All right, everybody.
Welcome back to the official third Cup series, the certified Kelly Lennox ten testing.
This is the information gathering module.
We've gone through all the basics for Lennox, and we're now into the part where we're going to start
our first foray into the offensive arts or the offensive gathering of information.
So this is going to cover reconnaissance for printing and enumeration.
So this is our outline.
We're going to cover several topics, including what is information gathering, what information is
being gathered.
You can we're going to talk about the different types of information that can be gathered on a target.
Well, look at the open source reconnaissance framework where I look at the various tools provided with
Cowboy Linux, like in a scanned directory, buster and map.
We'll get into Recon and G and even some MALTEGO and Google Hacking or Google Dorking as it's called.
So this is going to be our chapter flow based on the tools.
So it is information gathering.
It's often referred to as the predatory phase where we collect as much information as possible about
the target of evaluation or toea.
We usually collect information about three groups the network, the hosts and the people involved.
And there are essentially two main types of information gathering, passive or active, and then there's
also semi passive.
So if we're talking about information gathering or foot printing as it's known, active information
gathering means directly interacting with the target, such as using it and maps, or to scan the target
or confronting the target there some type of social engineering attack.
And then there's the more passive options where we try to collect information about the target without
directly accessing it.
So this is things like social media, public websites and many of the tools we're going to discuss today.
So what information is being gathered?
Well, of course, there's domain names, IP addresses, namespaces, DNS servers, authoritative servers,
records that makes all kinds of stuff, employee information like phone numbers, Social Security numbers,
personally identifiable information, anything that can link you to your organization or potentially
paint a picture of what you might be holding or what also.
Based on this information that's being gathered, attackers will figure out what to do in the next phase
of their attack and what kind of targets they might want to go after.
This could also include things like job portals.
Job listings.
All that kind of stuff.
LinkedIn indeed.
Monster, CareerBuilder.
These are all targets of information gathering.
So for tools of the trade, there's lots of different tools.
These are just a few of the tools.
If you want a complete list, you can go to the tools Dot California website and you can see the very,
very lengthy list of tools with respect to information gathering so that we would be here for essentially
weeks and weeks if we tried to cover every single tool that was in just this one category alone.
So we have these tools.
We also have social media.
Now we'll look at who has as well.
First, we're going to talk about the US.
Our framework.
The also our framework is.
So that was our framework as a set of libraries to perform open source intelligence tasks.
They include references to a bunch of different applications related to looking for usernames, DNS,
deep web searches as well as ad hoc maltego transforms.
Essentially, it's a way of making queries graphically as well as having lots of different interfaces.
So this is the GitHub page, and if you want to look at the different tools that are included with the
open source framework, there's a tool called us, you f f y.
It's a Python script that goes out and looks for a user profile in up to 290 different platforms.
Online tools there are.
Different arguments, you can pass it.
There's a tool for checking for the existence of a given mail from as many, many, many different tools
here, which you can use to gather that information.
This is what the OCR framework looks like.
Let's go ahead and jump in to our next distro.
So we go to our file menu and look at information gathered as a whole section.
And Kelly, that will gather a lot of this information for you as well.
So all the tools are here.
There's open source, intelligence analysis of all the tools come prebuilt in order for you to find
information.
So we want to install the open source.
Framework.
We can go to GitHub and look at its repository.
This is the.
L i3 Visio repository.
So it's got a description.
So it's JNU GPL licensing.
And if you don't have it, you can do it with PIP to install the framework.
I need to probably install PIP online, so if you don't have pip,
there's a way to get it.
And I have to go back real quick.
So that's one of those prerequisites.
Sometimes tools have special ways to download them and it can be in these things can change all the
time.
Area, Python, dash pips.
We have to have a few things in the library before we can be able to get the PIP command to get the
latest and greatest version of the open source framework.
Oops.
That's right.
All right.
So that's done.
There it goes.
The pep is being evoked by our script, so which means we need to run the later.
So you're going to run it with Python.
So we got to a small error here and that's okay.
This has to do with the fact that Kali updated to Python three.
You are going to install the OS AR framework.
We first had to do an install of PIP three, which is the Python based installer program.
So it's downloading some updates here.
