Module 03: Scanning Networks with Nmap & Zenmap 🔥 | Practical Ethical Hacking Course | Hindi Free

Name: Module 03: Scanning Networks with Nmap & Zenmap 🔥 | Practical Ethical Hacking Course | Hindi Free
Uploaded: 2025-04-23T02:30:12.000Z
Duration: 2 h 32 min 46 s

Introduction to Network Scanning

Overview of Module 3

This channel does not promote any illegal activities; all content is for educational purposes only. Welcome back to Module 3, where the focus will be on network scanning. The anticipation for this module has been high, as indicated by numerous comments and messages received on social media platforms like Instagram.

Transition from Footprinting to Scanning

In Module 2, participants learned about footprinting and reconnaissance, which serves as a foundation for today's advanced topic: network scanning. Understanding the enemy's strategies is crucial in warfare, similar to how hackers need comprehensive details about their targets before executing an attack.

Importance of Detailed Information

To effectively hack an organization or victim, one must gather extensive information (A to Z) about them. While Module 2 provided essential insights, today’s session will delve into more advanced techniques related to network scanning that can yield significant information.

Live Session Updates and Engagement

Addressing Missed Live Sessions

A common question arises regarding missed live sessions: they occur every Sunday around noon or approximately 10 AM. Notifications are shared a day prior on Telegram and Instagram regarding the exact timing of these sessions. Regular viewers should stay updated for live interactions.

Commitment to Content Delivery

There are concerns among students about whether the instructor will complete all modules without interruption. The instructor reassures that regardless of view counts, all modules will be taught professionally and made available for free within YouTube's policy constraints. Satisfaction in providing international content is expressed due to its reach across various countries including Australia and Indonesia.

Global Reach and Community Building

Positive Feedback from International Viewers

The instructor shares excitement over receiving positive feedback from viewers in foreign countries who appreciate the videos' quality and express interest in collaboration or paid courses with him due to their engagement with his content across different languages. This reflects a growing global audience appreciating Indian cybersecurity expertise rather than negative stereotypes associated with hackers from India or neighboring countries like Pakistan and Bangladesh.

Encouragement for Community Participation

A link is provided in the description for joining a discussion group on Telegram where learners can share knowledge, discuss problems, and submit homework assignments tagged with @CyberMindSpace for review by the instructor—encouraging active participation among students while fostering community learning dynamics.

Motivation Against Quitting

Persistence Through Challenges

Students are encouraged not to quit despite potential decreases in viewership through subsequent modules; many may drop out as they progress through the course material but persistence is key for success in this field—highlighting that competition diminishes as others leave the program early on while emphasizing commitment until reaching Module 20 where job acquisition strategies will be discussed further along with interview preparation tips.

Commencement of Network Scanning Techniques

Introduction to Practical Ethical Hacking Course

Transitioning into practical applications, participants are welcomed back onto their computer screens as they begin exploring network scanning techniques within this unique ethical hacking course designed by Cyber Mind Space—emphasizing involvement in cybersecurity revolution efforts while aiming not just to be targets but skilled professionals capable of protecting systems effectively against threats ahead.

Introduction to Ethical Hacking Course

Overview of the Course Structure

The course includes practical labs after each module, with homework assignments and discussions on Telegram.

Weekly Q&A sessions are held on YouTube every Sunday, providing additional support and resources.

Key topics covered include types of scanning, network scanning, vulnerability scanning, TCP/IP basics, and ICMP.

Types of Scanning

The session will cover various scanning techniques such as SYN scan and ACK scan.

Understanding live host discovery methods like ping sweep and ARP scan is essential for ethical hacking.

Importance of Network Scanning

Network scanning identifies active devices, open ports, running services, and vulnerabilities within a network.

It helps ethical hackers map networks to find potential entry points for further testing and exploitation.

Significance in Security Assessment

Network scanning assists in identifying attack surfaces crucial for security assessments and audits.

It's critical for penetration testers to gather information before conducting tests or hunting bugs.

Understanding Port Scanning

Definition and Purpose

Port scanning is used to discover open, closed, or filtered ports on a target system.

