Speaker 1: There's a certain thrill, isn't there in wheeling the power
Speaker 1: of text to command a computer?
Speaker 2: Oh?
Speaker 1: Absolutely, And when you apply that to security, well, it
Speaker 1: becomes this incredibly potent skill. Definitely. So today we're plunging
Speaker 1: into the world of Bash scripting for ethical hacking and
Speaker 1: penetration testing. We're really focusing on that crucial first phase reconnaissance.
Speaker 2: Yeah, the information gathering part.
Speaker 1: Our goal here is to distill the essential knowledge from
Speaker 1: some key materials. Understand exactly how Bash and as buddy
Speaker 1: tools are used to get that critical first layer of
Speaker 1: information about potential targets.
Speaker 2: And we're drawing from resources really aimed at security pros
Speaker 2: who want to harness Bash. It covers the whole setup too.
Speaker 1: Write things like setting up your environment maybe WSL, Windows
Speaker 1: Subsystem for Linux or Siguin, picking a.
Speaker 2: Text editor, and then getting into the Bash fundamentals, variables
Speaker 2: for storing data or raise for collections, understanding streams.
Speaker 1: Standard input output.
Speaker 2: Error, that kind of thing, exactly how commands talk to
Speaker 2: each other. These basics, they're the foundation for everything else
Speaker 2: we'll discuss.
Speaker 1: Okay, so environment sorted command line feels hopefully a bit
Speaker 1: less intimidating. Now the exciting part putting Bash to work
Speaker 1: for reconnaissance, and like any assessment, first job is figuring
Speaker 1: out who we're looking at, creating those target.
Speaker 2: Lists precisely the materials really stressed defining the scope clearly first.
Speaker 2: Are we talking specific IPS, whole networks.
Speaker 1: Or domain subdomains, that sort of thing.
Speaker 2: Exactly, And Bash actually gives us some well, surprisingly efficient
Speaker 2: ways to generate these lists.
Speaker 1: Okay, let's start with IPS. Say you need to hit
Speaker 1: a range like one seventy two point one six, but
Speaker 1: ten's part one up to dot two point four. Typing
Speaker 1: that manually is well not ideal.
Speaker 2: Definitely not. The sources show a few clever Bash stricks.
Speaker 2: One uses the c command inside of for loop.
Speaker 1: Okay, pretty straightforward, iterate the numbers output the IPS.
Speaker 2: It works, but they're usually quicker ways, right like Bash's
Speaker 2: brace expansion.
Speaker 1: Ah, yes, that's much shorter.
Speaker 2: Yeah, you could just do echo one seventy two point
Speaker 2: one since send down one point twenty five to four.
Speaker 2: That gives you a space separated list, but.
Speaker 1: You probably want them on separate lines for tools.
Speaker 2: Usually, Yes, so you pipe that echo command to says
Speaker 2: lines replace spaces with new lines.
Speaker 1: Simple, very neat and there was a third way, something
Speaker 1: with print.
Speaker 2: That's right, print line one seventy two point one six
Speaker 2: point one zero percent might be even cleaner.
Speaker 1: How does that work?
Speaker 2: The per scene is a placeholder for a number and
Speaker 2: integer Bash fills it in for each number in the braces,
Speaker 2: and the N automatically adds the new line. No extra
Speaker 2: formatting needed.
Speaker 1: Clever. Okay, so that handles IP ranges. What about finding subdomains?
Speaker 1: Organizations have tons of those.
Speaker 2: These days, they really do. The common strategy detailed is
Speaker 2: using a word list, you know, just a big text
Speaker 2: file with potential subdomain names like mail, ftpwww, dev, things
Speaker 2: like that exactly. Then the job is just sticking the
Speaker 2: main domain name onto the end of each word in
Speaker 2: the list. A standard Bash while read loop is perfect
Speaker 2: for this.
Speaker 1: So it reads a line say mail, then you echo
Speaker 1: mail plus dot example dot.
Speaker 2: Com yep if example dot com is your target. The
Speaker 2: material even points to an example word list on GitHub
Speaker 2: subdomains dash one thousand dot txt in the black Hatbash
Speaker 2: repo useful.
Speaker 1: Is there another way besides the loop?
Speaker 2: Yeah? They also mentioned using said directly. You can tell
Speaker 2: said to just appennthdomain dot example dot com to the end.
Speaker 2: Of every single line in the wordless file does the
Speaker 2: same thing, just a different command.
Speaker 1: Okay, makes sense. So we've generated our lists potential targets identified.
Speaker 1: Now we need to see which ones are actually you know,
Speaker 1: alive and kicking host discovery.
Speaker 2: Right, and the classic first check is ping, good old ping.
Speaker 2: But when scripting, you need those flags to stop it
Speaker 2: waiting forever nanac one for just one packet and timeouts yeah,
Speaker 2: nash to W one or natch w one to set
Speaker 2: a weight time maybe one second, so your script doesn't
Speaker 2: just hang there if a host is down or ignoring pings.
