Now our challenge was simple. It was see if we can actually do perform a scan on a target system or systems and keep it slow enough. Also with permission if it's not yours and not get caught by the target systems and point protection system.
Now there's a couple of notes here I want to point out.
I hope you only picked one target. Because once you start adding multiple targets to a scan like this, it gets longer. Because you're not only scanning one of these really slowly, you're scanning multiple of these really slowly.
And so I would recommend just one target for this practice and seeing if you can get away with it just to get the scan results.
Now let's say you wanted to challenge yourself a little bit further and I'm not trying to get ahead of myself here.
And you say NMAPs, NMAPs, you know, just not doing it for me. Go back to one of the previous skills like open boss and perform a vulnerability scan on one of the target systems in our lab like Windows 10 or the actual host VM and start watching the bells and alarms go off.
Because you're going to have to run that one a whole lot slower too. And that's just more invasive than NMAP scan.
Now this scan, the successful one, because I had to run a few of them, this one took about five minutes, almost five minutes to complete.
And I can show you that here if we go inside of the NMAP and highlight that last line right there.
And you could see 282.03 seconds for the entirety of that one scanning. It's one target IP address, this local system.
And there was a lot of information to come back from that. And you can see that different ports and things like that are open.
Now, what's unique about this one is, is that fact that I have VMware running along with a bunch of other different things.
And you can see that inside of the actual ports that are open because TCP port 903 is always a kind of a tip off.
And the reason I point this out is, is because this is the first scan out of seven that I ran that was able to go through and complete without triggering my semantic on my local system.
And I point all that out to tell you this, it's something you're going to have to play with on your own and get adjusted to, to figure out how, what, what works, works for you.
And also against the organization on systems that you're working with and against, because different organizations are going to have different policies and security settings.
No two systems or networks are going to be alike. And I also want to point out too, that even though I was using NMAP, the way to be able to learn how to use NMAP better for some folks like me,
is to be able to use a GUI tool like NMAP that shows us whenever we do a default selection, like slow comprehensive scan to show us the actual syntax.
This syntax can be used inside of POSIX based systems and also the terminal command line.
If you have NMAP installed like that on Windows and put just like that into the actual terminal command line and ran.
If you want to make some adjustments, then that's up to you inside that command line and you can alter that command line as well and run it from there.
Speaking of altering the command line, I have this code below in the box below this video.
And the reason I point all this out is, is that if you want to adjust your timing back and forth, instead of using the defaults NMAP has, that's where the dash T4 comes into play at.
This right here inside of NMAP.
Now inside of our command overall, the timing is what's going to be where we talk about using things fast or slower, right?
So the lower that number is, the longer it's going to take.
T0 being on average about 5 minutes between packets.
Now that may seem slow and tedious and you may be aggravated by that.
But again, slower is better when we're doing network scans.
As we saw earlier inside of our scans, it's easier.
Pretty easy to tip off in point detection and protection systems on the individual targets.
Because once that scan starts, it has characteristics about the scan that heuristically get picked up because of the way the packets are formed and how fast they're going through their iterations.
Being able to slow your scans down may be aggravating, but it also makes it to where we as pen testers can start to identify different things on the network a little bit more reliably without worrying about having to tip off everybody that were in the area on the network doing our pen test.
I hope this has been informative for you, and I'd like to thank you for viewing.