Hey guys and welcome back.
So what we're going to talk about in this nugget right here is all about port scanning.
So what exactly is this subject all about and what are the tools that we can use to
invoke this task?
So let's first talk about what a port actually is.
Now a port, although it might sound like a physical port like something you would plug
into, a port is a logical construct in this context, meaning that it doesn't actually
physically exist on your laptop or your server, it is something that is done effectively in
software.
Now when you talk about a port, you can identify them via a port number.
And particular services by default are associated with particular numbers.
A very well known one is port 80.
This is the common port when you want to run an HTTP service.
This is a basic web service without encryption.
Whereas if you happen to be running an encrypted web service, you would run that over port
443, that would be HTTPS.
Now one thing to note here is that these numbers are not locked in.
You don't have to use port 80 to serve up a web address.
You don't have to use port 443 to serve up an encrypted web server.
But having these well known and accepted and standardized numbers makes our lives much
much easier.
So let's say we wanted to go and watch some funny cat videos on YouTube.
Always a good reason to go there.
What we would do is on our local machine we would open up our browser.
This could be something like say Firefox or Google Chrome, say for example.
You would type in the address youtube.com.
Now what is actually going on under the hood here is that DNS is going to resolve this
host name to the server's IP address.
So this would be translated to the IP address.
Let's just say it's 8.8.8.8, which it is not for YouTube by the way, but let's just pretend.
Your browser would then seek to visit 8.8.8.8.
But it would also have to specify a particular port number to receive these services now
because we know we are trying to receive HTTP traffic.
We would make the request to either port 80 or port 443.
Now realistically in the modern day YouTube is going to be served to you over HTTPS.
So the request would be to the IP address here at port 443.
Your browser would handle this under the hood.
Now think about this.
Even though this is not a mandated number, i.e. you could feasibly change the number
to port 449 if you so choose.
Think about how confusing this would be if web servers all over the world were just randomly
choosing different port numbers.
If you happen to open up a browser and go to youtube.com, you could maybe resolve the
domain name to the IP address, but how would you figure out the correct ports to make that
connection over so that you could actually reach the web server?
Instead, if we have these standardized ports, which are associated with particular services,
when you want to have public facing services that you want to share with the public when
it does make sense to actually utilize these well known port numbers.
Now this is often a common thing with respect to networking.
We will have ports for particular things that we will be using.
Say for example SSH, which is what I have right here.
In this session here, I'm actually connecting to my virtual machine over SSH, which means
I am targeting my virtual machines IP address and I'm specifying the port 22.
Now when we happen to be managing systems doing things like system administration, we
want to know what services are running on the servers we happen to be administering.
Also for the purposes of security, we have to understand which ports are actually available
on our own system.
Because here is the thing, for every port you leave open, you leave a potential for
that port to be exploited.
In fact, if you happen to do the general hacking methodology which hackers use, one of the
very first things they try to do is to discover which port numbers are open on a particular
machine they want to attack and which services are running.
Because if you can identify a listening port, you can identify a potential attack vector.
Now if you are a Linux engineer and you happen to have a whole bunch of ports open which
are no longer necessary, then you would want to be able to identify those ports and shut
them down.
Now one thing to say is that when we actually talk about this combination of an IP address,
say for example 192.168.0.68 on port 80, this combination of the IP address and the colon
and the port number, this is known as a socket.
If you hear this term referring to some type of socket, you will know we are referring
to exactly this, the IP and the port.
Now like I say, we want to be able to identify which ports are open i.e. which services are
being served up by a particular server as well as which potential attack vectors are
we opening on our own system.
So the way we can identify what ports are actually open is we can do what exactly I
mentioned at the very beginning, we can do port scanning.
Now port scanning is really quite an art.
There is many many ways to scan different ports using different techniques but one of
the absolute best tools that we can use, in fact I would probably say this is the go-to
tool for security researchers and penetration testers, is a tool called Nmap.
This is the network mapper and with Nmap you are going to be able to craft particular
packets, things like TCP packets or UDP packets and send these packets to a particular host
or a particular network and probe that target to see which services it is listening on,
if it is listening on HTTP, port 80 or if it is listening on port 23 for Telnet.
You kind of get the drift and Nmap is going to make our lives much much easier when attempting
to do such a thing.
So what I actually want to do here is I want to briefly download another virtual machine
and we will scan that virtual machine using Nmap.
So we can see how to use this tool and how we can interpret the results of what we actually
see.
Now what I am going to download is something called the DVWA.
Now there is absolutely no requirement for you to download this for the purposes of the
LPIC2 examination.
This just happens to be one of my favourite virtual machines that I like to download when
exploring port scanning because what it is, it is a virtual machine that is deliberately
vulnerable.
I either is going to be a whole bunch of ports open on this machine so you can get a lot
of detailed results.
Really a prime candidate to show off Nmap.
So if you want to follow along then what to do is to go to your browser.
So I am just going to search for DVWA ISO image.
I click this top link right here and I will download an ISO image here and that is now
downloading right now.
Perfect, so it is now downloaded.
Cool, now I will go to virtual box.
I will create a new machine or just say DVWA.
I will make this a Linux machine and I will say next.
I will say next again and create.
Next and dynamically allocated.
I will just make this I don't know like 3GIG or something whatever it may be.
Now I will go to settings here.