Speaker 1: Because they might ignore ICMP, right, firewalls.
Speaker 2: And stuff exactly. Ping uses ICM and lots of systems
Speaker 2: block it, so no ping response doesn't always mean the
Speaker 2: host is offline. It's a piece of the puzzle, but
Speaker 2: not the whole picture.
Speaker 1: So for the local network, ping might miss things. That's
Speaker 1: where arp scan fits in.
Speaker 2: That's right. Arpscan is great for your local segment. It
Speaker 2: works using ARP the Address Resolution Protocol Layer two stuff
Speaker 2: exactly layer two, so it can spot devices even if
Speaker 2: they're blocking pings higher up the stack. The command is
Speaker 2: like pseudo arpscan Network twenty four I interface.
Speaker 1: And the sources mentioned a specific lab setup.
Speaker 2: Yeah, they used republic as the interface on the one
Speaker 2: seventy two point one six zero point zero two four network.
Speaker 2: In their examples, the key is ARP works locally and
Speaker 2: can find hosts that ICMP might miss.
Speaker 1: And they even showed how to put ARP scan in
Speaker 1: a loop like to watch for new devices popping up.
Speaker 2: Yes, a while loop to run ARP scan periodically if
Speaker 2: it spots a new MSA address, it uses send mail
Speaker 2: to fire off an email alert.
Speaker 1: That's pretty cool. You set variables for known hosts the
Speaker 1: network who to email.
Speaker 2: It's a great example of automating basic network mode ing
Speaker 2: with just Bash and standard tools. Simple but effective.
Speaker 1: Okay, so we're building a picture of who's online. Next
Speaker 1: logical step, what are they doing? What services are running?
Speaker 1: Port scanning time exactly?
Speaker 2: And the big names here are NMP, the classic and
Speaker 2: maybe the faster rust scan for initial suitees.
Speaker 1: MAP is the powerhouse though right blows of options.
Speaker 2: Oh yeah, very versatile. The Decimey dis ray is highlighted.
Speaker 2: Service version detection super useful.
Speaker 1: Why is it so important.
Speaker 2: Because knowing the exact software and version running on a
Speaker 2: port lets you immediately look up known vulnerabilities for it speeds.
Speaker 1: Things up a lot, makes sense, and you can feed
Speaker 1: en map our target lists.
Speaker 2: Yep. The isile filum option takes your list like the
Speaker 2: one hundred and seventy two to sixteen to ten hosts
Speaker 2: dot txt we talked about and scans all of them.
Speaker 1: And the sources had a script for handling NMAP output too,
Speaker 1: didn't they enmap to portfiles dotsh Right.
Speaker 2: That one's quite clever. It takes nmp's output, looks for
Speaker 2: the line saying TCP open, and then creates files named
Speaker 2: after the port number exactly. So you get eighty dot
Speaker 2: tx T four four three, dot tx two twenty two
Speaker 2: dot TXD whatever ports are open, and inside each file
Speaker 2: is the list of IP addresses that have that specific
Speaker 2: port open.
Speaker 1: That sounds incredibly useful for organizing results like show me
Speaker 1: all hosts running a web server.
Speaker 2: It really is great for prioritizing. Then there's the other script,
Speaker 2: portwatchdog dot sh. That one shows continuous monitoring.
Speaker 1: How does that one work?
Speaker 2: It uses rust scan, which is really fast in a loop,
Speaker 2: just checking if a specific port you care about opens
Speaker 2: up on a target.
Speaker 1: So like watching port eighty eighty on one machine exactly.
Speaker 2: If rust scan suddenly sees it open, then the script
Speaker 2: triggers n MAP with NSV to do a proper service
Speaker 2: scan just on that newly open port and logs it.
Speaker 1: Wow, like an automated trip wire for new services. Right
Speaker 1: I remember manually digging through huge n MAP logs. Scripts
Speaker 1: like these are game changers.
Speaker 2: They really save a ton of time and effort. Automation
Speaker 2: is key.
Speaker 1: Okay, so we found open ports. Now we want to
Speaker 1: pokem a bit, see what's actually listening.
Speaker 2: Banner grabbing, banner grabbing yep, trying to get the service
Speaker 2: to announce itself send back. A banner often contains software names, versions.
Speaker 1: And the tool for that is often netcat, dot NC.
Speaker 2: Netcat is fundamental, ncdah vip port just tries to connect
Speaker 2: the sv gives verbose output. Many services, especially older ones
Speaker 2: like FTP or SSH might just spit out a banner
Speaker 2: right away. There's a script to that too, yep, netcat
Speaker 2: banner grab dot sah to automate running NC against a
Speaker 2: list of ips and a specific port.
Speaker 1: What about web servers, They don't always give banners easily
Speaker 1: with netcat true.
Speaker 2: For eahttp, the material points to CURL specifically using the
Speaker 2: head method because head asks for just the HTTP headers,
Speaker 2: not the whole web page content. It's faster if you
Speaker 2: only want info like the server.
