In this demonstration,
we're going to talk about banner grabbing.
Banner grabbing helps us gather information
about a remote service software and version,
helping us with identifying potential vulnerabilities
that we can exploit.
I'm going to show you how to conduct banner grabbing
with four different tools, Curl, Wget, Netcat, and Nmap.
So first, let's look at how to use curl for banner grabbing.
The curl command is very versatile
for transferring data to and from a server,
but this is how we're going to conduct
banner grabbing with it.
Here's the command.
Now I'm currently on a VPN,
so I have a preconfigured vulnerable server.
So I'm going to use the -I flag,
which tells curl to fetch only the HTTP headers.
Now these headers often contain information
about the server software and version.
Okay, simple as that.
So we can see some good information here.
We see the version of http, which is 1.1.
We got the 200 response being, that's the okay,
and we can see the version of the server,
which is Apache 2.4.10.
Now this is where we're going to do some recon
and start looking at some vulnerabilities
to see if there's any specific exploits
known for that particular version of the server, alright?
And then next we're going to use the Wget.
Now here's the command we're going to use here.
Okay, so Wget is another command-line tool
that we use for retrieving files from the web.
Now to perform banner grabbing,
we're going to use the -q flag to suppress the output
and then the -S flag to display the server headers.
Okay, so we see we have the similar response
that we did to curl, but again,
this is just a different tool that we could use.
So as we're going through penetration testing,
you'll realize there's so many different tools
to accomplish similar things.
All right, and thirdly, we have Nmap,
which as we know by now is a powerful
networking scanning tool.
We're going to use the service version option.
So again, we're using the -SV option,
which is the service version detector,
and then we're going to point it
at our particular vulnerable IP address.
Okay, now here we have multiple different ports
that is targeted.
We didn't specify only port 80,
but now we see that we're able to see
a lot more than we did with just curl and Wget.
But if we key in on just port 80,
we'll see that we get the similar information
with the Apache server 2.4.10
using the Debian Linux distribution.
Alright, now this command simply just outputs
the server header by piping with the grip commands.
Now when I say pipe, that's just a Linux term,
meaning that I will feed the results
from one command into the next one.
Alright, so we see now we have a cleaner output.
We have exactly what we're looking for,
which is typically going to be the server version.
So again, all we did was feed in
multiple different commands here
to make sure that we were able to isolate
the one line that we needed, which was the server version
after we used the Netcat command.
Alright, now that quickly sums things up.
So we went over how to perform banner grabbing using Curl,
Wget, Nmap with this service version control, and Netcat.
I hope you liked this demonstration
and I'll see you in the next lesson.