It helps determine which services are running behind those ports by identifying common protocols associated with specific port numbers.

Common Protocol Examples

Understanding Port Scanning and Network Security

Introduction to Port Scanning

The discussion begins with identifying open ports on an IP address, which helps in detecting services like Apache and MySQL running behind a firewall. Tools such as Nmap, Netcat, and Masscan are mentioned for discovering ports.

Practical Application of Theory

The speaker emphasizes the importance of practical application alongside theoretical knowledge. They plan to demonstrate practical exercises after covering some theory.

Real-World Analogy of Port Scanning

A hotel corridor analogy is used to explain port scanning: checking door handles without entering rooms represents how one checks for open ports on the internet.

Example of a Pen Test Scenario

During a penetration test, a hacker runs a port scan on an office printer, revealing an unsecured web interface that allows unauthorized printing commands.

Understanding Network Scanning

Network scanning is defined as discovering live devices within a network. It helps build a map of infrastructure crucial before targeting individual systems.

Goals of Network Scanning

The primary goal is to find active IP addresses and devices. Knowing which devices are operational is essential for effective scanning and potential attacks.

Tools for Identifying Active Devices

Tools like Nmap, Angry IP Scanner, and ARP Scan are highlighted for gathering basic network information about active devices.

Real-Life Analogy for Network Scanning

The analogy continues with knocking on doors in a neighborhood to see who is home; this reflects how network scanning identifies available hosts in the network.

Total Number of Ports Available

There are 65,535 total ports available for scanning. Each port can be checked individually to determine its availability status.

Case Study: College Student's Wi-Fi Scan

A college student scans the hostel Wi-Fi and discovers hidden device names leading him to trace back to staff rooms where professors have set up private networks for faster downloads.

Vulnerability Scanning Explained

Definition of Vulnerability Scanning

Vulnerability scanning aims at identifying weaknesses or flaws in security measures. It’s compared to lightly pushing open an unsecured door indicating vulnerabilities exist.

Tool Utilization in Vulnerability Assessment

Understanding Vulnerabilities and TCP/IP Basics

Introduction to Tools for Identifying Vulnerabilities

The speaker introduces tools that help identify vulnerabilities in targets by analyzing their configurations.

Mention of a popular tool called Nessus, which is used for vulnerability scanning.

Emphasizes the importance of mapping weaknesses and entry points after conducting a port scan.

Hacking Process Overview

The speaker explains that hacking is not straightforward; it requires time and understanding of systems.

Discusses the significance of TCP (Transmission Control Protocol), highlighting its role in establishing reliable connections between clients and servers.

TCP Connection Mechanics

Describes how a TCP connection is established through a three-way handshake process, ensuring communication reliability.

Stresses the need for understanding responses from the target server during an attack attempt.

Internet Protocol Fundamentals

Introduces IP addresses as essential identifiers for sending packets across networks, comparing them to home addresses.

Explains IP spoofing as a common tactic used by attackers to disguise their identity while executing attacks.

Types of IP Addresses

Differentiates between public and private IP addresses, explaining their visibility and usage in networking contexts.

Provides examples of IPv4 address formats, emphasizing the importance of recognizing different types of IP addresses in cybersecurity.

Conclusion on Networking Concepts

Understanding IP Configuration and Subnetting in Networking

Basic IP Configuration Commands

To find your IPv4 address, open the CMD command prompt and type ipconfig. This is essential for tasks like Wi-Fi hacking.

Use the command curl ifconfig to find your public IP address. This can be done easily on Kali Linux by checking your IP configuration.

Importance of Subnetting

Subnetting involves dividing a network into smaller segments, akin to creating neighborhoods within a large city. This helps manage numerous IP addresses effectively.

By subnetting, attackers can understand the size of a network and identify how many devices are connected under a specific IP address.

Network Device Identification

Knowing subnetting allows hackers to determine which devices are connected to an IP address, such as printers or routers, enhancing their understanding of the network structure.

Subnetting provides insights into device types associated with specific IP addresses, aiding in targeted attacks.