Speaker 1: Header AH, which often tells you if it's apatche and
Speaker 1: jinx is exactly.
Speaker 2: And there's a curl banner grab dot S script that
Speaker 2: prompts for an ip in port, does the curl head
Speaker 2: and then uses grepen oc to pull out just that
Speaker 2: server line.
Speaker 1: Pretty targeted.
Speaker 2: And don't forget n MAP again. It's scripting engine.
Speaker 1: N SE right n S.
Speaker 2: There's a banner dot NS script. You can run nmap
Speaker 2: svscript banner dot n S and it does the service
Speaker 2: detection and banner grabbing together very efficient.
Speaker 1: Okay, banners grabbed services ID. What about the OS? Can
Speaker 1: we figure out if it's Linux, Windows, something else.
Speaker 2: NMAP again is the main tool here. It uses TCPIP fingerprinting.
Speaker 1: Fingerprinting how does that work? Sounds complex?
Speaker 2: It kind of is. NMP sends specific unusual packets and
Speaker 2: analyzes tiny details on how the target system responds, timings,
Speaker 2: flag settings, things like that. Different operating systems have slightly
Speaker 2: different network stacks that react uniquely.
Speaker 1: This is like a network level fingerprint basically.
Speaker 2: Yes, the aoflag tells nmap to try this.
Speaker 1: OS detection and let me guess there's a script for
Speaker 1: parsing that output.
Speaker 2: You got it, astetection dot ssh nmap has a greppable
Speaker 2: output format OGG. This script uses rep ac set on
Speaker 2: that output to find the lines with host and OS
Speaker 2: and pull out the IP and the OS gus. It
Speaker 2: looks for certain patterns to extract the info cleanly.
Speaker 1: It's amazing what you can learn just from how a
Speaker 1: machine talks in the network. Okay, one last area mentioned
Speaker 1: web applications, specifically using woppolizer.
Speaker 2: Right, woppolizer, fantastic tool. It's all about identifying the technologies
Speaker 2: behind a website or a web app, all kind of technology,
Speaker 2: things like the web framework React, Angular View, the back
Speaker 2: end language maybe PHP, NOJS, the CMS like WordPress or Druple,
Speaker 2: JavaScript library is web servers, lots of stuff.
Speaker 1: How does do that?
Speaker 2: It has a database of signatures. It looks for specific
Speaker 2: clues in the site's code, headers, cookies, scripts.
Speaker 1: And the example usage was simple.
Speaker 2: Yeah, just wappalizer, HTDP, dot IP, dot port. It spits
Speaker 2: out JSON data.
Speaker 1: Jason, you need something to read it that easily exactly.
Speaker 2: The example pipes the JSON output to JQ, which is
Speaker 2: a command line Jason processor. You can use JQ to
Speaker 2: pull out just the fields you want, like the technology name,
Speaker 2: the version it detected, and the confidence score.
Speaker 1: So you get a nice structured list of the tech
Speaker 1: stack that seems really valuable for figuring out where potential
Speaker 1: weakness is as might lie later on.
Speaker 2: Absolutely knowing the stack guides your next steps like looking
Speaker 2: for specific vulnerabilities in those components. It complements the network
Speaker 2: for you.
Speaker 1: Okay, let's try and pull this all together. We've seen
Speaker 1: how Bash acting as the glue, combined with tools like ping,
Speaker 1: ARP scan, end map, rust scan, netcat, curl, and woppilizer, well,
Speaker 1: it forms a seriously capable toolkit for that initial recon phase. Definitely,
Speaker 1: we can build target lists efficiently, find out who's online,
Speaker 1: scan for open ports and running services, grab banners for
Speaker 1: software versions, and even make educated guesses about the OS
Speaker 1: and web technologies.
Speaker 2: And the core idea really is that Bash isn't just
Speaker 2: a shell, it's a scripting language. It lets you automate
Speaker 2: these tools, chain them together, process their output. It makes
Speaker 2: reconnaissance scalable and much more efficient.
Speaker 1: So understanding the tools and how to script them in
Speaker 1: Bash is.
Speaker 2: Crucial, absolutely essential for effective large scale information gathering. You
Speaker 2: can't just click buttons for everything.
Speaker 1: This deep dive has given us a really solid ground
Speaker 1: in Bash for recon and it sounds like the source
Speaker 1: material goes even further into vulnerability scanning, maybe exploitation.
Speaker 2: Yeah, this is really just scratching the surface of the
Speaker 2: initial steps.
Speaker 1: Right. So for you listening, here's something to think about.
Speaker 1: How could you maybe apply some of these Bash techniques,
Speaker 1: even just the basic ideas in your own work or
Speaker 1: areas of interest. How can they help you understand the
Speaker 1: systems you interact with just a little bit better.
Speaker 2: Maybe check out some of those tools and map or
Speaker 2: woppalizer or even brows that get hub Repo mentioned it
Speaker 2: could be a good next step.