So because of the updates to Python and the old 2.7 version being deprecated, we now have to make sure
we're on the latest and greatest version.
And for following the official instructions from the Open Source Framework Repository.
This is the process.
So it's downloading all of the prerequisites it needs to be able to install.
I know right now we can do the SRF command.
Dash.
Help!
We can see the opensource framework command line interface collection of tools that are included in
this framework.
So there's check find which will verify an email address given a pattern.
There's domain file to check whether domain names.
Using certain words and nicknames are available.
You can look for information linked to spam by a phone number.
There's also Yusuf why where you can look for accounts with given nicknames.
So in our framework this is the description, the licensing, and then there's the commands.
PIP three install, what's our framework?
So let's take a look at that process briefly.
Sorry.
So for us, our framework to work, you have to install PIP three because it does not come with.
Cali 2020 by default.
And then there's the command to install it.
Once you get there, then you can be able to interact with the open source account.
Now let's look into how we actually use the as our framework.
So first we're going to do the OCR Dash Dash Health Command.
There's a couple of sample commands, so we're going to go ahead and look for.
A few things with this framework.
Let me go ahead and to the screen.
We're going to do Yusuf Wai Dash and we're going to use the repository name.
I look for similar things on Twitter and Facebook.
And there we go.
There's this free software, so there's the creators.
This is the warranty information.
It's starting the search on the two platforms.
And now all we have to do is wait.
Now.
We'll take a little bit of time.
To come back.
So we'll wait on that to finish.
And that is it came back with some results from Twitter and with Facebook for that particular username.
It even tells us where we can find the profiles.
So if we want to look for different things, we can use different modules as needed.
Again, it's a great tool for just looking at what's out there and finding credentials, even a starting
point.
So if we want to upgrade this, we can do OCR upgrade.
And I will go out and try to update for us and notice we're on the latest and greatest version.
That's fine.
If you forget how to use it, you can use the dash help command.
You look for certain domains, certain phone numbers.
And so on and so forth.
Now let's look at a program called Uni Scan.
So Uni scan is a open source tool capable of scanning web applications for critical vulnerabilities
like SQL Injection Y and SQL injection, cross-site scripting, remote file inclusion, web shell vulnerabilities,
hidden backdoors, and many others.
Besides vulnerability assessments, your scan can also do Bing and Google searches for domains on shared
IP addresses.
It's a tool that's written in Perl.
And if we want to install it, this is the process.
Although keep in mind, sometimes these tools, the process is do change.
They have to be root.
And so we're going to go ahead and get our updates.
For this program.
I'm going to say yes.
And it's going to go out to the CORLEY Rolling Repository, and it's going to pull in some information,
pulling out some additional Perl libraries and things like that.
And once it's complete.
And there we go.
So we can look at the help scale help file for the unit scan.
So you can put different options together.
You can try and fingerprint Web services.
So they even give you a few examples.
Let's go ahead and.
Run this tool on.
Example, XCOM will run the unit scan that knows it's the dot pl.
So that's p l for perl and the u.
As for the URL.
And then we want it to do stress checks.
In some cases, you may have to enable the appropriate.
Library to run with the program command.
There we go.
That's going out to example adcom.
It's running many stress tests looking for.
Best cast.
Of course, this is all just reconnaissance.
This is not.
Actively interacting with the system.
You know.
So if you want to install it from GitHub, that's another way you can do it as well.
It'll go out to the latest and greatest version.
So if you want to use it, you got the help file.
It's also has a gooey.
So let's go ahead and open the gooey.
And zoom in here.
And there's the good.
So if you want to work from the goalie versus the command line, just start a scandal on our local hosts
since we do have a web server running.
Actually, let's make sure that our service is still in fact running.
I make sure we root.
The Patriot Server is, in fact running.
Let's go and go back to our tool here and it's running directory checks on localhost.
We can see that it's an Apache server.
I'm going to write a file check.
It's going to look for the pages that are running.
And it's this is all of the stuff that it's crawling.
It's looking for back doors.
It's looking for anything that it might be able to be able to enumerate.
So a very useful tool.
I didn't check all the boxes, but you could, in theory, check all the boxes to get all of the information.
And it has logging capability as well.
There's the actual log file.