Scanning Techniques

Hackers can discover target ranges using simple commands that show subnets (e.g., 192.168.0.0/24), indicating how many devices can connect (up to 254).

If you see /24, it means there could be up to 254 hosts connected; understanding this is crucial for effective scanning.

Practical Example of Hacking Scenario

A hacker scans an IP range with /24, identifying various devices like routers and printers within that range.

The next step involves attempting default credentials on identified devices (like cameras or routers), showcasing practical application in real-world scenarios.

Broader Implications of Hacking

Understanding ICMP and Network Scanning Techniques

Introduction to ICMP

The speaker discusses the importance of understanding theoretical concepts before moving on to practical applications, particularly focusing on ICMP (Internet Control Message Protocol).

ICMP is likened to an "internet doorbell," where a ping command checks if a host is alive by sending requests and receiving replies.

Practical Demonstration of Ping Command

A demonstration of the ping command using ping www.google.com shows that all packets were sent and received with 0% loss, confirming that Google’s server is live.

The concept of traceroute is introduced, explaining how it tracks the path packets take through various hops in the network.

Understanding ICMP Types

Explanation of different ICMP types: Type 8 represents echo request, while Type 0 signifies echo reply. These are essential for understanding how pings work.

Real-life attacks can exploit IoT devices that do not block ICMP packets; attackers can use ping sweeps to find IP addresses of vulnerable devices.

Defensive Strategies Against Attacks

Discussion on defensive strategies against potential attacks includes using VPNs, firewalls, and subnetting to fragment networks for better security.

Emphasis on disabling external ICMP as a defense mechanism against hackers who might use ping sweeps.

Homework Assignment: Using Nmap

The speaker assigns homework involving Nmap, instructing viewers to download Metasploit 2 and use it alongside Linux for network scanning.

Instructions are provided for downloading Metasploit from specific websites and extracting it for use in virtual machines.

Overview of Nmap Usage

An overview of logging into Metasploit is given, highlighting its role as a vulnerable machine used for testing IP addresses.

Viewers are encouraged to check their own IP address using commands like ifconfig within Kali Linux before proceeding with Nmap scans.

Conducting Network Scans

The speaker explains how to perform a ping scan using Nmap with the command nmap -sn, which helps identify active devices in local networks.

Understanding Network Scanning Techniques

Basics of Ping Scanning

The speaker explains the concept of a ping scan, indicating that it checks if an IP address (e.g., 18.16.131) is active by sending a ping request.

A successful ping scan reveals that one host is up, confirming the presence of a vulnerable machine running Metasploit.

Essential Tools for Network Scanning

The speaker emphasizes mastering Nmap and its command-line interface as crucial for effective network scanning.

Other important tools mentioned include Fping for fast pings, Traceroute for path tracing, and subnet calculators for determining subnet masks.

Introduction to Port Scanning

Port scanning is described as "knocking on digital doors" to identify which services are running on specific ports (e.g., HTTP on port 80).

Hackers aim to discover open ports and the services running on them to find potential vulnerabilities.

TCP Connection Establishment

The discussion transitions into TCP full scans versus half-open scans, explaining how hackers can determine open or closed ports based on packet responses.

When a SYN packet is sent to an open port, it receives a SYN+ACK response; if closed, it returns an RST packet.

Practical Examples of Port Responses

An analogy illustrates how hackers probe networks: sending SYN packets and interpreting responses helps them understand port statuses.

If no response is received after probing, it may indicate that the port is filtered or not responding at all.

Real-Life Analogies in Networking

The speaker uses analogies like knocking on doors to explain how hackers interact with network services through packet exchanges.

Different types of responses (SYN+ACK vs. RST packets) help determine whether a service is available or if access has been denied.

Conclusion: Effective Use of Nmap Commands

To effectively scan networks while remaining undetected, using commands like nmap -ss with target IP addresses can be beneficial.

Understanding Nmap Scanning Techniques

Initial Setup and Command Execution

The speaker demonstrates logging into a system and executing an Nmap command to scan an IP address (192.168.26.131). An error message appears indicating a failure to resolve the source address.

