Nmap - Banner Grabbing

Key Takeaways

[Music] hello everyone welcome to this video in this video we're going to be taking a look at banner grabbing with nmap now banner grabbing as a whole is very important for penetration testers and for anyone who is doing any uh vulnerability analysis on a system or network right and if you're not already familiar essentially a banner or the process of banner grabbing is the process of essentially identifying uh the service version that is currently running on a particular port right so for example if i set up if i'm setting up a web server and i want to set up ssh i would install a piece of software right that would would actually act as my ssh would actually facilitate ssh connections a good example of this is openssh right so openssh is a is a piece of software that runs or will facilitate ssh communication on port 22. now as a penetration test if i'm performing a banner grabbing on that server and i'm performing banner grabbing on port 22 which is the ssh port what i'm likely to get is the banner of the service of the piece of software or the service version that is running so for example i would get open ssh so uh this is useful for two main reasons and it's it's quite similar to your service version enumeration however when performing manage grabbing manually uh when performing it uh you know in in sort of a direct manner without nmap filtering through the results and and sort of organizing it for us essentially able to get uh quite important beats uh bits of information and uh again that will be demonstrated shortly so this can be achieved by using a nmap script called banner and again i can perform a simple scan and let's say i wanted to perform a i will say sudo nmap and we'll run a simple tcp connect scandal the default scan right and we want to target let's see port 80 sorry port 22 and port 80 right and we then say script and that is going to be banner and then we specify our target in the case of this video we'll be using metasploitable 2. so uh 1.217 that is the ip on my network and we'll just hit enter right and let's uh let's take a look at the results and you'll see what i mean exactly right so we're only scanning about two ports so it should just display uh the two banners for us and it should tell us what what piece of software or and the version is running on these particular ports so for example um you can see that on port 22 here we are able to identify or to establish that we have open ssh 4.7 p1 and it's running we get an additional piece of information uh which is seems to be uh this this looks like an operating system banner it tells us we're running debian ubuntu right so ubuntu is a distribution that is based off debian so again we're able to tell all right that we we might be running debian or ubuntu but in most cases it's going to be ubuntu now if i perform the complete scan here right and i perform like a fast scan which is 100 of the most common ports let's hit enter of course this will take much more time and i'll just increase the uh the the actual scan speed here we'll hit enter let's run this right now and again we'll just wait for it to complete and then we'll take a look at the additional pieces of information that we're able to get and how it differentiates from you know something like uh like performing a service version scan and then of course the second bit of really important information is the fact that we can use these banners to perform vulnerability analysis or to perform a vulnerability scan on our network on our or on on our targets um so there we are you can see if we get all the ports that are really important we have ftp so you can see for ftp we are able to get the banner it tells us we're running vsftpd 2.3.4 for ssh open ssh for telnet we don't get a banner but a piece of shell code which is again it can be quite useful uh for smtp you can see that we get metasploit we get the actual domain name here and we can see it's post fix and it's running on ubuntu so we get another operating system banner leak there for the other services we aren't able to get any more banners but again for something like pro ftp for something that is running on port 2121 we can see we have pro f tpd uh running version 1.31 and it's running debian so again we're able to tell we're running debian or a debian based distribution for mysql uh you can see for the mysql server we actually get the banner here and it's part of the shell code which is great so we can see we're running version 5.0.518 a and it gives us the operating system banner so it tells us we're running ubuntu so on and so forth so again uh you know banner grabbing with nmap is very very important and can be very useful when when you're when you're trying to establish uh the accurate results and what nmap is getting back without it being filtered so again when performing service version detection nmap will typically filter the results and display things uh as appropriate as as appropriately as possible it'll not display things like shell code you know for service version or for the particular banners so that's pretty much all i wanted to cover in this video and i'll be seeing you in the next video [Music] you