‫In those unmap lectures, we have seen no port scam, also known as Ping Skåne, different ways of scanning
‫ports.
‫SoundScan, also known as half open scanning DCPI scan, also known as TCP Connect Scan and UDP scan.
‫Now, let's see some more details to be able to use and map more effectively.
‫We have found the hosts and open ports of them now is it time to find out the services which are listening
‫to those ports and the version of those services?
‫In addition, let's detect the operating systems running on those systems.
‫Suppose that you ran an map query and it told you that ports twenty five TCP, 80 TCP and 53 UDP are
‫open.
‫Using its and map services database of about, oh, two thousand two hundred well known services and
‫MAP would report that those boards probably correspond to a male server, SMTP, Web server, HTTP and
‫name server DNS, respectively.
‫This lookup is usually accurate.
‫The vast majority of demons listening on TCP or 25 are in fact male servers.
‫However, you should not bet your security on this.
‫People can and do run services on strange ports.
‫Even if unmap is right and the hypothetical server above is running SMTP and DNS servers.
‫That is not a lot of information.
‫When doing vulnerability assessments or even simple network inventories of your companies or clients,
‫you really want to know which mail and DNS servers and versions are running.
‫Having an accurate version number helps dramatically in determining which exploits the server is vulnerable
‫to version detection, helps you obtain this information after TCP and or UDP ports are discovered using
‫one of the other Skåne methods version detection interrogates those ports to determine more about what
‫is actually running.
‫The Unmap Service Probes database contains probes for querying various services and match expressions
‫to recognize and pass responses.
‫And Map tries to determine the service protocol.
‫For example, FTP, s.h. telnet HTP.
‫The application name could be Iasi Binde Apache http d Solares Telnet D.
‫The version number hostname device type, something like a printer or a router and the OS family, you
‫know, that is Windows, Linux cetera.
‫So let's see how to use service and version detection and then map and why it's important.
‫OK, go to Cali and open a new terminal window.
‫Let's create the unmap scam command and map is a command itself.
‫And is to avoid the DNS resolution.
‫Up expenses to avoid the host discovery, I'm using the skin scan this time.
‫All right, the destination IP, which is the IP address of my Métis voidable VM and the destination
‫ports, the top 10 ports.
‫Let's run this command first to see the results of a command without version detection.
‫Now I open a new terminal window to create a new and map command.
‫I prepared the command with the same configuration.
‫Since Gane.
‫Matus voidable.
‫And top 10 port.
‫I had s uppercase V parameter for version detection and hit enter.
‫As you see, the query takes longer this time.
‫The skin scan without the version detection took less than a second and the skin scan with version detection
‫took about 12 seconds.
‫In the first query, service names are estimated by and MAP, according to the default service, is
‫running on those ports in the second query, on the other hand, and map from the ports to determine
‫more about what is actually running.
‫Now, I want to show you the most important reason of using version detection and map queries, and
‫I'm going to run S.H. on Port 443 and then scan the port within map.
‫Let's perform the demo together.
‫First, look at the listening services, if S.H. is running, that's debt to help.
‫As I say, he is running on Port 22 at the moment.
‫Type service s s h stop to stop us as a service and hit enter.
‫Now, to change the board of S.H., we're going to change the configuration.
‫Open the SAHD, underscore config file with a text editor, change it.
‫I use nano text editor for this purpose type nano slash, Etsy slash, S.H., SAHD, underscore config
‫and hit enter, find the port line, delete the sharp to make it a valid configuration line.
‫The sharp was used to make it a comment line.
‫Change the port number to four four three control X to exit nano Y to say changes and hit enter to save
‫over the existing file.
‫Start S.H. again using the service, S.H. start command.
‫Look at the listening ports to double check net stat to help.
‫S.H. Service is running on Port 443 now let's scan Port four for three of Colly within map repair the
‫and map since can command no versioned detection for this query.
‫And map, the text of the port is open, look at the service and map says the services https using its
‫and MAP Services database and MAP reported that this port probably corresponds to a Web server for https.
‫And we know that's not true.
‫So let's prepare the maps and scan again, but this time use as uppercase V parameter to run the version
‫detection mechanism.
‫Now as you see, four, four, three is running and the service is S.H., not https version detection
‫interrogated the port to determine more about what is actually running and map query the port using
‫the probes of the end map service probes database and matched expressions to recognize and parse responses.
‫And the version of S.H. is open.
‫S.H. Version seven dot six P one.
‫So if you are not 100 percent sure about the type of the running service on a port run version detection.
‫Got it.
‫Good.