typing men and map.
‫To learn more.
‫Let's build an end map command to perform a ping scan.
‫After the command itself and map, I first add the parameter to define the scan type as ping scan.
‫Note that the order of the parameters is not important in unmap.
‫Now, enter the only mandatory parameter IP address here, ironer one seven two one six eight nine nine
‫eight zero two for network gurus already know what it is, keeping it very simple.
‫It means the IP address is between one seven two one six nine nine zero and one seven two one six eight
‫nine nine to five five.
‫That's not hit, enter and run the command.
‫And the results are in, these are the hosts which are up.
‫That means these are the systems that responded to our request.
‫Remember, from the previous slide, our requests are ICMP Sin for Port four, four three, ACC Report
‫80 and ICMP timestamp requests.
‫If the user is privileged, the IP addresses or the domain names of the systems are spread across a
‫line.
‫In most cases.
‫We want to see the IP addresses of the hosts as a list to use in further scans.
‫So what can we do to see only the IP addresses of the live systems?
‫Well, we're going to use the power of the Linux command show.
‫First, let's clear some lines of the result which do not contain IP addresses, so I'll only have the
‫lines of IP addresses to be able to do this.
‫I'll use grep command with pipe.
‫Copy a static part of the IP lines, for example, and map scam and give it as a parameter of grep command.
‫Let me give you a little tip here.
‫If you're using a mouse, select a string in the terminal screen and press the middle button of the
‫mouse to copy and paste the selected part.
‫Now we only have the lines which contain the IP addresses.
‫But wait a second, we have a domain name of a host, let's get rid of the domain name and see only
‫the IP address of it.
‫And then map command and dash and parameter to avoid the name resolution, so a map will display only
‫the IP address.
‫Now we have the lines with IP addresses.
‫Now the second step is to clear the words and the lines to have only the IP addresses.
‫To do this, we'll use a cut command of the clinic show.
‫Delimiter, here is the space character, give it with the D parameter.
‫IP is the.
‫Fifth field the line, give it with F. parameter.
‫Now we have the IP list of the live hosts.