So once it finishes, finish the scan, then you can see the actual report and it even saves it as an
HTML file.
So you can look at that as well.
So then we have dirt buster or a directory buster.
This is a multi string job application to constrain indexes and document names on application servers
to frequently.
We have Web servers that are.
With have default pages and default services running.
So.
Let's go ahead and take a look at.
How to how to get it.
Depending on your version of Kelly, you may not have it available by default.
Let's go ahead and we'll let this scan run.
So.
So there are busters already installed.
There's some pat packages that are no longer needed.
So we'll go ahead and do the Otto and we command the Otto remove move command will help us keep a good
eye on our our disk space.
And keep things cleaned up as best as possible.
So now that they're Buster is there, let's go ahead and look at the Help file.
Not all programs will have these.
But again, it's nice when they have a click help file so you can just use it.
The Dash H command.
And essentially these are some examples if you want to pull down the information.
Of course, you want to run this on sites that you have permission to go after.
So their buster also has a gooey version.
So let's go ahead and look at that.
This tour was put out by OWASP.
So if you want the latest and greatest documentation, you can always go to OWASP.
You put in your target URL.
That's where it's going to put in our local host.
And you can pick out how many threads you want it to do.
Do you want to brute force directories?
So you have a lot of different options.
So it'll directory.
Buster comes up with a bunch of different lists that essentially crawl the web to find hidden directories.
So we'll just leave things as a default and we'll go ahead and click Start.
And it'll take a little bit of time to come back.
But it will try and enumerate any directory since we're starting with Root and we're looking for IP.
You can change the extension if you want.
D.R. Buster also has the ability to buzz websites as well.
That is essentially generate random data.
To hurl at a website to see what vulnerabilities it might spit out.
You've got the file menu here.
You have some different options you can set.
So what it can do for you.
So it'll find hidden pages and directories, thus giving you another attack vector may be an unlinked
administration page.
It will not actually exploit things.
It's just the whole goal of directory browser is to find attack vectors.
It also helps developers understand that just because you don't link to a page does not mean that it
cannot be accessed.
Then we have a map or the network map or as it's known, it's a free and open source utility for network
discovery and security auditing.
Many systems and network administrators also find it useful for tasks like inventories, managing service
upgrades and monitoring post uptime.
IMAP uses real IP packets in different ways to determine what hosts are available on the network.
And so also what services and it can even enumerate different operating systems, what versions of those
operating systems that are running, if there are any packet filters or firewalls in place and many
other things, it was designed to rapidly scan large networks, but it works great against single host
as well.
And it's available on all of the major operating systems, Linux, Windows and Mac OS and also has a
command line version which comes with most of the versions of Linux.
But in this case, in Cali, you have and MAP.
You also have something called Net Cat, which is can be used as a debugging tool or it can be used
to do other things like open sockets and map is doesn't have a warranty, but it's a very popular tool.
It's downloaded many, many times a day.
So why?
Because it's it's flexible.
It has both TCP and UDP capability.
If you want to download and map.
And simply go to
their website and you can download it for Windows, you can download it for Linux.
So go to the download page and get the copy that you want.
You will need to install a couple of dependencies.
The NP capture library.
If you're doing it on Windows, the Windows Installer will handle all that for you.
You're doing other operating systems, you might have to do that.
Here's the difference.
Linux distribution binaries.
First.
In the case of Kelly, it's already there by default.
So we're going to go ahead and.
So if you go to Afghanistan, map and map is already the latest version.
Notice that 7.8. out.
So let's go look at the man page.
Oops.
Put a dash in there.
So network exploitation tool and security port scanner.
So for example, we can do and MAP scans and it will give you back things like port numbers.
It will give you back services.
It will try and do operating system enumeration.
This is the common platform enumeration.
That's CPE.
That's what.
And map can do for you now.
It's not perfect.
It is.
There are false positives.
But MAP does have its own scripting language as well and its own scripting engine.
It can do traceroute, it can do ping scans and we'll get into some of the different scans you can do
as well.
So it can not only be used as a network scanner, but it can also be used as a vulnerability scanning
tool.
So let's go ahead and just do a quick ping scan of the network.
And since we're on the Slash 24 network, that 19216870 will go ahead and run the scan.
