‫So a few lectures ago, we saw how we identify which ports are scanned now in input management, we'll
‫see how we identify which systems are scanned.
‫OK, go to Cali and open a terminal window.
‫First, I'll prepare an end map query.
‫And because I'll play with the destination EPWs, it will be the last parameter of my query.
‫And map is the command itself.
‫And to close a name resolution, uppercase P end to close ping as uppercase s first in scan.
‫Now to keep it simple, let's scan just the top three ports.
‫Now is the time to identify the destination systems.
‫Up to now, we learn to scan a single IP.
‫And we learned how to scan an entire city block that zero through 24.
‫OK, so what are the other ways of identifying target systems?
‫You can select a range of any part of the IP address in the slide, the third and the fourth parts of
‫the IP address is given his ranges.
‫That means and MAP will scan IPS from one nine two to one six eight one zero to one nine two one six
‫eight two five five five five.
‫I'd like to keep the rain small, I'll only define a range for the fourth part of the destination address
‫from 100 to 150.
‫There's only one machine between one seven two one six eight nine nine one zero zero and one seven two
‫one six nine nine one five zero.
‫You can scan more than one IP block in a single query, for example, and slide scans to ranges, the
‫first range is between one nine two dot one six eight one zero and one nine two one six eight dot one
‫two five five.
‫In the second range is between 10 dot zero zero zero and 10.
‫That zero dot 255.
‫DOT 255.
‫Since I don't have a second network on my colleague, I continue with a third example.
‫The third example is a combination of defining a range and a single number.
‫For example, you can scan the IPS between 100 and one for zero IP two zero six and the IPS between
‫two to zero and two three zero.
‫So here are the results.
‫And Map found a machine from the range of one hundred three one four zero.
‫The machine with IP two zero six.
‫And another machine from the range of two to zero through two three zero.
‫Another way to define the target systems is to give and map the IP addresses in a file.
‫In a typical penetration test or ethical hacking, you will scan the network a lot of times.
‫First you find the hosts.
‫It doesn't make sense to scan the entire network again and again.
‫You'll see huge networks.
‫So if you scan the entire network each time, the pen test will take a lot longer than you think.
‫Let's open a second terminal screen and find a host of our IP block using ping scan, as we learned
‫before.
‫Now clarify the output to have only the IP addresses of live hosts grep command to get only the rows
‫containing IP addresses.
‫And cut him in to get only the IP addresses from Arrow.
‫Now we can redirect the output into a text file to reuse the list and following queries, but first
‫let me close a name resolution.
‫Now put a greater than character and give a file name to write the result.
‫IP list.
‫DOT text.
‫We're not interested in the first two IP addresses, so let's edit the file and delete them.
‫I use nano text editor to edit the file.
‫In NENO use control keh to delete online, use control, exit to exit neno press why to save changes
‫and hit enter save on the same file type cat ip list.
‫TXT to look at the file again.
‫Now we have four IP addresses in the file.
‫Let's create a new and map query and this time let's give the destination systems in a file IP list,
‫not text.
‫And here are the results of the four systems which are listed in the IP list that file.
‫So let's talk about the output management in MAP now, up to now, we've run a lot of unmap queries
‫and got the results on the terminal screen.
‫This is the default output behavior called interactive output, and it is sent to standard output tiddy
‫out in a penetration test, we should say, the results of the queries to be able to analyze them later
‫on, hopefully, and map as its own output management skills.
‫So let's have a look.
‫There are three major output saving formats and then Matt.
‫Normal output, which is similar to interactive output.
‫That's what you see on the screen up to now, except that it displays less run time, information and
‫mourning since it is expected to be analyzed after the scan completes rather than interactively.
‫Graspable output, which includes most information for target host on a single line so you can use it
‫to collect the information you want using the excellent grep command.
‫We've already seen a few examples of Greb command in this course.
‫XML output is one of the most important output types as it can be converted to HTML, easily parsed
‫by programs such as Inmet graphical user interfaces or imported into databases.
‫There is one more magic parameter, which is uppercase A. to let you generate the outputs in all formats.
‫Now let's see the unmap output management in action.
‫Go to Colleen, open a terminal screen.
‫Prepare an and map query for this example.
‫I want to prepare a sin scan.
‫Now we're ready for output management options.
‫First, I want to generate the XML output using O uppercase X parameter, o uppercase X parameter needs
‫the output filename.
‫You can give the file name with a full path if you don't specify a path.
‫Just as in this example, the file is created in the current folder.
‫Be careful, OK, and A.N. parameters require the full file name, so if you want the file to have an
‫extension such as DOT XML, you should specify it here yet enter to run the command.
‫To see the generated file.
‫Here it is, and use the less common to see the content of the file, so it's typical XML file with
‫tags.
‫Here's a hashtag starts and ends.
‫All the results about a host is listed between the start tag in the end, tag I.P. address, scan sports
‫and of course, the scan result.
‫Here is another hashtag in the scan, results of the second host as well.
‫Rescue to quit less command.
‫Now, let's call back our map query with the up Iraqis of the keyboard.
‫Now I want to generate all types of outputs.
‫Type O, uppercase A. and the base name of the files.
‫Be careful o uppercase a parameter requires the base file name of the files, not the full names of
‫a file.
‫And it'll put the file extensions itself.
‫Let's look at the content of that and map file using the less Linux command.
‫This is almost the same as you'll see on the screen.
‫Now let's look at the graspable output.
‫Here there are two lines for each host, one to show the status of the host and another one to show
‫the port scan results.