WEBVTT - This file was automatically generated by VIMEO 1 00:00:06.100 --> 00:00:09.300 Hi, and welcome back to a deep dive into 2 00:00:09.300 --> 00:00:13.000 Network. Assessments by easy console. This is 3 00:00:12.600 --> 00:00:15.600 section tree. Hands-On with network 4 00:00:15.600 --> 00:00:18.300 Assessments in this section. You will learn 5 00:00:18.300 --> 00:00:22.200 about working with open source, intelligence tools, and 6 00:00:21.200 --> 00:00:24.400 you'll also discover on how to gather 7 00:00:24.400 --> 00:00:27.800 information about a Target. So that's 8 00:00:27.800 --> 00:00:30.600 so you're probably wondering what exactly 9 00:00:30.600 --> 00:00:34.400 is a scent of Open Source. Intelligence is simply 10 00:00:34.400 --> 00:00:38.500 this is a technique of possibly Gathering publicly 11 00:00:37.500 --> 00:00:40.300 available information about a 12 00:00:40.300 --> 00:00:43.200 Target. So probably wondering what do we mean 13 00:00:43.200 --> 00:00:46.700 by possibly got her in the first season Patriots 14 00:00:46.700 --> 00:00:49.800 on testing, ethical hacking or even talking 15 00:00:49.800 --> 00:00:52.800 generally. It's information-gathering or 16 00:00:52.800 --> 00:00:55.100 reconnaissance, this two types of 17 00:00:55.100 --> 00:00:58.800 information gathering or reconnaissance, and this is active. 18 00:00:58.800 --> 00:01:02.400 And the other one is called passive passive. Simply 19 00:01:01.400 --> 00:01:04.700 uses an indirect approach to 20 00:01:04.700 --> 00:01:06.000 God, information about 21 00:01:06.100 --> 00:01:09.900 All the target without a receipt directly engaging. 22 00:01:09.900 --> 00:01:14.400 The target publicly accessible 23 00:01:13.400 --> 00:01:16.800 information to help profile 24 00:01:16.800 --> 00:01:19.600 and understand what phone royalties 25 00:01:19.600 --> 00:01:22.500 exists within our targeted. Self it 26 00:01:22.500 --> 00:01:25.700 saying as many organizations usually leak, 27 00:01:25.700 --> 00:01:28.500 and they were supposed to much information about 28 00:01:28.500 --> 00:01:31.300 themselves on various platforms such as 29 00:01:31.300 --> 00:01:34.500 forums blogs on even 30 00:01:34.500 --> 00:01:37.200 social media a transaxle, what, it's a 31 00:01:37.200 --> 00:01:40.700 penetration tester or a real hacker can simply 32 00:01:40.700 --> 00:01:44.600 collect all of this information. Analyze information 33 00:01:43.600 --> 00:01:47.200 and even use information against actual 34 00:01:46.200 --> 00:01:49.900 Target to put simply to 35 00:01:49.900 --> 00:01:52.300 get started with performing open source 36 00:01:52.300 --> 00:01:57.500 intelligence. We can use is falling for in SAS guidelines. By 37 00:01:55.500 --> 00:01:58.600 checking search 38 00:01:58.600 --> 00:02:01.900 engines such as Yahoo. Been Google 39 00:02:01.900 --> 00:02:04.100 on any other search engines are there 40 00:02:04.100 --> 00:02:05.800 about or Target? 