And it'll take a little bit of time to come back.
We want to make sure that you're on the same network you're scanning with.
You can also run it from Windows if you have it installed.
You can run it from the command prompt.
You can do and map dash s and you can run the commands pretty much the same way.
And it will function.
You know, generally the same way, though sometimes you may get errors on Windows, so the preferred
method is running it on Linux.
Let's go ahead.
And first we want to know what our IP actually addresses so we can do.
I have config and we see we're on the Ten Network.
So sometimes when you want to be on the same network in VirtualBox, you may have to go into your settings.
So it's going to do that real quick.
This is only going to work if you're running it in VirtualBox.
When to go into the network tab under settings, you're going to change it from being Nat.
We're going to make it bridge adapter.
I'm going to bridge with the Ethernet adapter, which is what I'm currently connected to or select that
you can there's more advanced settings and you can put on promiscuous mode if you're doing traffic capturing.
So that's important depending on the type of wireless card you have.
So.
I'm going to go ahead and hit.
Okay.
And sometimes VirtualBox will crash and that does happen and that's okay.
So why and map why is that useful?
Because it comes with source code that we can also modify and redistribute has many different tools.
This is some of the sample options you can get from it, such as a thin scan, connect scan.
And so if you want to scan a single IP, you can do in map one 9 to 1 681.1 for the IP you can do and
map by hostname, you can scan a range of IPS, you can scan subnets with slash notation.
You can even read in lists of IPS.
It's a very versatile program and very useful for.
Many different operations.
So if you want to scan on a single port versus a range of ports, you can do PN mapped P and then the
port range.
You can scan the most common ports quickly.
You can do service detection, banner grabbing.
Let's go ahead and do some of these together, waiting on our virtual machine to power up.
I.
We can also do early detection with the dash, a command or the the dash upper case.
Oh.
And we go and have our virtual machine.
Go ahead and make this into some scaled mode.
Right.
Go put in our password.
Let's go check our IP address.
We should be on the same network as my local network here.
It's opened up a terminal.
And it takes a little bit when it first boots up.
But notice that we can see we have a connection here.
The wired connection is in fact active when I go hand pseudo to root.
Everyone want you.
I have config and we're on 1921687.252 and map we're going to ping scan local network
the slash mutation and we'll find some different hosts and we'll scan them one at a time.
Notice we got seven hosts that are up tick all of 2 seconds.
So let's pick a host that's up and we'll look at the 239 IP address.
So let's do service detection.
We did the uppercase A, which is going to try and make its best effort at detecting services.
And it takes a little bit of time because it also do some randomised scanning.
So while we're doing that, let's go ahead and look at the graphical version, which does not come with
Kelly.
But if you want to see what the graphical version of the end map looks like on Windows, maybe you're
not as comfortable with the command line yet.
So it's a good way to start out and do some scans very quickly, and it will also give you the actual
command.
So all you have to do is type in the target and this top box and it'll give you the command.
And the nice thing about it is let's just do a ping scan first or it will do a quick scan.
So we want to enumerate some results here.
So go ahead and click scan and it's not open.
The device codes are blue, it's already scanning.
Let's try.
So from here you can also save scans.
You can print scans to.
If you want a hard copy, you can save them all to a directory.
So let's go and come back to our skin hair.
We could see that it's going to give us kind of a progress bar.
It says 44 seconds remaining roughly and about 66% done of one host.
So the more detailed of a scan you do, the longer it will take.
If you scan on all ports on even if it's a very small network, you can plan on it.
Taking a good chunk of time and map what's open up a new tab.
Let's go ahead and go look at the end map servers.
And I have the comp, the capsule icon.
When I look at the map directory, then the US, our share
and map directory, everyone else, the different folders here we can see inside the map directory.
We have different payloads, protocols, but look down here, we have an interesting script directory.
So if we change into this scripts directory we can see there's a whole bunch of scripts for different
types of vulnerabilities NF DNS, and there's even some SMB for Windows Systems.
Maybe we will go look at.
Microsoft Hardware, Microsoft's sequel Dump Out the Hashes.
So these are all the different scripts that come out of the box with Kelly.
There's SMB vulnerabilities.
So if you want to enumerate systems that have been unpatched, there's a lot you can do with it besides
just port scanning.
