So next up on the list are our network enumeration commands.
And I was going to throw a few at you for now.
We're going to explain why they're important.
So again we're going to go ahead and enter into a shell.
And let's take a look at some of them.
The first may be obvious but we're going to run an IP config.
Now we can run the IP config and see what the IP address is of the machine.
We can also get more details by running IP config slash all and seeing a little bit more information
than we did before.
We can see the default gateway we can see the DNS servers etc..
So this just provides information on the architecture.
We might even see something like If I run a domain we might see the domain controller here as a DNS
server or just give us a little bit more information as to where our next attack might be what our subnet
structure is etc..
So important to know.
Another thing that we're going to look at is we're going to look at our ARP tables so we can just say
something like our dash a four hour dash all.
And this won't be that big on most CTF machines but if you're in a lab environment there's a chance
that you might see another IP address here.
So we see two in two fifty five.
Chances are this is a broadcast I.D. and maybe this is your network I.D. here.
It's hard to say without knowing for sure.
But we know we're a dot five.
Actually yes our DOT too is our DNS server.
So we know we're talking to DNS and then we have a dot five which is us maybe we saw like a dot six
or seven or dot seventy five whatever if we saw another IP address in here I would be instantly suspicious
as to why it's in our ARP table especially in a lab environment and how it's communicating with us and
what we can do about it.
So if you're not familiar with these networking protocols then you're probably need to brush up on what
ARP is or where IP config is etc. Those aren't gonna be taught in this course but we should be looking
at the art table.
We should also be looking at the routing table something like a click route print will tell us where
this is communicating as well.
So we're interested in seeing the 10 address and you could see the 10 10 dot 10 10 five.
There's not like another network on here.
Same thing with the IP config by the way.
Sometimes you see dual homed IP addresses where there's a tend not hand that tend to and maybe you would
have something like a 10 not 10 not 10 or 10 not 10 to eleven not two or something like that or dot
five.
We would see a second Nick on this machine and that would mean that this is communicating on one address
and then communicating on another address.
And maybe we don't even need to elevate we just need to pivot on this machine.
So there's a lot of different reasons for looking at what's going on here.
Same thing with the ARP table.
That's another thing if we're communicating to another machine that's important to know the routing
table same thing and then net step is super important close to a net stat dash you know and see what
ports are out there.
We should know you know where are we talking to.
Who are we communicating with.
Well we could see we're communicating with us over this 4 4 4 4 and that's an established connection.
But what about all these listening ports like we're listening on one thirty nine.
OK well we have all these other eyepiece here that we're listening on and how many of these actually
showed up when we were looking at the box originally.
Well not a lot of them.
Right.
We had twenty one in 80.
I didn't see any of these externally facing to us when we did a search.
So where are these ports coming from.
Here's UDP ports where are these ports coming from.
Why are we seeing them you know inside the box but we're not seeing them outside the box.
So maybe these services are only available to us from the inside network and that could be interesting
too because that could allow us maybe to do some sort of port forwarding using a tool like plank or
even interpreter can do it.
And that's just a foreshadowing of what you might see a little bit later on in the course.
So keep that in mind that these internal services are important as well.
So for now we've established that we need to do some basic enumeration.
We need to look at the systems we need to look at the users.
We need to look at the network just kind of gather what's around us before we just start going crazy
and looking around all the files and infrastructure.
Now when we get to the tool section I'm going to show you all the tools I can do this for us.
The next thing I want to show you before we move on and start looking at different tools and start talking
exploits is I want to show you how to do some basic enumeration hunting down passwords and then we'll
move on and start doing our actual exploitation and using tools and et cetera.
So I'll catch you in the next video and we start talking about hunting down passwords.