41 00:02:06.600 --> 00:02:09.800 So you put simply we can just go on Google and search 42 00:02:09.800 --> 00:02:12.700 for a target of an isolation and 43 00:02:12.700 --> 00:02:14.600 see what is search results revealed us. 44 00:02:15.500 --> 00:02:18.700 We can even perform Google hacking techniques or 45 00:02:18.700 --> 00:02:21.300 what somebody since my call Google Duo 46 00:02:21.300 --> 00:02:24.900 King, which is pretty much using advanced Google searches 47 00:02:24.900 --> 00:02:27.200 to look for specific information about it. 48 00:02:27.200 --> 00:02:30.300 I guess, we can even check social media 49 00:02:30.300 --> 00:02:33.800 platforms, such as Facebook LinkedIn, Instagram, 50 00:02:33.800 --> 00:02:37.100 even Twitter for anyone 51 00:02:36.100 --> 00:02:39.500 who may post, pictures, such as 52 00:02:39.500 --> 00:02:43.100 let's say, I employ of the wise Asian, and sometimes 53 00:02:42.100 --> 00:02:45.600 employers will take pictures of your desk and 54 00:02:45.600 --> 00:02:48.700 only a desk may have. Let's see the employee's 55 00:02:48.700 --> 00:02:51.800 ID, badge, or even sensitive information. Written on 56 00:02:51.800 --> 00:02:55.700 a positive note. We can also look at footprinting 57 00:02:54.700 --> 00:02:57.800 a company's website. We 58 00:02:57.800 --> 00:03:00.200 can even look up profiling email for 59 00:03:00.200 --> 00:03:03.400 printing techniques using who is information to 60 00:03:03.400 --> 00:03:06.600 daughter to my registry when performing 61 00:03:06.600 --> 00:03:07.900 DNS foot printing. 62 00:03:08.400 --> 00:03:12.200 So let's take a deep dive into understanding, how 63 00:03:11.200 --> 00:03:14.100 to use each of these techniques to 64 00:03:14.100 --> 00:03:18.000 actually calling to Mission about your target. Hear. I'm 65 00:03:17.200 --> 00:03:20.700 on Google and I could somebody search for 66 00:03:20.700 --> 00:03:23.600 who is this will list in 67 00:03:23.600 --> 00:03:28.700 number of who is databases, usually contains 68 00:03:27.700 --> 00:03:31.100 the registration information about 69 00:03:30.100 --> 00:03:33.200 it. Do mean so we can 70 00:03:33.200 --> 00:03:36.800 check if you have these we can even the 2 on icon 71 00:03:36.800 --> 00:03:39.700 who is look up, we could check who is that doing? 72 00:03:39.700 --> 00:03:43.000 So to speak unless click on any of these. So we 73 00:03:42.200 --> 00:03:44.200 can start with this one here. 74 00:03:46.800 --> 00:03:49.600 And we can simply enter a do 75 00:03:49.600 --> 00:03:54.800 mean. So let's say for example, we answer microsoft.com I 76 00:03:54.800 --> 00:03:57.600 hit search. This is going 77 00:03:57.600 --> 00:04:00.500 to of course is going to ask me if I'm 78 00:04:00.500 --> 00:04:03.100 a robot to not let it go. 79 00:04:05.300 --> 00:04:08.900 I know we actually got who is information for Microsoft so 80 00:04:08.900 --> 00:04:11.500 we can see the domain registration 81 00:04:11.500 --> 00:04:14.200 information such as when they do mean was 82 00:04:14.200 --> 00:04:17.300 registered. When it's going to expire, when it 83 00:04:17.300 --> 00:04:21.200 was last updated. We can even get the nameservers, 84 00:04:20.200 --> 00:04:23.400 we can even get any sort 85 00:04:23.400 --> 00:04:27.600 of technical contact information. Also there 86 00:04:27.600 --> 00:04:31.500 at our system numbers such as the ISP, dear 87 00:04:30.500 --> 00:04:34.300 public inside address on any 88 00:04:33.300 --> 00:04:37.800 other meaningful information. Down here, 89 00:04:37.800 --> 00:04:40.900 Will Reveal any sort of confidential information. 90 00:04:40.900 --> 00:04:43.300 Do you have some organizations who 91 00:04:43.300 --> 00:04:46.600 wrote to say to me in and does not pay for privacy? If they 92 00:04:46.600 --> 00:04:49.600 do not pay for privacy, then we'll see all the registration 93 00:04:49.600 --> 00:04:52.600 information publicly available in this portion of 94 00:04:52.600 --> 00:04:53.400 the Wiz record. 