Let's go see if we've got our port.
Scan finish is about 85% done and it's almost complete.
And SC stands for End Map Scripting Engine.
So if you're wondering what that's about, notice, it also gives us just from a ping scan, we got
a mac address and we got an IP address.
There's other programs you can do this with like angry IP or many others.
But MAP does a lot of functionality for you from the start, so it's almost done scanning.
Let's open up a command prompt and we can also from end map.
If we forget how to do it, we can get the help file on the Windows Command prompt as well.
So you can even run it on Windows and it gives you some examples.
Also has the scripting engine knows, it tells you the version.
Maybe we want to scan a particular host.
Let's scan the router that we're connected to and we'll put it into our version detection.
So we're going to do a lowercase s, uppercase V, and so we're going to go out and we're to scan that
and we're going to see what it gives, gives us back while we're waiting on our other scan to finish
it.
It's almost done.
Notice in a VM, you're going to have a little bit slower performance in your scan than you ordinarily
would on a physical system.
But notice, there's lots of different tools.
And map is in there so you can type in in the command prompt or you can type it into the search bar.
You can also just click on the link to go ahead and start it.
So we keep hitting enter and map or keep updating the status in real time.
It's good to see if our other scan.
So for some reason we're getting a failed to open device.
Now, this does happen sometimes, so don't worry about it.
May just be.
Try to connect to a different interface.
So we got our scan back and look at all the information we got.
So we got a couple of different ports open.
We got some SSL running.
They have an SSL cert.
We also have some PCP ports open.
So we sea port, 9000, 10,000, and then down below it.
It's running a Linux kernel and it ran a couple of scripts to try and figure out what it was and it
also did a traceroute to it.
So there's a lot you can do with an map and a lot of functionality you can get from and map.
So definitely if there's a tool to spend a lot of time with and map is definitely one because the better
you are within map, the better you will become as an ethical hacker.
So you can do to simply connection scans.
Essentially, all the map commands have similar syntax.
If you want to do a send scan, which is otherwise known as a stealth scan, you can do a and map a
dash lowercase ast.
Notice that the lowercase s is always in the beginning.
The uppercase letter will be the type of scan you're doing.
So if you're doing an ACT scan, it's a dash uppercase a if it's a UDP scan, it's a uppercase U.
If you're just doing a pen sweep that's lowercase, you can even scan as if you were scanning from another
machine that's called the zombie scan.
And then you have decoy scanning if you want to set up several randomized IP address to scan a target
from, you can do that.
Let's talk about recon engine.
Recon engine is a full highlighted Web reconnaissance framework written in Python.
So it has autonomous modules, database communication.
It is very useful for keeping track of online reconnaissance efforts during the various phases of get
the information gathering process so it looks and feels like Metasploit framework, but it's very different
than Metasploit.
It's not designed to look for just existing modules.
It can be modified, it can be configured in many ways.
So if you need to use Metasploit for Metasploit, use Metasploit.
If you're trying to do social engineering, use the social engineer tool kit with recon and gee, you're
actually they have quite a robust usage guide and even the Python developers can actually create new
modules, custom modules along with that.
So we can and does look like Metasploit.
But it has its own flavor.
So it's a measured system and it makes it simple to create specialized modules.
There are basic interfaces to.
Perform tasks and you're able to completely oversee things like API keys and the hard work has been
done for you.
So this is a sample of what it looks like.
Let's go ahead and jump into our virtual machine and we'll run through our process.
All right.
So recon energy is if it's not installed by default and call it Linux, you can do a pseudo abs, get
install recon and the.
And it's currently installed the newest version 5.10.1, dash two.
So now when you first launch it, you can just type in recon, dash energy.
And you're going to see some red notifications and that's perfectly fine.
This means there's some things that have not been set, and that's no problem.
So what we're going to do, there's 85 recon modules, there's 15 disabled modules, there's eight reporting
modules, there's even exploitation modules.
So those is not primarily an exploit tool.
It's just not.
So we can do some tools here.
We can say show.
We can show companies and there's currently no data right now.
So in this particular notice that we have recon engine and then we have a workspace name which is default
in this case.
So what we want to do is we want to go ahead and type in workspaces.
