Inside of our Kelly box, there's a couple of things I want to discuss and go
over with you before we get too deep in weeds on
running in-map in our lab. So think of this as a couple of walkthrough examples
before we move on over to the lab and you get to play on there.
Now I have the in-map opened up and we're going to run it both in the GUI form
and also in the terminal form.
And I wanted to kind of give a compare and contrast real quick.
First things first, I do want to point out these profiles real quick and
understand the differences between them.
First, if we go through an intent scan, that's going to take a while longer to
be able to complete because it's going through all possibilities of what's ever
open for a response.
Now we're used to being able to ping a system and do ICMP as far as a reply
from a system to say if it's online or not.
Now some devices out there may have ICMP plot or it's blocked into firewall
depending on where we're at on the actual network,
internal, external, whatever the case may be or what rules may be applied.
But just because you don't get a response from ICMP doesn't necessarily mean
the machine is offline.
Could mean that it's blocked and there are other services running just to limit
the amount of forward, faith and services at the attack plane.
And you see that we have ping a scan available, a quick scan available.
Those two right there are ICMP based to give us a response whether the system
is online or not.
But the intent scan is going to tell us if it's actually on or not and has an
actual service that's running behind the scenes that we just don't necessarily
get from a normal thing.
Flow comprehensive scan is something that is time based. It's not as fast as
any of the others. In fact, it's probably the slowest and will take the longest
and takes even longer depending on the number of ICMP addresses that you're
doing.
Now we'll go over time here in just a second. But the reason I bring this up is
because there's one thing that we are definitely going to hammer home in this
field is that's actual detection during our scanning.
But more on that in a minute. We just want to go over right now some of the
basics of what's actually going on with these scans and I'm going to type in an
address of 192.168.247.1.
And the reason I'm doing this is because this is the actual host system that I
'm running Cali on for the virtual environment.
And we're just going to do a simplistic quick scan and you can see right there
that it also populates with dash T4 and dash F inside of our in-mat syntax.
So we'll go ahead and run this scan, let it complete and it shouldn't take too
long. Matter of fact, it's already done.
And it gave us a quick response of one, it's already opened up and the system
is aligned and two, what ports and possible protocols are open on that
particular system.
Now, as I'm running this, I'm going to copy the actual command itself and go
inside of my terminal and do it in there as well. And we get the exact same
display minus the fancy colors.
And I prefer Zen map because I get the colors and I can differentiate real
quick and also export this to a report quicker.
And you could pipe out or Pacman out to a text editor or text file or however
you want to do it inside of the terminal.
It's just that I prefer these colors and you as a pen tester may prefer the
actual terminal output or the low overhead usage of terminal versus the GUI.
And when we take a look at this, I want to point out here the ports and
services that are being identified by Zen map
or in map altogether. Because the ports are open, these are TCP by the way. So
the way in map is actually going behind the scenes is doing a three way
handshake to see if it's open since then I can act
along those different ports.
If they respond,
it will trigger an in map that the port is open. It doesn't necessarily mean in
a quick scan that that service is correct. It could be a customized
setup and we're only getting a quick response because that's a commonly
assigned port number
for what came back as 135 TCP being MSRPC.
It's when we start getting into the slow and comprehensive scams that we
actually start getting a lot of information back.
Now I have here the actual Zen map running in the background of 128, which is
that Calibot.
And you can see here that we've already been running for a little bit and we're
still waiting on the full scan results to come back
more on that in a minute.
But the reason that I bring all this up is because I want to point out here in
a little bit what the actual traffic looks like.
So I'm going to let this complete and then I'll come right back and show you
the difference between a slow or quick scan and a slow comprehensive scan.
So I'll hop back into Calibot to do this and I did this because I can make it a
little bit bigger and have better colors for you.
And also it allows me to point out how to bring up past scans that you
completed inside of one session without saving.
And that is as I zoom in for you the scans tab.
You can click on there and see the scans along with the entirety of the syntax.
Now the first one that we have was the slow or excuse me was the
quick scan and you can verify that along with the actual command that was used
for that.
Now the second scan that was ran was intent scan all TCP ports.
And if we double click on this you can see that a lot of there wasn't really
that much information that came back.
I'm in mapping myself and we'll get more into the weeds on that in a bit as we
expand our scanning.
But I wanted to point out that this ran in 3.52 seconds.
And if I go back to my scans and select the one that was for the slow
comprehensive scan as you can see by that comparison.
You know, quick that.
You see that we get a whole lot more information to include network adapters,
whatever else has been either disabled like the host map on here along with
different findings.
And we have 13.41 seconds.
Now this was done on itself and took almost three times as long to be able to
complete.
So when you're going out on the network and wanting to do these scans, please
keep in mind
that although some scans are faster, they don't report back as much information
.
And some scans are slower. They are time intensive based on the amount of stuff
that you want to get back about the actual system itself.
And this will play into the next part of the skill where we go through it and
understand why sometimes scanning really fast or really slow isn't to the
benefit of the actual pen tester.