Lesson 24 : Nmap Video Lecture | Ethical Hacking using Kali Linux (in English) - Software Development

hey guys welcome to the next tutorial
for ethical hacking and penetration
testing via kali linux so in the
previous tutorial I showed you how we
can go ahead and gather information
using nmap if you are in the same
gateway and if you are not on the same
gateway then you can go and use the DNS
and who is methods to gather the IP
addresses of any specific person and so
now I am assuming we were on the same
gateway and you have the IP address the
same way I told you last time so now I
want the operating system information
about this specific IP address so what I
would do I would go ahead I use use my
Zen map I'll type the IP address over
here point one six eight point two three
six point one 31 and as you can see
there are different types of scan over
here if you go down if the operating
system you are trying to get access to
is related to a company it has it's a
big company and you're trying to get
information about that then I won't
suggest intense scan or indents in
either of these things I would not
suggest that I will just go ahead and
ask you to do a regular scan or a slow
and comprehensive scan so that you don't
get detected but I will be doing you all
of these scans I'll show you what is the
difference between them and the
different hops between them as to how we
can go ahead and connect them how many
between routers were there in between so
the in through which I need to go
through to go ahead and get information
about that so just too intense scan and
it is doing a sin stealth scan so these
are the open ports as you can see of
this particular PC and off my and I can
go ahead and use any of this port to go
ahead and transfer my any trojan or any
virus that I have and it will not get
detected it will just take a check it as
a normal traffic as you can see for
service and one host it's trying to go
anti OS detection
can take quite a bit of time sometimes
perfect time perfect so these were the
ports open
it started scanning for the OSS so there
are total of 996 filtered ports and
filtered means these are firewall ports
you won't be able to enter these ports
but these are the ports which are open
out of these nine and the six excluding
these 906 these are four ports which are
open through which you can go and access
them that's Windows Microsoft RPC and
windows HTTP API and these are the two
NetBIOS SSN but if you're using Windows
8 let me suggest you that these would be
all filtered out and there will not be
any port open if you have an updated
version of Windows 8.1 but still there
can be ways you can social engineer your
way through that as you can see the MAC
address is a VMware it's specifically
showing that if you don't know which
companies MAC addresses you can just
copy it over here and if it is related
to a specific PC then you can go over
the Internet and you can check MAC
address and yes you can go and check it
over here you can find the company
lookup and you can just type the IP
address probably it will not be able to
find it so perfect that means anything
starting with 0 0 0 C a 2 9 is the half
VMware if I go ahead and check it over
here
like a I need to go down through system
and over here I can see so this will
give you an idea of which hardware is
the person using exactly I'm getting
VMware over here but II since I'm using
a Virtual PC but if the person has an
actual hardware which is not a VMware
which is an actual computer then you
will get at the detail information so
let me just check the mac ID and I'll go
ahead and copy this Mac ID over here
that we have and I will paste it over
here in this portion so what I would do
I'll just cancel I'll just open over
here and I'll check I need to go and
check the Mac ID so ugly we have the Mac
ID over here okay that may be 6 hours
per bed we have the Mac IID so I'll just
type it over here FC - AAA - 1 4 - 45
and 5e - 64 and let's check what we get
buffered it has the gigabyte technology
and company limited so if you want
motion for more information you can just
go and compare it and you can check it
over here and you will be able to
confirm it exactly it is since this is a
gigabyte technology you can see the my
system manufacturers give out user by
technological company limited so in this
way you can get the it can go ahead and
at least narrow your down your Hardware
area as to which exactly it is using and
where you have the hardware right now
now you need to go know which operating
system is the person using so you don't
need to go ahead and gather much
information about that but because you
already have that months you do nmap
scanning it will show you that it's
general-purpose for phone or a normal
system and but you know it's not a phone
sense
it has gigabyte technology that means
it's a computer and it's not a virtual
pc and you can see it has Windows
version 8 or phone or Vista or 7 it can
be either of these but since its using
gigabyte technology
it cannot be phone or Vista because no
one uses Vista some now as frankly so it
will be a Windows 2008 server or a
Windows 7 so but over here again these
are the things as you can see but again
it has a narrowed it down a bit more it
can be Windows 2000 r2 or Windows Phone
which is not so I'll just cancel these
things out this is out and we have now
it so it can be even the service beaver
app pack 1 or Windows 7 or in here
versions and this operating system was
last started on May 13 that's today at
2:30 p.m. in the afternoon so you have
the date since how much time it is up
and it's just one half that means there
is only there are no computers in
between these are connected directly if
I am connecting it through Internet and
there were multiple computers through
all the routes through which I am going
and it will show me through the fisheye
as to where exactly my computer is by
connecting it to several computers and
as you can see we have the TCP sequence
prediction that is true 63 that means we
can easily go ahead and penetrate into
that again operating system is Windows
and we have all the information that we
need so the computer name was test user
since