Network enumeration involves querying a group of hosts
to gather specific information about our network assets.
When we look at network scanning and mapping,
we're really talking about the aspect of gathering as much information about
our network as a whole that usually includes scanning for specific ports,
protocols, software and vulnerabilities or flaws.
When it across our entire network,
we're looking for active ports,
we're looking for specific software vulnerabilities.
We're looking for flaws that go through the entire network as a whole,
not within just one aspect of a specific machine,
but across the entire domain, whether that includes operating systems, routers,
switches or pretty much anything within the entire network.
Uh We are usually doing a vulnerability scan to look for specific vulnerabilities.
But we're also looking for problems that may erupt from
different troubleshooting lags or flaws within the network traffic.
Uh So we want to identify the different ports.
We want to identify the different protocols that we're utilizing.
But it's more than just finding out if this port is open
or closed or if this protocol is actually active or not.
What we're really looking for is what version of that protocol are they utilizing.
Are we using an
outdated or flawed protocol or a port that is seamlessly
more often than not very vulnerable to attacks such as
FTP or
TELNET.
These specific ports or protocols that are often used can
indicate a major flaw within our system as a whole.
NMP is one such tool that is greatly known
as an open source tool utilized for scanning.
Most people use NMAP specifically for identifying
operating systems or ports or protocols,
different services that are being offered,
but it can also be utilized as a vulnerability scanner.
In such way,
we can identify whether or not a specific protocol has a known vulnerability on it.
If a specific
port is well known and providing a flaw within our system such as telnet
or
FTP.
And it goes without saying that INMAP is widely used as a command-line based tool.
You'll probably also heard of Zenmap which provides us a
overall network kind of topology that's easier to use,
however, it's not really supported anymore.
And it's hard to find that Zenmap I would call it
you against using Zenmap as you're going through your tools.
Most cybersecurity professionals,
it's expected that we understand command-line interface and that we
expect to understand how a Linux system actually operates,
get used to typing out those little commands.
It'll be good for you in the long run metasploit framework
is an open source framework that's widely adopted for penetration testing.
When most people think metasploit, they think penetration testing,
most people don't realize that that tool actually has scanning
uh uh scanning services involved within the tool itself.
For instance,
we can use metasploit framework to find out if a specific SQL or a specific
uh Samba is vulnerable to attack.
It goes a little bit more in depth when we use
it for scanning tools because it's a specific for penetration testing.
But there's no doubt that
metasploit framework does provide us not only some scanning
tools but also exploits into vulnerabilities that those scanning tools
find that can be compromised. Reco
NG is an open source framework that
specialize in reconnaissance and open source intelligence gathering
and much like
metasploit, it focuses on target discovery and infrastructure mapping,
but it goes a little bit step beyond
that by identifying specific subdomains email addresses.
Uh and pretty much anything on the internet that you could think
of that would be open source for gathering information and intelligence.
It really goes without saying that
recon NG provides us with a vast understanding of the network and how your domain,
how your website
is seen by the public eye. All of this information is open source.
So what is your information that you're leaving on the domain
or on platforms such as Google or Bing or Bing,
excuse me operating across the board?
And what can our attacker see about our specific domains?