[Applause]
[Music]
[Applause]
[Music]
hey guys hackersploit here back again
with
another video and welcome back to the
metasploit course
uh now in this video we're going to be
looking at information gathering with
the metasploit framework uh more
specifically the metasploit console
all right uh so let's get started now uh
just a prerequisite i have a virtual
machine
i have the metasploitable 2 virtual
machine running and i'm just going to be
using it
as a kind of a target system for
illustration purposes
you know i like to create a lab and
that's what keeps my videos
you know stay within the range of
legality
so again i'm just demonstrating how this
all works
all right so information gathering more
specifically for example
we can look at using the nmap we can
look at using
uh how to use nmap to perform port
scanning we can look at how to scan for
ssh services so we look at all of that
so you might be confused and you might
be asking yourself well how is this
even possible right now again
using a framework like metasploit to
perform in information gathering kinds
of
uh it it tends to keep things in a more
in a modular modularized fashion all
right now what i mean
is uh is let's say you're dealing with a
target
directly all right so this is a
fantastic way of using
uh for frameworks like nmap for example
to perform
uh spot scanning in this case which will
which is what we're gonna do
all right so i already have my
metasploit uh
the msf console open here and it's
really very simple right like if i
wanted to perform an nmap scan
let's say we had uh we we already have a
target
right and uh again i'm going to use the
metasploit 2
ip address here so let me just get that
up again it is
bridged to my adapter so there we are
192.168.1.107
okay so that is going to be the bridged
its bridge to my
its bridge to my network that means
they're all going to be on the same
network
all right so for those of you having
trouble with that that's how to fix that
issue where you can detect it on the
same network
all right so i could perform a simple
port scan on nmap so i would say nmap
just as you would
all right nmap and then i would use the
commands s and capital t
what these commands do i'm pretty sure
you already know them
it it initiates the three-way handshake
and will essentially just detect the
open ports
on the target machine now the target
machine being metasploitable
too it'll have a lot of open ports all
right so
192 0.168.1.107
okay and we're going to start that and
it'll just open up
the nmap um framework and there we are
those are the results
so you can see all the ports that open
probably all of them we have the
ftp ssh telnet uh you have your
you know your login your mysql etc etc
right now that's pretty cool you know
that we can actually use the nmap
um the nmap framework in information
gathering
right so i'm pretty sure you guys
already know
how to uh how to use nmap but i'm going
to show you one more comment because
a lot of people ask me this and this is
when a site has probably a firewall and
you want to perform a stealth scan
all right so a stealth scan essentially
allows you
um what it will do is
really it will give you a connection
between the target and the scanner
all right so it will give you uh
you know the ability to to perform it in
a more promiscuous manner
while still maintaining uh maintaining
um how i don't know how to explain this
it'll not do it in a
in more of a direct way so probably the
target will not recognize it
so much as a scan all right so in order
to do this
uh we're going to obviously use the end
map and uh it's
we use the commands the ss all right so
a small s and a large s i'm pretty sure
if you're familiar with the syntax you
know
this means and again we'll just target
the system
and again uh misplayable to not being
you know very very secured it should
return us
there we are really really quickly all
right so
that's if you want to perform a stealth
scan all right so that's very very
interesting
now looking at the other type of
information gathering that we can
you know carry out we can actually use
auxiliaries uh we can use the auxiliary
modules
uh or the scanner modules that come with
metasploit all right
so you might be asking yourself well you
know what
what do you mean exactly well what i
mean is we can actually use
uh the inbuilt modules that come with
metasploit or you know in
in in the form of auxiliaries where
where you have your scanners as
explained in the previous video they
allow you to use the inbuilt
scanners which are considered to be
information gathering tools
now probably not a lot of you guys have
actually used this and that's fine
you know it's really really very simple
to do and that's what we're going to do
now
all right so what we're going to do is
i'm going to
demonstrate this let me just clear the
console i'm going to demonstrate this
very very simply uh using um
the ssh scanner all right so this is an
in-built scanner that comes with
metasploit
uh i'm pretty sure probably most of you
have gone through it it's a very
it's not you know very very early when
you're using the meta split
um the metasploit framework um all right
so essentially what it'll do it'll allow
you to detect
the ssh versions that are running on a
target okay
uh so if you don't know what ssh means
it's ssh is
secure shell all right it is essentially
uses
um it uses cryptography and
authentication
um you know to connect between two
computers as a connection between
two computers right so let's get started
now uh we're going to be using the
auxiliary called ssh version
uh all right so i'll show you how to do
this in a few seconds so