And if you do tab complete, you can type list.
And notice we have two workspaces that have been already created.
There's the default one and then there's the one we created called Search Cop.
Now, if we want to load a workspace or workspaces, we can type, workspace, load and type in the
name of the workspace.
And now we have that with you show companies and you can see we have some targets of interest in here.
There's also the ability to add contacts.
So we have added a couple of contacts just to have some individuals in here.
You know, we can see we have.
The John Smith or Agent Smith network admin.
We have the the region there in.
And let's go ahead and fix something real quick.
Let's go ahead and fix our display setting on Kelly again.
That way we.
Have the the better picture and everything is on the screen as it should be.
So let's do 1024 by 768.
And that's better.
So we can kind of see a little bit, but this is still slightly cut off and that's fine.
So if you want to put the question mark, we can actually see the difference commands that there are.
So we type in Dashboard.
Dashboard will give us a summary of what we currently have.
When you show domains, we have our two domains here.
If we show, we also have credentials, vulnerabilities and the way recon engine works and it works
with keys.
So if we do keys list command, we can see that we have a couple of API keys loaded in here.
Now you'll have to go to the various sites here to download your API key.
What that means is you'll actually log in to the site and copy and paste your API key into here.
Now, of course, these are you can put in fake keys as well.
You don't have to put real keys.
That's for demonstration purposes.
That is good enough.
So and you can also take snapshots of different workspaces.
And many other many of the things you can deal with this framework.
So some of the things that have changed with the new recording.
It had a major update in June of 2019.
From version 4.9. 6 to 5 .0.0.
And the major differences is that recon energy is now hosted on GitHub, and that's where you obtain
it from GitHub.
It has the new version of Python, Python 3.6.
The modules have been moved into a marketplace.
And so if you do not have the environment setup, which initially you will not.
There are a few things that you will want to do.
So let's go and exit out and clear the screen.
So from installing this, we have done the sudo app get install recon engine which we know it's already
installed.
We can do a pseudo apk dash get upgrade because you want to be on the latest and greatest version which
we are.
We can also do sudo apt get install dash y to get python three dash pip.
Now if you already have this installed, that's great.
On the new version of Kali Linux.
The 20 .0.2, it's there so we can change into recon and G.
Once we once we clone it we're going to get clone HD IPS.
GitHub dot com slash land master 53 slash recon dash engine I get now this is the GitHub repository.
So we already have the framework here.
But.
We can go ahead and clone the repository and.
Once the repository is closed, then you will install some requirements.
And you'll be ready to go.
So now that we're done cloning the repository, what we'll want to do is go ahead and change into the
repository directory.
And of course, this will already be done or we've already done this.
But for demonstration purposes we'll do PIP three install our requirements dot text.
And that will make sure that all the appropriate requirements are installed.
For any kind of energy to work properly.
Typekit incorrectly.
The a lot of the other tools require this to be installed.
So we'll notice that if it's already satisfied, then you'll get a pop up like this.
But now we have all the requirements and we can do a PIP three install.
So pip three install p y pdf three.
P, y,
a, s, and B for some other dependencies.
To make sure that recom energy is fully functional on the first go.
So the first time you launch, you can actually launch and create a new workspace.
What you can do is you can type in.
Recon energy.
Dash W and then we can call it a workstation.
Workspace test and it will create us a test workspace.
And as we launched into test.
And so now we're going to show workspaces.
Or worse.
Not sure.
Places or spaces lest.
We now have three workspaces.
So the first time you'll do it is you're going to use the marketplace and you're going to install all
course.
In our case, everything is already installed, which is fine.
It's just going to go through and check all the different modules to make sure they're good to go.
You're going to see some read come across the screen for certain API keys that are not loaded, but
that is not a problem.
So it takes a little bit of time and then we'll be done with all the modules that we can get into configuring
some options and start adding in some data.
So we're going to first we're going to look at the global options and we're going to change the time
out for it.
So basically the options are going to be in all caps.
So we want to know that it is case sensitive.
So we're going to do options list and we see we've got the name server, which is fine.
We're going to do we're going to set options set.
Five out 15 senators put time out with an arrow there.
So we go back to Options List and we now see we have the time out, said the 15.