Command Syntax and Importance of Accuracy

A mistake in typing commands is highlighted, emphasizing the difference between -sn and -ss switches in Nmap. Correct command usage is crucial for successful execution.

Scan Results Interpretation

After running the correct command, the scan report shows that port 21 (FTP service) is open while other TCP ports are closed. This indicates which services are running on specific ports.

Understanding Open Ports and Security Implications

The focus shifts to identifying open ports and their associated services, with an emphasis on understanding security vulnerabilities related to these open doors.

Firewall Detection through Scanning Techniques

The speaker explains how sending ACK packets can help determine if a firewall is present based on whether responses are received or not, illustrating hacker strategies for bypassing firewalls.

Analyzing Responses from Firewalls

If no response is received after sending ACK packets, it suggests that a firewall may be blocking access. Conversely, receiving a reset packet indicates no firewall presence.

Practical Examples of Firewall Interaction

The discussion includes practical examples where hackers can infer firewall presence based on response types from sent packets, showcasing their clever tactics in network scanning.

Unfiltered vs Filtered Port Statuses

The distinction between unfiltered and filtered port statuses is explained; unfiltered means no firewall interference while filtered indicates potential blocking by firewalls.

Real-Life Analogies for Network Scanning

A relatable analogy compares sending messages over WhatsApp to checking if a house exists or if there’s a security guard (firewall), making complex concepts more understandable.

Executing Advanced Nmap Commands

The speaker prepares to execute advanced Nmap commands using both small 'a' and capital 'A' options along with target IP addresses for comprehensive scanning results.

Summary of Scan Outcomes

Understanding X Scan Techniques

Introduction to X Scan

The concept of decorating a Christmas tree is used as an analogy to explain the use of flags in network scanning, specifically focusing on FIN, PSH, and RST flags.

If a port shows a response status of "open" or "filtered," it indicates that no response was received from the target.

Real-Life Analogy for Scanning

An X scan can be likened to ringing a doorbell or throwing stones at someone's window to check if anyone is home; it's about probing multiple access points.

The goal is to identify which ports are open and whether any firewalls are present that might block access.

Practical Demonstration of Scanning

A practical demonstration using Nmap with the command nmap -sX 168.26.131 illustrates how an X scan reveals various filtered TCP ports like FTP, SSH, Telnet, SMTP, and HTTP.

The results show numerous closed ports and reset responses indicating active filtering mechanisms.

Using Wireshark for Analysis

Wireshark is introduced as another tool for monitoring network traffic during scans; it provides insights into requests sent during different types of scans.

The session highlights how various flags (FIN + PSH + RST) are utilized in these scans and what they signify regarding network security.

Understanding Null Scan

A null scan sends packets without any flags set; if a port responds with RST, it indicates closure while no response suggests potential filtering by stateful firewalls.

This method can be visualized as leaving a note at someone’s door: if removed, it indicates someone is home; if left untouched, it may suggest no one is there.

Conclusion on Scanning Techniques

Various scanning techniques such as SYN scan and NULL scan are discussed along with their effectiveness in detecting open ports and firewall presence.

Discovering Live Hosts in a Network

Importance of Discovering Live Hosts

The process of discovering live hosts is crucial for identifying which devices are online and reachable within a network before conducting further scans, such as port scans.

Without live hosts, hacking attempts become futile; understanding the active devices in a network is essential for hackers to plan their actions effectively.

Techniques for Discovering Live Hosts

Ping Sweep: This technique involves sending ICMP echo requests to multiple IP addresses and waiting for replies to determine which devices are alive. It acts like a roll call in the hacker's toolkit.

Commands like nmap -sn or fping -a can be used to perform ping sweeps efficiently, allowing users to identify active devices on the network.

Scanning Methods Explained

When using Nmap, it’s important to use the correct syntax with small 's' followed by capital letters (N, T, V), ensuring accurate command execution.

The analogy of shouting into a dark alley illustrates how receiving any response from an IP address indicates that at least one device is operational within that subnet.

Understanding ARP Scans

An ARP scan utilizes Address Resolution Protocol (ARP) within local area networks (LAN). It helps map IP addresses to MAC addresses, providing insights into device identities on the network.

