> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/footprinting-and-scanning.md). # FootPrinting & Scanning We're going to start thinking and acting like a adversary. The first step an adversary is going to take when they get hands-on with the network are: 1. Mapping a Network 2. Port Scanning *** #### Purpose * **Scope** : We need to figure out the scope of what will provide them value while not interfering with their business. * **Discovery** #### Process * Physical Access * Physical Security * OSINT * Social Engineering * Sniffing * Passive Reconnaissance * Watch network traffic * ARP * Address Resolution Protocol (RFC 826) * It resolves IP to MAC * ICMP * Internet Control Message Protocol (RFC 792) * Traceroute * Ping : Type 8 - echo request #### Tools * Wireshark * Open wireshark choose, tap0 interface * sudo arp-scan -I tun0 -g \ * wireshark => statistics => endpoints, and see our ethernet endpoints, this gives us all the mac address * ARP-SCAN It is used for host discovery. ``` sudo arp-scan -I -g ``` * Ping To check if the host is active or not. ``` ping ``` * FPing It will sends ping to multiple host at a time and gives better return back ``` fping -I -g /CIDR -a ``` *Note: Standard IN - 0, Standard Out - 1, Standard Errors - 2* ``` fping -I -g /CIDR -a 2> /dev/null ``` *Note: When we do arp-scan & fping to host discovery you may might some new hosts as few doesn't reply to pings maybe firewall rule...that's why its better to use different tools for host discovery.* * Nmap - it's a powerful tool, it's open-source and available for all operating system ``` nmap -sn / ``` * Zenmap It gives us discovery scan in a graphical way. *** ### Port Scanning #### Purpose * Identify Operating System * Revealed by Signatures * Revealed by Services * Identify Services * Trying to connect to ports * Check for responses * Connection to UDP are usually slower, open| filtered, can be sped up ``` nmap -h ``` -iL for inputfilname ``` nmap -iL ``` *Note: press "v" while scanning it will increase the verbosity, and press "space/return" to know what currently happenin**g.*** **RUSTSCAN** ``` rustscan -a -r 1-65535 -- -sC -sV -oN -vvv ``` #### Other Tools * Zenmap - GUI NMAP * NMAP Automator * Masscan - It is a very fast port scanner, it works on by multi-threading * Rustscan - It runs of a rust language, which operates at a lower level language, and is then able to work a lot faster and auto recon, similar to Nmap automator * Autorecon ### Nmap Host Discovery\[LAB] ``` nmap -sV -Pn -O ``` ``` Not shown: 993 filtered ports PORT STATE SERVICE VERSION 80/tcp open http HttpFileServer httpd 2.3 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds 3389/tcp open ssl/ms-wbt-server? 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Microsoft Windows 2012 OS CPE: cpe:/o:microsoft:windows_server_2012 OS details: Microsoft Windows Server 2012 Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows ``` *** ### Windows Recon : Zenmap \[LAB] **Objective** : Discover all available live hosts. Windows machine (Server 2012) is provided. Your task is to discover the live host machines using the provided Zenmap tool. The subnet mask you need to focus on is "255.255.240.0" and CIDR 20. > nmap -sn \/20 ``` Starting Nmap 7.91 ( https://nmap.org ) at 2023-08-24 10:53 Coordinated Universal Time Nmap scan report for ip-10-5-16-1.ap-south-1.compute.internal (10.5.16.1) Host is up (0.00s latency). MAC Address: 02:B5:F8:B3:8D:26 (Unknown) Nmap scan report for ip-10-5-16-44.ap-south-1.compute.internal (10.5.16.44) Host is up (0.00s latency). MAC Address: 02:73:CE:2A:1B:90 (Unknown) Nmap scan report for ip-10-5-16-159.ap-south-1.compute.internal (10.5.16.159) Host is up (0.00s latency). MAC Address: 02:AB:32:AE:F0:52 (Unknown) Nmap scan report for ip-10-5-21-148.ap-south-1.compute.internal (10.5.21.148) Host is up (0.00s latency). MAC Address: 02:5E:4D:80:7A:6C (Unknown) Nmap scan report for ip-10-5-22-160.ap-south-1.compute.internal (10.5.22.160) Host is up (0.00s latency). MAC Address: 02:AB:B7:45:B1:FE (Unknown) Nmap scan report for ip-10-5-22-254.ap-south-1.compute.internal (10.5.22.254) Host is up (0.00s latency). MAC Address: 02:37:BA:8F:94:C0 (Unknown) Nmap scan report for ip-10-5-23-96.ap-south-1.compute.internal (10.5.23.96) Host is up (0.00075s latency). MAC Address: 02:77:B5:2C:11:FA (Unknown) Nmap scan report for ip-10-5-23-125.ap-south-1.compute.internal (10.5.23.125) Host is up (0.0040s latency). MAC Address: 02:CF:62:8A:77:CE (Unknown) Nmap scan report for ip-10-5-24-218.ap-south-1.compute.internal (10.5.24.218) Host is up (0.00s latency). MAC Address: 02:A7:F7:4A:70:D2 (Unknown) Nmap scan report for ip-10-5-24-246.ap-south-1.compute.internal (10.5.24.246) Host is up (0.00s latency). MAC Address: 02:A4:B2:83:F5:DA (Unknown) Nmap scan report for ip-10-5-26-70.ap-south-1.compute.internal (10.5.26.70) Host is up (0.00s latency). MAC Address: 02:F2:A1:21:8A:74 (Unknown) Nmap scan report for ip-10-5-28-45.ap-south-1.compute.internal (10.5.28.45) Host is up (0.00s latency). MAC Address: 02:DF:10:BD:81:F6 (Unknown) Nmap scan report for ip-10-5-28-53.ap-south-1.compute.internal (10.5.28.53) Host is up (0.00s latency). MAC Address: 02:66:7B:41:F4:DA (Unknown) Nmap scan report for ip-10-5-28-128.ap-south-1.compute.internal (10.5.28.128) Host is up (0.00s latency). MAC Address: 02:A5:35:C4:49:9A (Unknown) Nmap scan report for ip-10-5-22-104.ap-south-1.compute.internal (10.5.22.104) Host is up. Nmap done: 4096 IP addresses (15 hosts up) scanned in 14.25 seconds ```
#### Scan the Server 1 \[Lab] #### Scan the Server 2 \[Lab] * Note: It's always got to check UDP ports as well ``` PORT STATE SERVICE VERSION 177/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.10.3-P4-Ubuntu ``` #### Scan the Server 3 \[Lab]