uh what we're going to do is we're going
to utilize the search command the search
command allows us to search for modules
uh
in this case we're using the auxiliary
and furthermore the scanner
all right so what we're gonna do is
we're gonna say search ssh
version all right search ssh version
and again you can start up the database
if you want to or the postgresql
database if you want to or if not uh you
can just you know
you you can just let it perform the
normal search which is again
it's just it's a slow search but
nonetheless it'll return
the the results that we want all right
so just give it a few seconds uh it
shouldn't take too much time at all
again you'd be much better off if you
started
up the database and you had it
properly configured right but i didn't
so i'm sorry about that
um again it shouldn't take too much time
in fact it's probably taking quite a
while now but
um the search results are pretty much
standardized there we are
so we have the search results now what
we're going to be using is the auxiliary
scanner because we don't want
fuzzers uh we already discussed what
those ones were we want these
auxiliary scanner all right so i hope
you guys remember the
uh the syntax so we're going to say uh
so this is the one we're going to be
using the auxiliary scanner ssh version
so what we're going to do is we're going
to use the
uh we're going to use the use
um we're going we're going to use the
use command to select that one right so
use auxiliary auxiliary
oops i should have actually just copied
it
and oops oh my
sorry about that guys let me just copy
it uh so just to keep things really
really simple because
even uh if it was a scanner it shouldn't
it should have actually
detected that itself so let me just
paste that in there
again a lot of people ask why i do that
with the mouse pointer and that's just
to
reinforce the idea of me actually
copying and pasting something because if
i did it with my keyboard
strokes some people would ask me what i
did and there's really not
it's not important that we go through
that so i'm going to hit enter
and there we are so let me just clear
that out and it's using the scanner ssh
ssh version
so essentially it's just together it's
getting information about
uh it's getting information about the
target in terms of what ssh version it's
running on the ssh port
all right so we can look at the options
that we have here
and as you can see the port is set to 22
which is the default
uh tcp port you have the threads which
is what we'll be looking at and the
timeout
so usually the timeout is pretty much
okay but we need to change the threads
and the r host
all right the r host is the target
address or the or a range so you can
actually use a range
okay but in this case we're not going to
use a range because again i only have
about three computers running on my
network right now so
you know it's probably gonna get only
like one of them because
my if my ssh ports are all closed on the
other computers
so let's set the r hosts like so
and i'm just going to use the
metasploitable 2 target machine 0.1.107
right and once that's done we want to
set the threads
to something quite uh high like
um something like a hundred yeah that
sounds about right
there we are and uh finally once we're
ready all you have to do is hit run
not exploit because we're not exploiting
anything that's also a mistake that many
many people make
is they actually go directly for uh you
know
for the exploit command so just hit run
and there we are immediately it's going
to return the results so
on that on the metasploitable 2 machine
we have the ssh version running ssh
version 2.0 open ssh it's running ubuntu
and the version number is written there
and again this
can be valuable information you know you
could find exploits related
to the version of ssh running and that's
for the exploitation stage
which we'll be getting to but it's
important to know how to use the
metasploit um
how to use the metasploit framework in
any way
whether it's the metasploit console or
you're using
the other frameworks the gui frameworks
right so there's a lot of other
things that you can do with in terms of
information gathering you can also use
you can also search for the ftp version
and you can look at other things like
sweeping and
banner grabbing but really that i'm sure
if you've done it before
uh you know you know with hacking you
learn
information gathering first and you
learn about all the frameworks for
gathering information
so i just wanted to show you how to
utilize the uh auxiliary
module where you can use scanners or
fuzzers for that matter to gather
information about your target
it's really really very interesting so
that's gonna be it for this video i
thought i'd give you a bit of an
introduction and
you know just move you around how to use
all of these
in a modularized way to perform
individual tasks right
so i hope you guys found value in this
video if you did please leave a like
down below
if you have any questions or suggestions
just let me know in the comment section
or you can hit me up on my social
networks
and uh you know for the latest version
or for the documented version
of this uh of this video you can check
out my website
hsploit.com is the latest hacking news
there and you can also get tutorials
you know different pdfs uh guides just
guiding you on your way
as you learn hacking and yeah thank you
so much guys for watching this video
thank you so much for the support i
appreciate it
and in the next video we'll be looking
at how to use
nieces all right so thank you so much
for watching and i'll be seeing you
in the next video peace
[Music]
you