ARP scans can still function even if ICMP traffic is blocked, making them reliable for local network discovery with high accuracy.

Practical Steps for Conducting ARP Scans

To perform an ARP scan, commands should be structured correctly. For example: sudo arp-scan 192.168.x.x/24, where you replace 'x' with your specific subnet details.

Users are encouraged to actively engage with the material by typing out commands rather than passively watching videos; this hands-on approach enhances learning retention.

Homework Assignment

Understanding Banner Grabbing Techniques

What is Banner Grabbing?

Banner grabbing refers to the technique of gathering information about a service running on an open port, such as identifying the software version and operating system type.

Hackers utilize banner grabbing to extract details like software versions and potential vulnerabilities that can be exploited.

Types of Banner Grabbing

Passive vs. Active Banner Grabbing

Passive Banner Grabbing: Involves no direct interaction with the target; instead, it uses sniffing tools (e.g., Wireshark, TCPDump) to gather information quietly.

Active Banner Grabbing: Involves sending requests to services and reading their responses. This method is faster but carries a risk of detection.

Tools for Banner Grabbing

Commonly Used Tools

Tools like Telnet, Netcat, Nmap, and Curl are commonly used for performing banner grabbing effectively.

Each tool has its specific use case; for example, Telnet can be used to connect directly to a service and retrieve its banner.

Practical Demonstration of Tools

Using Telnet for Banner Grabbing

To perform banner grabbing using Telnet, you would enter the command followed by the IP address and port number (e.g., telnet <IP> 80), which reveals server details like version numbers.

Using Netcat and Curl

Netcat can also be employed similarly by typing nc <IP> <port> to get service information quickly.

Curl allows users to fetch HTTP headers using commands like curl -i http://<IP> which provides insights into web services running on that IP.

Advanced Techniques with Nmap

Scanning Services with Nmap

Nmap can be utilized for more comprehensive scans by using flags such as nmap -sV <IP> which identifies running services along with their versions.

Understanding Ethical Hacking and Vulnerability Assessment

The Value of Ethical Hacking Courses

The speaker discusses the ethical implications of selling hacking courses, emphasizing that many students feel they receive little value for their investment, often spending large sums without gaining practical knowledge.

Technical Insights on Network Services

A detailed examination of open services on a network is presented, highlighting the presence of FTP services and potential vulnerabilities associated with specific versions like VSFTPD 2.3.4.

Banner Grabbing Explained

The concept of banner grabbing is introduced, which involves identifying running services and their versions to assess vulnerabilities. This technique helps hackers find exploitable weaknesses in systems.

Exploitation Based on Version Information

Hackers search for exploits based on service versions identified through banner grabbing. This process includes downloading payloads and utilizing resources like GitHub to exploit vulnerabilities effectively.

Mitigating Risks from Banner Grabbing

Strategies to prevent unauthorized information gathering through banner grabbing are discussed, including disabling server banners in Apache and using firewalls to restrict access.

Importance of Network Mapping Tools

Nmap is described as an essential tool for hackers, functioning as a "Swiss Army knife" for discovering live hosts, scanning ports, detecting services, fingerprinting operating systems, and finding vulnerabilities.

Fast Scanning with Nmap

Introduction to Fast Scanning

The speaker introduces the concept of fast scanning using Nmap, which scans 100 ports quickly.

A command is demonstrated: nmap -f followed by an IP address, indicating familiarity with the command syntax.

The scan results show that 82 TCP ports are closed, highlighting the speed of the scan (completed in 20 seconds).

Specific Port Scanning

To scan specific ports, the speaker suggests using nmap -p, specifying port numbers like 80 (HTTP) and 443 (HTTPS).

The output indicates whether these ports are open or closed and identifies running services.

Understanding Service Numbers

The importance of knowing service numbers for various protocols is emphasized; this knowledge aids in network reconnaissance.

The speaker explains stealth scanning, which avoids detection by firewalls. This method uses TCP SYN packets to probe without establishing a full connection.