95 00:04:54.700 --> 00:04:57.400 However, keep in mind that most organizations, if not 96 00:04:57.400 --> 00:05:00.300 already FIFA privacy, so that 97 00:05:00.300 --> 00:05:03.400 their personal or the private information is not 98 00:05:03.400 --> 00:05:06.500 leak outside so that she has one technique of where 99 00:05:06.500 --> 00:05:09.900 we can actually get information 100 00:05:09.900 --> 00:05:12.100 about a domain or the 101 00:05:12.100 --> 00:05:15.400 Uno to do me another place. We can check his job 102 00:05:15.400 --> 00:05:18.800 websites. So, that's how do I change a light switch 103 00:05:18.800 --> 00:05:24.000 or something? Let's search for network administrator 104 00:05:22.400 --> 00:05:25.100 and let's see what pops up. 105 00:05:25.100 --> 00:05:29.300 So, it's, it's sewage and guys, by 106 00:05:28.300 --> 00:05:31.400 no means, I'm targeting any particular 107 00:05:31.400 --> 00:05:34.600 organization. We are just taking a look at publicly available 108 00:05:34.600 --> 00:05:37.500 information. I'm trying to understand how it's 109 00:05:37.500 --> 00:05:40.300 your doctor. Could leverage this information to Target a 110 00:05:40.300 --> 00:05:41.000 political organization. 111 00:05:41.800 --> 00:05:44.700 So, let's click on this one next 112 00:05:44.700 --> 00:05:46.300 week and systems administrator. 113 00:05:48.200 --> 00:05:51.600 On what you're looking for is, whether the organization list, 114 00:05:51.600 --> 00:05:54.700 any specific Technologies and look 115 00:05:54.700 --> 00:05:57.500 at his experience in the following, but it's 116 00:05:57.500 --> 00:06:00.400 not required. So yeah, I'll 117 00:06:00.400 --> 00:06:03.500 some Dell EMC systems are some, my 118 00:06:03.500 --> 00:06:06.100 telephone systems. There's a 119 00:06:06.100 --> 00:06:09.800 backup exec solution case. Even 120 00:06:09.800 --> 00:06:12.500 this case on VMware, get some 121 00:06:12.500 --> 00:06:15.800 Windows Server, some Unix systems, and 122 00:06:15.800 --> 00:06:18.500 apparently this company is using some Dell 123 00:06:18.500 --> 00:06:21.500 networking Technologies. So how's the traffic to 124 00:06:21.500 --> 00:06:25.600 even do? I'm seeing this as what's a job, vacancy. What 125 00:06:24.600 --> 00:06:27.100 I'm also say, he is the type of 126 00:06:27.100 --> 00:06:30.500 technology is this company is using. So for example, 127 00:06:30.500 --> 00:06:33.300 the voice over IP systems Night, Owl. 128 00:06:33.300 --> 00:06:36.300 So, this means Our Fate rather than simply look for 129 00:06:36.300 --> 00:06:39.600 vulnerabilities on even exploit for my Toby 130 00:06:39.600 --> 00:06:42.400 systems, in terms of networking. We can 131 00:06:42.400 --> 00:06:46.500 see that they're using Dell networking Solutions. Now, 132 00:06:45.500 --> 00:06:47.800 I'm not too sure what it switches. 133 00:06:48.100 --> 00:06:52.500 Photos of some other solution as well. However, what 134 00:06:51.500 --> 00:06:54.400 a identify is a child when they're here. 135 00:06:54.400 --> 00:06:57.500 So, just by looking at this specific information, 136 00:06:57.500 --> 00:07:01.000 we can determine the type of Technology IIT or 137 00:07:00.600 --> 00:07:03.700 network infrastructure within 138 00:07:03.700 --> 00:07:06.200 the international side of his 139 00:07:06.200 --> 00:07:09.300 organization. So, as you can see, this is