If you try it, if you don't put in the right case, it will not work.
Let's go ahead and insert another domain.
We'll do DB inserts domains and we'll type in a domain.
We'll do search first dot com.
This is searched first and we'll type in show domains and we now have the new domain in this new workspace.
So we have our work, we have our other workspaces.
So you can have multiple workspaces to work from multiple companies, multiple domains.
So it becomes a very nicely organized utility.
So how do we run a module?
Well, let's go ahead and run a module.
We do modules, command load domains.
And the hosts in this case.
We're just going to try a example and notice that our prompt changed from our workspace and it added
in the name of our module.
So now we can type in run and it's going to go out to that host.
Sometimes it may not work if there is.
There are there can be network issues there.
There are a host of reasons why the module might not work.
So we have to have something in the domains table first because that particular module is going to start
with something that's already in the domains table.
So once we've seen how to install recon energy, how to see what models are available, you definitely
should spend some time with it.
There's a cheat sheet on the Black Hills InfoSec website, which you'll have the link to.
You can take a snapshots of workspaces as well, but it's a very intuitive, very user.
Maltego Maltego is a tool that's created by a company called Petrova that is used to perform open source
intelligence gathering.
And essentially, it can collect information.
From many different locations.
Things like real world links between groups of people.
Organisations, websites, domain names, network blocks, IP addresses and even documents and files.
So if you go to the.
Information gathering portion in Copley Square and closed down our terminal here.
Let's go to the start menu with good information gathering and we click on Maltego and it's going to
open up the community edition.
Of Maltego.
You can also do it from the.
Command line.
And it's going to do some module setup and things and then you'll be ready to go.
So it says memory settings optimized or require it's gotten restarted.
Sometimes you get that error.
It's totally an error.
It's just just a warning just to let you know that you want to tend to heed the warnings to make sure
you're running the program to the best setting possible.
So when you first set up maltego, you have to set up a you can activate it with a key if you want to
purchase the pro version or the.
There's also a.
Free version of their new case.
Five, We're going to run the community edition.
Essentially you go down, you accept the license terms and agreement.
And if you're not registered yet, you can go register here and it'll open up a browser for you to register.
And they give you the CAPTCHA to solve as well.
That's going to redirect you to their website, of course, because it's doing authentication.
It's going to ask you to unlock it.
And Kelly.
That's perfectly fine.
So you put your information in here and then click register.
I already registered.
So I'm going to go ahead and.
Skip this step.
All right.
I'm going to go ahead and put in my information and log in.
Do the capture.
Probably timed out considering course the capture was incorrect.
So this happens all the time.
There's lots of fun.
That sent me a new one.
And there we go.
We're logged in.
I want you logged in, log in or ask you to do some configuration.
This is a summary of the.
Install.
What's been opened, what's been updated.
And so I'm going to go ahead and say I want to automatically send error reports and then you pick your
privacy.
Do you want stealth or do you want normal?
I'll just keep it normal because I'm not doing an investigation right here.
So it's been successful.
So we're going to open up an example graph so you can see what it kind of looks like.
It's a very intuitive interface and essentially it allows you to map out websites to different organizations
so we can click on an IP address.
We can see different relationships and the detailed view might take a little bit of of this plane.
This is actually from Maltego.
We have incoming outgoing and we have a date.
We can view things in different ways.
If you want to change up the view, you can do that.
If you want to buy a graph view or you want to see it buy incoming and outgoing.
You can see your different organizations here.
Click on different buttons to change the way.
Things are displayed.
And see the machines.
Window.
Any usernames?
You can also import data as well into material.
So it's a very robust program.
Definitely spent some time with it at will.
It will help you in your open source intelligence gathering.
So now let's talk about Google hacking or Google darkening, as it's been called.
It's utilizing a Web crawler, for example, Google, to find things that might be on the Web that you
may not necessarily want people finding.
Or maybe somebody was just careless and forgot to make it private.
So.
Google hacking or Google Dorking can give us a lot of information.
So let's go over to the Google hacking database.
And this is part of exploit.
DB It actually has a lot of already added Google Docs or hacks.
Essentially the way it works is you pick what you want to find.
Maybe you want files containing usernames, maybe you want sensitive directories.
