In this lesson,
we are going to talk a little bit more in depth
about fingerprinting scans.
So we've talked about ports
and we've talked about port states,
but there's more information that you can get
by doing your fingerprinting.
When you do fingerprinting,
this is a technique that gets a list
of all the resources on the network, the host,
or the system as a whole
to identify potential targets for future attack.
Now, this is the idea here with fingerprinting.
As an attacker, I'm trying to find out all about your system
so I can figure out a way to penetrate it
and a way to exploit it.
You, as a defender, want to know that same information
so you can put defenses in place to stop me from doing that.
Now, once you start identifying the open ports
and you've discovered those,
we're then going to use Nmap to probe them intensely.
Now, what do I mean by intensely?
Well, there's two ways of doing this.
You can use the command nmap -sV, or nmap -A.
Both of these will do an intensive port scan.
Now, these scans do differ just a little bit.
When you're using sV, you're going to be able to get
some basic versioning information,
but -A is going to do it more intensely
and discover even more data.
This intensive fingerprint scan
can provide you with a lot of detailed information.
Things like the protocols in use,
the application name and version,
the operating system type and version,
the host name, and the device type.
All of this is great information.
So once your scan is complete,
you're going to see something that looks like this.
You're going to receive a list of the ports
and their states.
Notice, there are different states that a port can be in.
We talked about those.
We had open and closed and filtered, right?
And so here, I see the first port is port 53.
It's a TCP port and it's open.
Now, what service does this run?
It runs domain service, domain name service.
Now, I also see the fingerprinting strings here,
and it shows me what version of the bind request TCP
was being used.
In this case, it couldn't identify the exact version,
but it does know it's using bind.
Then, I see the next port, port 80.
This, again, is TCP and it was open.
This is running our web service, HTTP.
What version is being run here?
Microsoft Internet Information Services.
That's running the HTTP daemon,
which is running on version 10.0.
Now, as I look into that, it gives me even more information,
gives me some basic methods of how it's done that,
and the information it knows about it.
And as you go through this,
you're getting more and more details.
As you go further, you can see the MAC address,
you can see what operating system it's using,
in this case, Windows Server 2016.
And all those types of details are things you can find out
by doing this type of in-depth, intensive probing
of those different ports and seeing what the responses are.
So you may be wondering, how does Nmap fingerprint
what services and versions are running on this server?
How does it know all this information?
Well, it does it using what's known as a CPE,
which is the Common Platform Enumeration.
This is a scheme for identifying hardware devices,
operating systems, and applications
developed by the MITRE Corporation.
Essentially, this CPE is a database
of different fingerprint signatures,
and what Nmap does is it compares
the response it's getting from these ports
when it sends that SYN packet,
what it gets back as the SYN/ACK, it looks at that packet
and determines which operating systems it is
and which versions
because each one answers just a little bit differently.
That's the idea of using the CPE.
Now, Nmap is also a really powerful tool,
and it's even more powerful
when you can use scripting with it.
Nmap even comes with its own scripting engine.
It's known as the Nmap Scripting Engine, or NSE.
This allows scripts
that are written in the Lua scripting language
to be used to carry out detailed probes.
This includes things like OS detection
and platform enumeration,
Windows user account discovery,
identifying the logged-on Windows users against the system,
performing some basic vulnerability detection
to figure out what software's in use
and what might be vulnerable.
It can also be used to probe web servers to gather HTTP data
and identify web applications in use.
And you can even add geolocation
to your different trace route probes.
All of this and more can be done
using the Nmap Scripting Engine.
If you go to nmap.org,
you also find there are lots of pre-made scripts out there
that have already been created for you.
You can simply plug them into your Nmap client.
And that way,
you don't even have to write these scripts yourself.
We're going to explore the Nmap Scripting Engine more
in a separate video.