a pretty good 140 00:07:09.300 --> 00:07:12.700 example of how you can use publicly 141 00:07:12.700 --> 00:07:15.400 available information, which may be leaked a little too 142 00:07:15.400 --> 00:07:18.900 much over there and try that this could simply leverages 143 00:07:18.900 --> 00:07:21.700 to their advantage. However, 101 144 00:07:21.700 --> 00:07:24.500 ization, standpoint. They are looking for someone who has 145 00:07:24.500 --> 00:07:29.000 the skills or experience Within These Technologies. Sometimes revealing 146 00:07:28.500 --> 00:07:31.300 certain Technologies may be a bad thing 147 00:07:31.300 --> 00:07:34.200 and also a good thing. So that's remind shalabh or at 148 00:07:34.200 --> 00:07:37.700 another place. We can check for organization. Information 149 00:07:37.700 --> 00:07:40.400 is a cycle hunter that 150 00:07:40.400 --> 00:07:40.800 I you 151 00:07:41.300 --> 00:07:44.000 So Hunter. Are you is going to 152 00:07:44.500 --> 00:07:48.600 provide a lot of publicly available information about employees 153 00:07:47.600 --> 00:07:50.600 who belong to certain organization? 154 00:07:52.400 --> 00:07:55.500 It's recommended to create an account on hunter that I owe before 155 00:07:55.500 --> 00:07:58.200 a performance, which has caused. Your searches will be 156 00:07:58.200 --> 00:08:02.300 limited. However, if you want to get additional features on 157 00:08:01.300 --> 00:08:04.500 hunter that I owe, you need a pita count, 158 00:08:04.500 --> 00:08:07.200 so just give me one second. I'm just going 159 00:08:07.200 --> 00:08:10.300 to log in and then we'll perform a simple switch. All right. 160 00:08:10.300 --> 00:08:13.700 So now I'm back logged in on the face, looks 161 00:08:13.700 --> 00:08:16.300 a little different, but on a means, which is so I can 162 00:08:16.300 --> 00:08:21.600 begin my type in an organization example, Microsoft. 163 00:08:20.600 --> 00:08:23.500 And while I'm typing 164 00:08:23.500 --> 00:08:27.300 Microsoft is giving me Susan potential. 165 00:08:26.300 --> 00:08:29.500 Do means philosopher example, I'm 166 00:08:29.500 --> 00:08:32.800 looking for microsoft.com., We can see slowed up microsoft.com., 167 00:08:32.800 --> 00:08:36.700 I can simply click it and then Uber City 168 00:08:36.700 --> 00:08:37.400 photos and results. 169 00:08:39.600 --> 00:08:42.200 Simply by clicking this. I can get two 170 00:08:42.200 --> 00:08:46.000 sons who perhaps has a shin 171 00:08:45.300 --> 00:08:48.400 before is currently working working within 172 00:08:48.400 --> 00:08:51.500 this organization and it actually 173 00:08:51.500 --> 00:08:54.100 shows the most common form of 174 00:08:54.100 --> 00:08:57.300 48 emails. So if it is, this 175 00:08:57.300 --> 00:09:01.600 organization is using their, let's see, the username 176 00:09:00.600 --> 00:09:03.300 portion of your email address to 177 00:09:03.300 --> 00:09:06.200 log into your network. Then hunter that 178 00:09:06.200 --> 00:09:09.800 I use are showing me their email format structure 179 00:09:09.800 --> 00:09:12.600 possible, username structures. Well, 180 00:09:12.600 --> 00:09:15.900 structures. And therefore, Matt now look 181 00:09:15.900 --> 00:09:18.900 at some of these weekends Sleepless in sneem, we 182 00:09:18.900 --> 00:09:21.200 can see the email addresses, we can see 183 00:09:21.200 --> 00:09:24.600 even the sources of where this information was 184 00:09:24.600 --> 00:09:27.600 