As an analyst,
you may be expected to understand not only your network but also
the subnetworks that are attached to your organization as a whole.
You can have a cloud environment, a hybrid environment,
an on prem environment and then several different offsets
of each environment depending on what your organization entails.
This could range from a couple of machines
all the way to several 1000 different machines.
Within this chapter,
we're going to discuss vulnerability scanning methodologies as
well as the concepts associated with them.
Specifically within this episode.
We're going to talk about network mapping and what it entails
and how to identify the different subsets of within each network,
whether it's in an isolated environment or within the network as a whole.
We're also going to dive into an individual item on your network and
be able to fingerprint exactly what's going on with each individual system.
Network mapping includes different aspects of scanning the network as a whole
to identify the different machines or IP addresses associated with it.
You have to remember that each physical device has a respective
IP address associated with it to be on the network.
Now, we talked about dynamic and static IP addresses.
And that's not really what we're discussing here.
What we're discussing is each item on your network
is interconnected to another item on your network.
And you as an analyst need to be able to formulate an exact
map of each device and how it interacts physically with each other device.
Now, that sounds a little bit more complicated than what it needs to be.
We can usually pull this off via a different subset of networking tools.
In one way, such things as a ping sweep or port,
scanning ping sweeps really provide us a different
aspect of every IP address associated on the subnet
that we're operating on for each physical device.
Within that we want to know what ports are operating on it.
How is that device communicating with other items or objects on our network?
We also want to be able to enumerate it services.
What services are associated with that specific device?
Does it have a web server operational on it?
Maybe it's using something weird like RDP or
a specific port or protocol that we don't
normally see.
We need to be aware of those because we need a baseline
in order for our network to function operationally within our own organization.
How do we know if something's going wrong if we don't
have a baseline to identify exactly what's on our network?
Now,
once we've identified the different services ports and
the different IP addresses on our network,
we need to dive into an individual device in order to fingerprint every note
service operating system
and expansion pack that's operating on that specific device.
We want to keep a list operational within
our environment so that if something does occur,
or if our investigation takes us to a specific operating system,
we can identify everything that was originally on that
device from two days ago or a week ago.
If something has changed,
that's an indicator of compromise that we need to be able to identify.
We're going to go through right now and discuss that on an end map
and show you exactly what I'm talking about when it comes to network mapping.
Once we're in our Cali environment, we're going to open up a terminal.
That's that little black box at the very top left hand side,
I'm gonna blow this up.
So you can see it a little bit better as I'm typing out these different commands.
Now on my virtual network, I have both the windows 10 machine running.
I also have a key OPX
two which is a vulnerable machine that
we've identified before within this lab environment.
So I've actually got two machines running right
now on the network plus my Calley box.
In order to scan,
I actually need to know what my IP address is because
all of my machines are operating in the same subnet.
So the very first command I'm going to input is if config and this is just
going to give me the same principles that an IP config would on a Windows machine
here. You can see my IP address is 10.0 0.2 0.9.
And you can see my netmask as well as my broadcast address
throughout this.
We're going to run a simple network ping scan and I'm
going to do that using the NMP command switch or TSN
and I'm going to do a 10.0. 0,
there we go. Let me do that numlock button in there.
We're gonna do a 10.0 0.2 0.0.
But at the very end, we're gonna do a slash 24.
This is the final octet or what we're really scanning here is zero through 255
on that last octet right there.
If I hit enter, it's gonna go through and it's just gonna run that Pingan
very, very quickly to identify everything that's on my network.
You can see here the output.
Now I am in a virtual environment and
because I'm in a virtual environment using VirtualBox,
this IP address right here 2.1.
It's not a real IP address.
It's just something VirtualBox uses so that I
can see what's going on within my system.
If I scroll up, I know that my IP address for my county box is 2.9
which is right here.
Now, I did notice something and I'm sure you did too.
I've only got one box operational.
I've only got that 2.5 which means my Windows
machine is most likely not on this network.
Now, I can't be sure of that because I've only got one IP address.
We're gonna dive into this a little bit later when
we get into fingerprinting in the next little demo.
The next thing I want to do is port scanning to do port scanning.
I'm just going to open up that inmap command again.
But instead of doing sn we're just gonna do a P switch P.
This is going to provide me a very detailed port scan of every device on my slash
24 network. Again,
I'm not identifying a singular IP address.
I'm going through the entire site and this is what network mapping is all about.
