-: Information gathering is one of the most important steps 2 2
when it comes to hacking or penetration testing. 3 3
If you think of it, you can't really gain access to a system 4 4
if you don't have enough information about it. 5 5
So, for example, let's say you're connected to a network 6 6
and one of the devices connected to this network 7 7
is your target. 8 8
Now for you to hack into that target, 9 9
first you need to discover all of the connected clients 10 10
to this network, get their MAC address, their IP address, 11 11
and then from there try to maybe gather more information 12 12
or run some attacks in order to gain access to your target. 13 13
Now, there are a number of programs 14 14
that will do this for you. 15 15
Examples are NetDiscover and Nmap, 16 16
which do this job really, really well. 17 17
So in this lecture, we'll start with the simpler one, 18 18
which is NetDiscover and see how to use it to quickly map 19 19
the network we're connected to. 20 20
And in the next lecture, 21 21
I'm gonna show you how to use Nmap 22 22
to gather detailed information about all 23 23
of the clients connected to the same network. 24 24
So, I have my Kali terminal in here, and if I do ifconfig, 25 25
you'll see I have eth0, it has an IP address. 26 26
And like I said, this is the virtual interface created 27 27
by VirtualBox when we set the Kali machine 28 28
to use a NAT network. 29 29
Now, I also said that this NAT network behaves exactly like 30 30
an Ethernet network. 31 31
And as far as the Kali machine is concerned, 32 32
it thinks that it is connected to a real wired network. 33 33
And as you can see in here, 34 34
it's telling me that wired connected. 35 35
Now, I have my virtual Windows machine right here. 36 36
It is configured to use the same NAT network 37 37
as the Kali machine. 38 38
Remember, we're still in the network hacking section, 39 39
so both you and the target machine need to be connected 40 40
to the same network. 41 41
So as far as these two computers are concerned, 42 42
they think that they are connected to the same network. 43 43
So what I wanna do right now is use NetDiscover 44 44
and see how we can use it to discover all devices connected 45 45
to the same network. 46 46
Now the method that I'm gonna show you 47 47
will work exactly the same, 48 48
whether you're using it against a virtual network, 49 49
like I'm doing right now, or against real network, 50 50
and even if your target is a Wi-Fi or a wireless network. 51 51
So all you have to do is type the name of the program, 52 52
which is NetDiscover, and then type dash r 53 53
to specify an IP range to search for. 54 54
This needs to be arranged that can be accessed by you. 55 55
So right now you can see that my IP is 10.0.2.16 56 56
and I can only access IPs on the same subnet. 57 57
So IPs on the same subnet start at 10.0.2.0, 58 58
and they would end at 10.0.2.254 59 59
because 254 is the last IP that a client can have. 60 60
So, my range is gonna be 10.0.2.1 61 61
and I wanna search for clients that might have an IP 62 62
of 10.0.2.1, 10.0.2.2, 10.0.2.3, 63 63
all the way up to 10.0.2.254. 64 64
So instead of manually typing all of these IPs, 65 65
I can just type over 24 66 66
and NetDiscover will automatically know 67 67
that I'm trying to search for all of the IPs 68 68
that start at 10.0.2.1 and end at 10.0.2.254. 69 69
So this is a way of specifying an IP range 70 70
for the whole subnet. 71 71
So if I hit enter now, you'll see that NetDiscover 72 72
will show me all the IPs of the devices connected 73 73
to the same network. 74 74
And note that the first three parts of the IPs 75 75
are always the same because they are on the same subnet. 76 76
And I also have the Mac addresses of these clients 77 77
and Net discovers also attempting 78 78
to guess the device vendor. 79 79
Now, if I press queue, this will quit the program. 80 80
And right now, we have a list of all the connected clients 81 81
to the same network. 82 82
Now, like I said, you can also use this method 83 83
to discover clients connected to the same Wi-Fi network. 84 84
The only thing is, right now, if I do ifconfig, 85 85
you can see that my Kali machine 86 86
does not have a wireless adapter, 87 87
it's not connected to a Wi-Fi network. 88 88
And like I said before, 89 89
you cannot access the built in wireless card 90 90
from a virtual machine. 91 91
Therefore, if you want to do this 92 92
or run any of the wireless attacks that we're gonna see 93 93
in the future against a real computer 94 94
and a real wireless network, 95 95
you're gonna need to use a wireless adapter. 96 96
Now, I'm gonna include links in the description 97 97
that will help you pick a good adapter 98 98
that works with Kali Linux. 99 99
But right now I actually have one, 100 100
and I'm just gonna connect it 101 101
and use it just to prove to you, 102 102
if things work on the virtual machines connected 103 103
to the virtual network, 104 104
they will work exactly the same against a real network 105 105
with real machines. 106 106
So, I'm gonna connect my adapter now. 107 107
And if I do ifconfig, it's still not showing up, 108 108
so I'm gonna connect it from my devices, USB, 109 109
and click on the adapter name, 110 110
and let's see if it shows up now. 111 111
Perfect, as you can see, I have an adapter now called Lan0. 112 112
And what I'm gonna do is, 113 113
I need to connect this adapter to a Wi-Fi network first 114 114
before I can discover all the connected clients 115 115
to this network. 116 116
So I'm gonna go to my network manager, 117 117
I'm gonna click in here 118 118
and you wanna click on Select Network. 119 119
And as you can see, automatically now, 120 120
it's actually connected to a network. 121 121
But in your case, you'd wanna select a network 122 122
and click on Connect, 123 123
and then it will ask you for the password. 124 124
So now I'm actually connected 125 125
and you'll see if I do ifconfig again. 126 126
Right now, lan0 has an IP address. 127 127
So this means that it is connected to a network 128 128
and this means that we can use it now with NetDiscover. 129 129
So again, I'm gonna use the exact same command 130 130
that I used before just to show you and prove to you 131 131
that if this works against virtual machines, 132 132
it will work against real machines. 133 133
And the only difference is going to be the IP. 134 134
So I'm gonna remove this IP. 135 135
And as you can see right now, my IP is 192.168.1.8. 136 136
So therefore, the range that I'm gonna look 137 137
for is gonna start at 192.168.1.1, 138 138
and I'm gonna leave the over 24 here 139 139
because this will tell NetDiscover that I want to start 140 140
at 192.168.1.1 and finish at 192.168.254. 141 141
So if I hit enter now. 142 142
Now, this did not work and I know why. 143 143
In order for this to work, 144 144
you actually have to disable the NAT network. 145 145
So to disable the NAT network, we're gonna go on devices, 146 146
we're gonna go on network, 147 147
and we're gonna uncheck the Connect Network Adapter. 148 148
So now once done with this, 149 149
if we just run the exact same command again. 150 150
As you can see, it's discovering all the connected clients, 151 151
all their IP addresses, all their MAC addresses, 152 152
and it's guessing the manufacturer, 153 153
and you can see it's also discovering 154 154
some Apple devices here. 155 155
So as you can see, 156 156
it's working perfectly using the exact same command. 157 157
Now, I only did this just to show you 158 158
that if things work against virtual machines 159 159
and I guess virtual networks, 160 160
then they will work against real machines 161 161
because these virtual machines and virtual networks 162 162
are modeled of a real machines. 163 163
And as far as the machines are concerned, 164 164
they actually think they are real computers 165 165
and real machines.