Advanced Scanning Techniques

Stealth Scan Implementation

A demonstration of a stealth scan is provided using nmap -SS followed by an IP address to gather information without alerting firewalls.

Various options for aggressive scanning are discussed, including nmap -A for detailed detection and OS identification.

OS Detection Process

The process for detecting operating systems involves logging into Kali Linux and executing commands like nmap -O.

Results reveal details about devices on a network, such as their operating system type (e.g., Linux), which can indicate vulnerabilities.

Practical Applications and Security Tips

Identifying Vulnerable Devices

If outdated devices (like those running Windows XP or Windows 7) are found during scans, they may be more susceptible to exploitation.

Module Learning Overview

An overview of what has been learned in Module One is provided, emphasizing basic commands and footprinting techniques before moving on to advanced topics.

Combining Scans for Efficiency

Mixed Scan Strategies

Combining different types of scans (nmap -S with small flags for version detection and OS identification).

Real-Life Scenario Application

A practical example illustrates how to use Nmap in real-life scenarios like assessing Wi-Fi networks at public places.

Best Practices for Ethical Hacking

Cautionary Advice

A pro tip advises against blind scanning on the internet; always test within controlled environments where permission has been granted.

Efficient Scanning Techniques

Recommendations include focusing on top ports during scans and utilizing timing flags (T4) for faster results while maintaining accuracy.

Introduction to Zenmap

GUI Version of Nmap

NMAP and Zenmap: Mastering Network Scanning

Introduction to NMAP and Zenmap

The speaker emphasizes that memorizing all commands is not necessary; mastering NMAP is the priority before using Zenmap.

Zenmap provides a GUI version of NMAP, making it easier for users who may struggle with command-line inputs.

Using Zenmap

To start using Zenmap, type "Zenmap" in the terminal after pressing Control + L. This opens the interface.

Users can input target IP addresses (e.g., 192.168.26.131) and select scan profiles like "Intense Scan" for comprehensive scanning.

The tool automatically detects commands for various scans, providing detailed information about services running on hosts.

Understanding Scan Outputs

The output reveals critical details such as which services are running on specific ports (e.g., SMTP on port 25).

Key terms include:

T4: Fast timing option.

A: Aggressive scan mode.

V: Verbose mode, which shows step-by-step progress during scanning.

Firewall Evasion Techniques

The discussion transitions to firewall evasion techniques, likening firewalls to bouncers at clubs that restrict access.

Firewalls can block responses during scans, preventing attackers from determining if devices are live or offline.

Strategies for Bypassing Firewalls

Evasion techniques aim to conduct scans without triggering alarms:

Fragmentation: Breaking packets into smaller pieces to confuse firewalls.

Timing manipulation: Sending packets slowly to avoid detection.

Advanced Evasion Techniques

Additional methods include:

Decoy scanning with fake IP addresses to mask real ones.

Source port manipulation by using common ports like DNS (53), allowing stealthy entry through firewalls.

Practical Application of Commands

Examples of commands for practical application:

For fragmentation scans: nmap -f <target_ip>

For source port bypassing: nmap --source-port <port_number> <target_domain>

Understanding Hacking Techniques and Learning Resources

Importance of Concise Video Content

The speaker emphasizes the need for a fast-paced delivery to avoid lengthy videos, which may lead to viewer disengagement.

The goal is to make notes comprehensive enough that viewers can benefit from them even without watching the video.

Key Concepts in Hacking

Scanning is highlighted as a crucial skill in hacking, focusing on reconnaissance rather than just hacking itself.

A skilled hacker gathers all necessary information before executing any moves, applying various techniques effectively.

Tools and Techniques Learned

The speaker mentions several tools learned during the session: banner grabbing, Nmap, and Zenmap.

Mastery of Nmap is particularly stressed as essential for effective scanning and hacking practices.

Practical Applications of Skills

Understanding how to scan domains or IP addresses is vital for practical applications like bug bounty hunting.

The speaker encourages viewers from different educational backgrounds to utilize available resources for learning hacking skills.

Community Engagement and Future Learning

Viewers are invited to share their thoughts on shocking moments from the content and suggest improvements.