We're not identifying a specific operating system.
We're not doing fingerprinting, we're doing network enumeration and mapping.
This is gonna take a second as it goes through
the command because this is a very detailed command.
So you may have to wait a few seconds for the system to finish up.
Ok.
So our scan is finished and you can see here that it
provided us at 2.1 but there's no ports except for 53 open
bonus points. If you can remember what port 53 TCP stands for,
let's drop down to 2.5.
Now 2.5 is the IP address of the singular machine that's
operational on my system or on my virtual network right now.
And we know that because 2.5 pointed out some different aspects
here.
You can see with our port scan that we identified several
different ports that are open starting with port 22 on SSH,
we can also see port 81 11 4 43 6 31 8 25 and 33 06.
All of these provide us a service,
but it's not a lot of information when it comes to that specific service.
It's not telling us the version.
It's not telling us the specific software that it might be utilizing.
It's just giving us a broader categorization of the service
that it's utilizing in conjunction with the port that's open.
Again.
It's telling me that SSH is open, but it's not telling me which version of SSH is open.
This is where network remuneration kind of stops.
We've identified the I from IP addresses associated with our
network and we've identified the ports that are open.
Now, let's talk about services.
If I want to run an inmap services scan, I'm gonna do
in map
T
or switch lowercase S uppercase V and again 10.0 0.2 0.0 with a forward slash 24.
Again, then make sure that I'm doing that last
octet of zero through 255 on the 24 Cider,
I'm gonna hit enter and it's going to go
through and start scanning all of these IP addresses.
In my case,
just the one for different services that are operational on this specific machine.
Again, you can recognize for the output that is providing us that report for 2.1
which again is just a VirtualBox.
And it's saying hey port 53 and it has one
service is unrecognizable because it is in fact VirtualBox,
if we scroll down,
we can see 2.5 is pointing out and it's providing
me a little bit more information to the specific machine.
It's telling me that port 22 is open on TCP with an open state running SSH.
And the version it's running is open SSH version 3.9
P one was protocol version 1.99.
This provides me a lot of information specific to this specific
box now because I ran it for the entire octet,
you can see that it's providing different aspects.
And if I had other machines, it would provide that output for each and every machine
on my subnet.
This is where network mapping really comes into play and where you as a
cybersecurity analyst should be able to read this output within your cys A exam.
You may see scenario based questions with an output like I'm showing you here going,
hey, what output
or what version of software is running?
We'll start again
from the top on this one,
not from the top, from the from the cys A exam.
You may see a question on your cys A exam asking on port 80
what service is currently running?
And it will provide you this blank out right here, which port 80 is running TCP
open.
And the correct answer would be running Apache HTTP D and it may be version 2.0 0.52
and maybe even asking you what operating system.
And in this case, it provides us using sent
OS
this is important information that you need to be aware of for
your cys A exam because you may see outputs like this.
It may also try to trick you where it's
not providing that service uh column right there.
And it'll say something like
uh what
service is running on HTTPS and you may be able
to add to identify that HTTPS is actually running on
port
43, which it didn't tell you before.
It's not associating with it.
And then you may have to put out the version service as Apache HTTP D version 2.0 0.52
S
OS.
So again, just like security plus,
you need to know what important protocols are matched and they may
not provide you everything when it comes to that specific attribute.
Expect to see different questions associated with that. On your cys A exam.
We talked about network mapping and how it includes mapping
your entire network and how those physical connections take place.
When we talk about fingerprinting,
we're specifically talking about a single device on your network.
This could be a server, a client, it could even be an I DS or IP S or a firewall.
It doesn't really matter. It's just dependent upon what you're actually scanning.
We're going to provide you an example today on IMAP. Again
of actually fingerprinting a specific device from our previous scan.
We know that 2.5 or 10.0 0.2 0.5 is actually running our
soul machine on our network associated with what we're doing here.
Now, I know what that machine is, but let's pretend for a minute that I didn't
if I've already done the ping sweep scan, which I have.
The next thing I may want to identify is the operating system as a whole.
Now, in our previous scan,
we identified that as possibly being a sent OS operating system.
But if I want to know for sure,
I can do a tag or switch capital O and then
provide the exact IP address you'll notice in a fingerprinting.
I'm not doing a scan or a citer.
I'm doing an individual IP address specifically 10.02 0.5.
If we see here, you can see at the very bottom,
it's providing me what the operating system is.