Maybe you want a particular type of server log in.
So what it's designed to do is essentially go out and crawl the web and optimize and focus your search
process.
So maybe you want to find servers that are vulnerable.
So we'll see.
We can click and copy this.
If you click on an individual entry, you know, give you more information.
We're just going to go ahead and open up a new tab in Google.
You can actually paste it right in the browser or you can go to the search engine.
These are all the different hits that it came up with to notice.
Instead of tens of thousands of results, you get a handful.
So let's say maybe I want let's go to Google the TAB itself.
Let's go to Google.com.
And we'll grab another one.
Let's go get a different one.
Let's say we want index.
So everything in the title of admin slash x amount.
Now this is essentially just using different keywords.
So if you want to find out servers that are vulnerable to this particular setting and there's all kinds
of lists of Google keywords, if you want to look at something all about a particular site, if you
typed in site Cohen, CNN, AECOM, you would get all the CNN.com results.
Same thing with Facebook, Facebook.com, you get all the Facebook results and you can use these different
keywords.
You can also use the advanced search.
If you go to settings and from within Google, click on advanced search and you can actually type in
the keywords here as well.
You got if you want to find maybe pages that are similar to the URL.
Maybe you want to exact words from your search or maybe you want sites that are related.
So let's say I want related to CENTCOM.
And it says unusual traffic because sometimes when they do this, they'll think that maybe you're doing
it from a robot.
But again, so it gave me all the sites that are related to CNN dot com.
So it's a very quick way to be able to research a target and find a lot of information.
And there's all kinds of lists of the top Google hacks or dorks that are there and they get updated
regularly.
So these are some sample query.
So you could search for all certain phrases in the page.
You can look for certain phrases in a URL, maybe you want certain types of file formats.
So there's a lot you can do with Google Dorking if you want to do, maybe you want to find passwords.
Or going to be display usernames for database connections.
So since we're on the Google hacking database, this is a screenshot from the exploit DB as well.
And so that is.
Our summary on information gathering, open source intelligence reconnaissance footprint.
This helps an individual and an organization figure out a way to retrieve data that would otherwise
be harder to find.
We talked about the different types of information gathering.
We talked about semi passive information gathering, and we talked about passive versus active.
So passive being you're not interacting with the target, whereas active you actually are.
You might also hear it called open document searches.
We talked about the open source reconnaissance framework and how to install that.
We looked at the unit scan for remote file include detection, local file in cloud and remote command
execution.
We also looked at directory buster.
And we looked at and map maltego as well.
So now let's do some practice questions.
Information gather.
Information gathering helps.
In what?
Gathering passive and active info about the target helps in setting up a lab, helps in preventing attacks.
Helps in alerting admins on attack.
The answer, of course, is a gathering, passive and active information about a potential target.
Number two, one of the two main types of information gathering.
Active and passive.
Pro and community.
Proactive and reactive.
An up or down.
The answer is, of course, active and passive as we just discussed.
So remember the different methods of information gathering.
They will help you paint the biggest, broadest picture of your target.
Number three, one of the prerequisites software needed to run the open source intelligence framework.
And you need node JavaScript, you need python shell or ad map.
Correct answer is of course no JavaScript.
Number four, what does your scan do in this scan?
Performs remote code execution vulnerability scan.
Perform SQL injection vulnerability scans.
Performs port scans on the target or none of the above.
And the correct answer is a remote code execution.
So RC.
What is the main purpose of an app?
A network vulnerability scans, B Web application scans, or C network troubleshooting and pen testing.
Or man in the middle attacks.
Correct answer is, of course, network troubleshooting and pen testing, and that can be used as a
vulnerability scan but is not the main purpose.
It's also not a web application scanner or a better application scanner tool would be something like
auto.
So these are some of the acronyms we talked about open source intelligence.
We talked about the Google hacking database, the open source reconnaissance framework.
The remote file include local file include.
Okay.
So in summary, we looked at information gathering, we looked at open source reconnaissance, look
at some of the various tools as well as how to do Google hacking or Google Dorking.
And I thank you very much for your attention.
I hope you enjoyed the module when you learned a lot more now about open source intelligence gathering
than you knew before, and we'll see you guys in the next module.
Friendly product.