Number one or number two number one or number two number three or number four
number three or number four
You might have noticed a difference between number one and number two
Being that one was just a command and the other one had the full syntax with it
And number three and number four with the full syntax and output along with
time stamps versus no time stamps
And if you want you can go back and take a look
But the point behind this is is that we want to be able to provide as much
information as possible and provide those time stamps
So let's add time stamps here. We are in our handy-dandy Cali box and we want
to run a simple command of
In-map we're doing a very quick and nitty-gritty
reconnaissance to figure out what's actually out there on the network and
By doing so it'll tell us what's open and what's available at that particular
time of scan
Well, there's that keyword again time because we want to make sure that we are
within
Compliance of our scope and our rules of engagement to make sure that we are
doing everything when we're allowed to do it
If there are any time constraints
So if I zoom in for you here real quick, you'll notice that there's no time
stamps whatsoever
and even if we run a simple command, let's say in-map and
We're just going to do a quick scan real quick. We could hit enter on this and
we can see that
Let me pause and zoom in for you there real quick
There is a timestamp on the actual in-map command them itself
But there won't be actually anything in the actual terminal other than what's
in that command or tool that you're using at that time
So now there are different ways to do this and what I like to do when I'm
getting into want to keep track of every
Thing that's going on to the second I can actually
Incorporate time stamps inside of the channel itself to make things a little
bit easier on me now
I've cleared the screen and we're gonna walk through this together because I
want to make sure that we all
Can follow along and make sure that we're installing tools correctly first and
foremost
I want to make sure that we have a pseudo apt
update that's ran to make sure that we have all the available packages to us
from the Cali repository
Now I've done this offline and already did all of our upgrades
So this shouldn't take too terribly long now. I've cleared so we're gonna go
ahead and do a pseudo apt install more utils
and
You can see there that it's gonna add a couple of different things to it
But yes, we want to go ahead and install that and timestamp is one of the
things that's included inside of the morning tilt
And we'll be able to pipe it with some of the commands that we're actually
using
Such as in map now obviously that didn't take too long
But I want to give you an example real quick
We're going to do an if config - a and pipe in
TS and you can see here that we get time stamps now
With every line of output that's going through to include the actual initiation
of the command itself
Which was 18 to be 859 now if I run this by itself
if config - a you can see that there are no time stamps there and
that
Just to give you a compare contrast now this comes into play a whole lot better
when we go into in map and
We ran it while while ago
But now we're going to pipe a TS on the end of it and you can see here for a
fact
I'm gonna stop and zoom in for you real quick not only do we get the actual
timestamp on the end of it itself
But at the beginning of it we get the full
formatted to our system timestamp May 14 659 32 seconds and
Starting in map 7.95 and you'll notice that on the end map
It doesn't actually have the seconds on there now is that getting two in the
weeds on the time stamps?
Maybe but for me it makes sense and if I zoom out you can see that
The the entire program ran it took about four seconds to complete a quick scan
of the overall network
And we have time stamps to prove every little thing that happened
so when we start going and comparing two logs on the network for our
Roundup meeting with the actual
Administration teams they can actually go through in their network logs and see
at that particular time
Based on timeskew if there is any and see if that lines up with their systems
If not it could be an indication of the vulnerability or if it does yes
they got it and it was duly noted.