I will go to storage, go to controller, click empty.
I will change this and I will choose a disk file.
I will grab this ISO image and say open and I want to make sure this is on the same network.
I will make this a bridged adapter because that is the same type of connection I have
on my Zubuntu machine and I will click OK.
Now what I will do is I will power this on.
I will click start.
This is beginning to boot up.
OK, so I now see this boot screen if you just give this a minute or so to actually fully
boot and we will eventually see a splash screen.
OK, so we now have this splash screen.
We can choose a live system or we can choose to install by using the arrow keys.
I will just say live system.
OK, so I now have this little command line.
So I will say ifconfig and if you can see here I have an address of 192.1680.72.
That is on the same network as my Zubuntu machine.
So what I will do is I will try to ping this device 192.1680.72 and we can actually see
I have connectivity here.
So what I want to be able to do is to use Nmap to initiate a port scan against this device.
So what I will say is sudo apt install nmap.
Type in my password and I will say yes and it will run through the installation for nmap.
OK, perfect.
So if I now say man nmap, we will see the man page.
Now this is a network exploration tool and if we scroll on down we are going to see a
ton of options that we can use with respect to nmap.
Like I say, port scanning really can be quite an art and a science.
It's very, very in depth or it can be very, very in depth.
We can see all of these different flags that we can use.
We can do a list scan.
We can do a ping scan.
If we scroll on down we can run particular scripts against the device.
We can run particular tests which will actually test the operating system that we're targeting
which will tell us if we happen to be connecting to a Windows 7 machine or a Linux Ubuntu machine
so on and so forth.
We can do things like firewall and intrusion detection system evasion.
We can scan via IPv6 and a whole host of other options.
So let me show you how we can use this tool then.
So I'll press Q to quit and let me clear the screen.
So the very basic use of nmap is just to specify the command nmap followed by the target that
you want to well target.
So if I say 192.168.0.72 and I hit enter we can see here we've done a very basic port scan
and we have retrieved some information.
So we can see here that this particular service has port 21 open TCP but it's in the open state.
This is for file transfer protocol.
We can see it has SSH open port 22.
It has a web server open support 80 and it has port 443 open as well as it has a MySQL
database available and open.
So just by doing this very basic nmap scan straight away I can see that this server here
is actually running a web service.
So we can actually take this IP address and pop it into our browser.
So let me just go to my Zabuntu machine grab this or log in here so I can access its web
browser.
So if I go up to my options I go to my web browser.
I'll just type in the IP address 192.168.0.72 and I could do colon port 80 if I choose
to specify give me it over unsecured port 80 and hit enter.
And now here we actually have the web page for the DVWA web server and if we notice here
we can see the connection is not secure.
This is because we are running over port 80.
So straight away just by initiating this scan I was able to infer information about
this server almost immediately I could tell that indeed this server actually is not just
a basic Linux server.
It's a Linux server acting as a web server and we can visit this because it has port 80
open.
Now as it transpires if we just happen to use nmap let me just minimize this and go back
to my SSH session.
Now like I say we can use nmap to get further information say for example we could use the
dash o flag to use OS detection and we can say 192.168.0.72 if I hit enter now.
Oh I'll have to use super user privileges to do OS detection.
Let's try this again.
Now we're going to get additional information and we can actually see here information relating
to its MAC address.
We can see what system it's running that it is a Linux machine it's not a MAC it is not
a Windows machine we can actually see the kernel which is being run here 2.6 and we can
see how far away in the network it is it's one hop away.
Now what we can also do is say nmap and as opposed to targeting a particular host say
for example 72 as we did before we could actually give nmap a network address and hit enter
and what nmap is going to do it's going to try to find all the hosts within this network
and conduct a scan against those hosts.
So this will indeed take a little bit of time because we happen to be doing much much more
scanning right now but ultimately once this is finished you will have a report back about
the live host and which ports are available on that particular host.
So notice we actually get information relating to our host 0.72 and we can see all the available
ports which are open and we also get information relating to our cells here because we are
also of course on this network.
So indeed we can actually see here that port 22 is indeed open and that is because right
now while I'm connecting to that machine over SSH if I did IP adder show then we can see
here this is our local IP address.
So the nmap command is a very very very useful tool it can be used to identify particular
services which are running on a machine giving you insight as to what you can do against
that machine as well as insight about potential security flaws in that machine.
Say for example if I use the flag nmap-a and target that machine and hit enter.
This is going to run additional tests to try to find particular vulnerabilities against
the machine so not only are we seeing things like FTP being open we actually see the version
of FTP that is open and this is the type of thing that hackers would look for they would
look for vulnerabilities in this particular version.
So in the middle of the play we can see the web server happens to be an Apache web server
with the particular version and we get a whole bunch of other information relating to the
SSL ciphers.
So like I say using this nmap command we can not only just find out information about
the services that a particular server is running we can also use the different abilities of
nmap to port scan our own system to identify these potentially vulnerable services on our
machine and if you happen to identify a particular service that you know is no longer in use
and no longer needed then what you should do is shut down that service and close that
port because it's just simply opening a potential vulnerability for your actual system and server
to be compromised.
So like I say definitely explore the nmap command the man page has so much different
options and examples that you can use to get a wide and different range of information.
But for now that is all I have for port scanning I hope this has been informative for you and
I'd like to thank you for viewing.