Lesson 19 : Determining Operation System Video Lecture | Ethical Hacking using Kali Linux (in English) - Software Development

hey guys welcome to the next tutorial
for ethical hacking and penetration
testing we are kali linux so so far we
have collected information about sorting
the Buster's before I proceed in the
previous tutorial I taught you about the
huis and the DNS lookup so so far we
have collected information about IP
addresses network current server names
and exit of the target Network but now
it's time to find out the OS running on
the target network the technique of
obtaining information about the target
network OS and it is called as OS
fingerprinting so if you remember
properly then I showed you you just open
it I showed you a different tool over
here which gathers information about OS
and it's given over here as OS
fingerprinting and the best part of this
which I normally used would be n map or
this n map and I will show you one
example I won't be teaching as to how we
actually go ahead and do that
I'll teaching you that later on by the
end of this tutorial so I'll just open
my another operating system and I'll
just power it on the different tools
except Cal Linux that allows you to
gather information all the Catalina's
has a better one but still if you are
not using Gallinas for some reason then
there is net crapcom
our site and can go ahead and type the
domain name of your target Network in
and which side is running it will give
you the domain name along with operating
system running on it so I'll just load
and show you one example for that and
since we don't need ok just
let's take a look and I just go ahead
and type out over here mmm
search let's take microsoft.com let's
check if i'm able to get that okay
perfect so as you can see we have
Microsoft comm which works on the net
block akima international and was first
seen on August 1995 and they're using
operating system Linux and for do go dot
Microsoft comm we have Windows Server
2012 and I believe this one may be the
unique server system because it's a
unknown and that's what happens when you
need use a UNIX operating system it is
unable to detect because it's not Linux
or Windows that is the reason the as you
can see that we have all the names of
operating system and that they are using
currently right now so this is just an
example but you can do the same thing
using Colinas as well and that is
another search engine which is quite
famous which is the shortened search
engine just type show than HQ okay
perfect so you can use a shortened
search engine that lets you find
specific computers using a variety of
filters so to give you an example I'll
just show you here I believe we need to
sign up for that
okay let's search okay let me type micro
soft and let's see what we get
okay so Mitch
okay so as you can see we have these
services running on Microsoft and is the
top countries using them if I want I can
go ahead and filter these by services so
let's check if I want HTTP then I just
scroll down search for port 80 and let's
see we don't have any port 80 over here
open so let's check if you could get the
FTP open now then this proves that
Microsoft is quite secure and it won't
be anything easy to for us to go down
hack over there perfect if I just go and
type Microsoft if I check the HTTP 1
none gtps perfect so this shows that
Microsoft is quite secure since we are
unable to get any open ports in that but
if you go in and check some random or
newly developed website then they may
not be that strong and they may give you
out open ports and if you find the open
port then you already have a jackpot for
that and you can easily go ahead and
gather as much information that you want
so this is one example and but we also
have traceroute and finding the route of
the target host is necessary to test
against the MIT M attacks and MIT M
means man-in-the-middle attack and it is
also called as monkey in the middle
attacks and other relative attacks
therefore you need to find the route of
the target host in the network this can
be accomplished with the help of tracer
our utility provided with most operating
systems and even Windows has that it
allows you to trace the path or the
route through which the target host host
packets travel in the network traceroute
uses the ICMP protocol concept and the
TTL that's time-to-live feel of the IP
header to find out the path of target
host in the network the traceroute
utility can detail the path IP packets
travel between to our systems it can
trace the number of routers the packets
that travel through the round-trip time
during in the duration in
sting interns sitting between two
routers and ether routers have DNS
entries name of the routers and the
network affiliation as well as the
geographic location so this is quite
useful for an hacker and much more than
I can say as useful because they almost
will have all the details and it sends
out a packet for the destined
destination specified so and this
utility helps reveal the IP address of
the intermediate hops in the route of
the target host from the source so I'll
show you an example let's check I if I
could if I can run this over here and so
let's go ahead and AC ERP treasured are
two one six point two three 9.30 six
point one zero okay try circuits unable
to recognize that let me check okay let
me check I believe I need to start that
as the administrator perfect and if I
when I child let me check I'll get
perfect so I'll just type treasured to
one six point two three nine point three
six point one zero so let's check how
many hops do we get and just if you
don't know two one six two three nine
three six point one zero is the tracer
is the address of nh3 google.com this in
case you don't know so let's check the
total of 30 hops and how much do we get
as you can see these are the IP
addresses as two and the fourth one got
timed out so this shows that from which
IP address and from how it is actually
traveling and what a hacker might do is
that the first shelter in the path this
is the packet it decrement the TTL value
that's time to live a value
I won and if the resulting TTL value is
zero it discards the packet and sends a
message back to the originating host to
inform it that the packet has been
discarded the same thing that happened
over here when intricate when the
request was timed out and it records the
IP address in the DNS of that router and
sends out another packet with a TTL
value of two this packet makes it
through the first router then times out
at the next router in the path and this
second router also sends an error
message back to the originating host
trace route continues to do this and it
records the IP address and the name of
each router until a packet final reaches
a target host or until it decides that
the host is reachable and yeah it does
the process in that way so in this
process it records a time it took for
each packet to travel the round-trip to
each router and finally when it reaches
a destination the normal ICMP ping
response will be sent by the sender
that's what it happened when google.com
sent it back over here as you can see
that these are the milliseconds that it
took for it to go ahead and respond so
we have seen how the traceroute utility
helps you to find out the IP address of
the intermediate device such as routers
firewalls etcetera are present between
the source and destination you can draw
the network topology diagram by
analyzing the trace route results as
well and after running several trace
routes you will be able to find out the
location of a particular hop in the
target Network and that's how it will
work so there are different trace out
tools as well