‫Port and services on the Web server.
‫Web applications are generally served on ports 80 and 443.
‫But it's not limited to use just these port numbers, port numbers are configurable, so it's not uncommon
‫to see Web applications served on a non-standard port such as AT&T.
‫OK, so basically you are or an IP address will be provided to you if you start a penetration test,
‫but sometimes due to your contract, you you may need to run a black box testing approach with nothing.
‫You wouldn't even have an IP or a URL to get to test.
‫In both of these scenarios, you would need to identify and then map the target network in some level,
‫so the first thing to do is to identify the target network with who is.
‫So we've already done that.
‫The second thing to do is to map the network.
‫And that's what we're going to do now.
‫And we will use county, it's it's got a great tool in there to help us out and map.
‫So end map is short for network mapper.
‫It's a powerful open source network scanning tool perfect for conducting reconnaissance and enumeration.
‫So here we are going to benefit from and map, so now open up your terminal and county and type and
‫map.
‫You can see there are a few options.
‫And MAB can perform many tasks.
‫It can identify live hosts, scan TCP and UDP, open ports, detect firewalls, get service version
‫running in remote hosts and even with the use of scripts, find and exploit vulnerabilities.
‫So why don't we just start with a basic scan?
‫So at this point, let's assume I was given or I have found the target IP or you are.
‫So I'm going to use B box IP address and the examples.
‫Simply type and map one nine two dot one six eight two zero four, out one three zero and hit enter.
‫And here is a basic scan.
‫So Unmap will scan the target IP with its default options.
‫And the result shows the open ports and corresponding service names running on these ports.
‫So now let's touch on some of these other parameters to perform a detailed scan.
‫Now, Unmap has several approaches for scanning open ports.
‫It sounds raw network packets to several top or UDP parts of the target and check to see if there's
‫a response.
‫And if there is depending on the type of response, it will define the port.
‫As to whether it's open or not and remembering that HTP uses Tsipi for transmitting packets.
‫And MAP will play with these packets.
‫And then different skin types come up.
‫So regular TCP connection between.
‫Two types is called a three way handshake.
‫So first.
‫A sign flack reaches a destination and then it sends the Sinak flags back to the source, then the source
‫sends back the ACT flag to start the data transmission.
‫So this is the basic and fully qualified TCP connection, right, so type and map one nine two, not
‫one six eight two zero four one three zero dash s.
‫S.
‫And the SS parameter will do the sign scan on the target.
‫So that means it and map will not complete the three way handshake.
‫It's not going to replace the last sign packet with a reset packet.
‫But the result is not going to be different than the first one, because the sign scan is the default
‫option for unmap.
‫Now, type and map one nine two, not one six eight two zero four one three zero T.
‫And this is a TCP scan, if the S.
‫T parameters used.
‫So that means and map completes the three way handshake.
‫And that way and map can actually connect to the target for.
‫And then the connection is logged by the server and the result is the same as the previous one.
‫But it provides a more accurate state of the port.
‫OK, so you can see the maps are really clever tool at first identifies the live host on the Target
‫network and then scans the host for open ports.
‫So now let's type and map one nine two down one six eight two zero four dot one three zero as in.
‫And with the flag SRN, you can force and map to check to see if the host is alive or not.
‫And then, of course, the opposite is also possible.
‫Change SRN to porn.
‫And then this time and Map will not check to see if the host is alive or not.
‫It will only perform a port scan.
‫OK, so now let's let's be a little bit more specific about these ports so you can use the P flag to
‫define a port, no port list or port range for and map to scan.
‫So here, I'm going to give it port 80 and four for three.
‫And of course, you can provide service names like HTTP or https.
‫This time, it will find ports running the services.
‫So if you want to scan all the ports, just put a dash after the P.
‫It's going to take a lot longer.
‫But if you're not looking for a specific port, you can limit the number of ports by using top ports
‫as a parameter.
‫It will look for an maps, top 100 ports.
‫Now, if you only want the open ports, just ahead, the open parameter.
‫Now, closed port is gone.
‫Also, you can add a reasoned parameter to display the reason a port is in its particular state.
‫So until now, we've got open ports and the names of the services, right, so thankfully and MAP can
‫show the software versions running on the open ports.
‫And just add the parameter as the easy to detect versions.
‫And it might take a little while to run this kind of scan.
‫And here are the results with their version banners.
‫So now you can look for these version numbers to see if they have vulnerabilities or not.
‫And then the last thing that we'll do here is determining the operating system running on the target
‫host.
‫So just add the parameter O to the previous command.
‫And this could also take a little more time.
‫And Map will analyze the information collected from the open ports and versions and guess the probable
‫OS.
‫You can also use and map scripts and also you can compose your own script by using the end map scripting
‫engine.
‫So here are some script names that you can use to help you when you're doing penetration tests.
‫I want to show you how to use them, but simply because I'm going to be using some other tools and techniques
‫for the same purpose, using scripts is certainly not complicated, and I.
‫I do advise you to use them.