I am running a Linux 2.6 point X.
It's not sure exactly what the last version is for that,
but we are fairly confident that it is running on a
Linux platform of 2.6 if I drop down one line,
we can see the operating system.
C pe this tells us that it's running Linux, Linux kernel version 2.6 right here.
And if I look at the operating system details, it's making a best guess here.
And it's saying it's running Linux
2.6 0.9 through 2.6 0.30 which means it's fairly confident
that our operating system is one of these versions between that
we can also see. Unlike before, there is only one hop between my machine.
In which case, I'm running the scan and the virtual machine that's associated with.
That means there's nothing in between because one hop is actually the machine,
there's no route switching or anything else in between our two devices.
This is important to note when we're doing a fingerprinting
because it really tells us how many machines or how
many systems are between me and the operating system or
the fingerprinting system that I'm actually trying to communicate with.
You may see exam questions here specific to this.
And again,
you just need to know how to read something
like inmap that provides us this detailed information.
The next thing that we want to run is the software
for software.
A lot of times we're going to run a basic nmap scan with the SV command,
which we showed you specifically with the network mapping,
except we're doing it on the client based as well.
If you don't remember it's just in map with a switch or T
lowercase s uppercase V
and then the specific IP address in this case 10.0
0.2 0.5 and pressing enter to let it go through.
Uh This isn't the only software that you should
be associated with or understand on your network.
Uh
nmap doesn't have a specific command to identify every piece
of software on an individual client or a server.
But it does provide us a basically a high level overview of what's going on.
If you're in the CYS A or if you're an analyst,
you should have a list of uh software or
assets associated with every client on your network.
Meaning if you're running a Windows system and it's uses Microsoft Office Excel,
maybe it uses Outlook for its email
or other proprietary software or even common software like Java,
you should have a list of every
software that's associated with that specific device.
A
lot of times that software is held at the IT team because
that's more of their primary responsibility
than ours as cybersecurity specialists.
But we want access to those services and
software that are associated specifically with that machine.
Because if we're doing patching, if we have a piece of malware,
we have something that's going on,
we obviously need to know what was associated with that
specific machine because it could lead us down
some interesting pathways as we're doing our investigation.
However, for NMP, we're just going to run a basic services scan like we saw before.
In this case,
it really nothing has changed because we only did it for a specific machine
and you should know how to read this again.
You may see questions specific to a HTTPS or even IP P where it's not really
providing you the port number but expecting you
to understand the correlated uh port address for it
again, with open ports,
we're going to run the same command as before we
can do that switch piece switch just like before,
I'm not going to show that again because I feel like we've already covered that in
the network scan and it's really no different
except we're going to provide that same scan
to an individual IP address rather than a network as a whole.
Now, you may be asking yourselves for network scanning and then again,
for fingerprinting.
Why would I run the same command twice on an individual
machine if I already have it on a network scan,
a
lot of times it's because of the reporting feature
or the output feature of the actual software.
In nmap,
you could actually do an output for a report based
on the entire IP address range that you're utilizing.
For instance, if I'm doing network mapping,
maybe I want to fill out a report for every IP address that provides
me all the port numbers and associated services for the entire gambit of the
CIDR address.
But maybe I have an individual report on a shared drive that tells me, hey,
I have a Windows IP address
associated with Windows 10 running this uh this service and this software
and here's the open ports associated directly with that specific device.
So I have an individual port for that specific machine,
but I also have one for the network as a whole and they should match up if they don't,
then that could cause some possible issues.
Again, I can run services on the system using SB,
I can also identify the specific MAC address associated with it. To do that.
I would run an in map command to the specific IP address
can't type today
and map. And then we're gonna do a switch or T
lowercase S uppercase P
and then we're gonna do a switch in lowercase space
and then the specific IP address we want to run in
this case 10.0 0.2 0.5
and it should run through. And here you go, we can see our MAC address right here.
Uh The mac address in this case
right here, 08002742 AC 87 for our MAC address.
Again,
CYS A isn't going to specifically identify in
map commands that you may have to remember
if I'm showing you the in map command here on today's lesson in on our previous lab.
I wouldn't memorize those I really would because there
are labs specific in your hands on material there,
you may have to identify specific commands for in map,
they are few and far between, but they are there.
It's not uncommon for your CI S A exam to ask for a specific command.
Usually this is SN or in order to run a port scan.
And normally it's asking, hey,
this in map command in map switch lowercase s uppercase me runs.
What type of command expect to see those types of questions?
Don't expect to see questions like
input the command for inmap to run this type of scan their testing
material or testing database doesn't really form
around that type of test question,
but it does form around giving you the command and expecting
you to understand what the output of that command may offer.
That's the type of questions you can expect to see
for IP addresses.
We've kind of already covered that with the basic command of
switch SN which does a port scan or excuse me,
an IP scan which identifies the IP address associated with it.
And then again, configuration settings
for configuration settings,
they're really more talking about specific IP
addresses that aren't associated with operating systems.
You're talking about firmware versions or that type of thing
where we're looking more at IP SSS routers, firewalls,
items on your network that actually take configuration a
lot of times in my own past. What we used to do is we would show
those configuration settings onto a USB drive, as well as a shared folder
that was secured in our own databases.
So that if I had a device like a firewall crash on me, all of a sudden
I could take that USB drive,
which had the past configuration settings already on it.
And it would make setting up that new firewall that much easier
because it's literally loading the old
configuration settings onto the new device.
It's also nice if I'm troubleshooting a firewall
and it has some specific issues with it,
maybe it took a hiccup in power and it's just not operating properly.
I can already have this configuration settings
setting aside where I could plug it in
and just streamline the process all the way from the start to the finish.
Not all network devices have that capability,
but it is nice to have that already set aside if you have an issue,
remember, configuration settings are something that you should save and provide.
If nothing else, just screenshots that you can follow along.
If something happens within those devices.
As a Cybersecurity professional,
you should have access to those settings on a case by case basis.
In most cases, we want those settings all the time,
it just
provides us a little bit of error correction. If something goes on with the networks
and then finally, unique identifiers,
unique identifiers can be anything from a one off from a neural configuration.
In my old line alert, we used to have five or six different routers.
And other than the actual IP address, they were exactly the same
in those instances,
we may have a offset where one switch is operating against the norm.
We would identify those unique identifiers specific to that switch.
Normally we save those in configuration files or maybe we would color code it.
I remember on one rack, we had five different switches.
And so for that specific switch,
we would color it green with a nice juicy tag and some spray tan.
I doubt we were high tech,
but we would identify that switch as being unique and
that was a unique identifier we'd utilize with it.
And it would tell everybody that was working on that switch.
There's a different configuration file for this switch than the rest of them.
We only did that because we constantly had people going in
and then redressing that same switch to the normal switch,
configuration files that we always use unique
fires can be anything from a color code to a specific IP address
to associate with it or technology that isn't used on our normal switches.
Throughout this episode,
we talked about both network mapping and fingerprinting and
how to utilize those and the differences in between
with the network mapping.
We're really talking about the network as a whole and getting that logical
or or logical point of view of how our network map actually functions.
This is more utilized for it to identify, hey,
the router connects to the switch and the switch goes
to here and this goes to here so that visually you
could see all the different physical outputs or ports being
utilized and the cable throughputs between one device and another.
While I usually
this mechanism,
we as cybersecurity professionals need to know it as well
and we should have a copy of the network mapping.
We also want the logical perspective
where we're identifying each IP address through
map or some other form where we
can quickly identify what's interconnected between it.
So we want that physical mapping perspective,
which we may see from a topological point of view.
But we also want the software version where we can actually
see the different IP addresses and how they're associated with one another
with fingerprinting.
We're actually talking about the specific device and
how it operates on an image level,
what ports are open, what services is operating
the different software that's on it as well within the cys
A expect to see a lot of outputs within there.
And when I say a lot,
I really need one or two questions that are associated with
specific inmap outputs or other software that you've been accustomed with.
Maybe angry IP or something similar
to it.
You should be able to read those different outputs and identify what's
going on with the device based on the information they provide.
This seems pretty common sense and should be somewhat
easy for you to read as a cyber professional,
but I would brush up on it, especially if I've seen those outputs in a while.
A lot of times as analysts,
we get pigeonholed into one career field or one aspect of our job.
Remember that cys A is a broad scope of different jobs, all formula
at a high level. And so you need to be aware of how those different outputs are read.
I would just go over there once or twice before you take the exam. You should be OK.
Remember, it isn't uncommon to see a nmap command associated with the exam.
I myself have seen at least one in map command as a quiz question.
So be prepared for those high level
quiz questions associated with those basic commands
that you expect to see as part of nmap and you should be OK.