captured from. So if a person had an 185 00:09:27.600 --> 00:09:31.200 LED lights for your email address, their contact information and 186 00:09:30.200 --> 00:09:33.300 Lexie, somewhat link to the 187 00:09:33.300 --> 00:09:36.400 organization in some public or external probably 188 00:09:36.400 --> 00:09:38.400 to the party for them, it's going to pop up here. 189 00:09:38.900 --> 00:09:41.200 About the cool thing is that we can see some 190 00:09:41.200 --> 00:09:44.200 of their job titles. So let's say for example it try 191 00:09:44.200 --> 00:09:47.600 to talk to his actually Targets in a high-profile employees 192 00:09:47.600 --> 00:09:51.400 such as it's a board of directors, perhaps 193 00:09:50.400 --> 00:09:53.600 a see you perhaps even let 194 00:09:53.600 --> 00:09:56.100 see IT director while it makes 195 00:09:56.100 --> 00:09:59.300 it easy talk to identify the high-profile employees of 196 00:09:59.300 --> 00:10:02.800 analyzation if you should perform. Let's see. Some type 197 00:10:02.800 --> 00:10:05.600 of spear phishing attack or even a willing attack. 198 00:10:07.100 --> 00:10:10.500 Korean food, I hear. We can see that. The result is 199 00:10:10.500 --> 00:10:14.500 limited and definitely will need a peed account 200 00:10:13.500 --> 00:10:16.700 to see more results. However, the 201 00:10:16.700 --> 00:10:20.700 cool thing is we can click on. This always says 202 00:10:20.700 --> 00:10:23.700 sources. I could see the actual sources 203 00:10:23.700 --> 00:10:26.800 of where intimations captured from the more 204 00:10:26.800 --> 00:10:29.200 we can use a People Finder. So you 205 00:10:29.200 --> 00:10:33.300 could switch for a person on Android ization to verify, whether 206 00:10:32.300 --> 00:10:36.300 the person actually work with sin. Institution 207 00:10:35.300 --> 00:10:38.500 organization, is also 208 00:10:38.500 --> 00:10:41.200 any sort of additional information that may 209 00:10:41.200 --> 00:10:43.700 lead to verify to listen to. We Can. Company 210 00:10:44.100 --> 00:10:47.300 Another great place we can check is called Shoot on. 211 00:10:47.300 --> 00:10:50.700 Shoot on is pretty much a search engine 212 00:10:50.700 --> 00:10:53.500 for devices with your own internet. So 213 00:10:53.500 --> 00:10:56.500 other words, it's a search engine for iot devices. 214 00:10:56.500 --> 00:10:59.100 As a really, really powerful. Actually, we can 215 00:10:59.100 --> 00:11:02.500 find a lot of devices up tops belongs to various 216 00:11:02.500 --> 00:11:05.200 companies. You can look for vulnerabilities. We can 217 00:11:05.200 --> 00:11:09.000 even see things that we thing. 218 00:11:08.300 --> 00:11:11.400 No one else sees when connected device to 219 00:11:11.400 --> 00:11:14.200 a network to leverage a parachute and you will definitely 220 00:11:14.200 --> 00:11:17.600 need our account. So just give me one second. 221 00:11:17.600 --> 00:11:20.900 I'm going to log into my account here. Okay. 222 00:11:20.900 --> 00:11:23.100 So now I have been logged into my 223 00:11:23.100 --> 00:11:26.300 account. But I'm going to Isleta fight song 224 00:11:26.300 --> 00:11:30.000 by switch for Windows server and 225 00:11:29.400 --> 00:11:32.300 hit enter search on. This 226 00:11:32.300 --> 00:11:35.300 is going to show me all the Windows Server around the 227 00:11:35.300 --> 00:11:38.700 world. Now. This is not every window silver, but all 228 00:11:38.700 --> 00:11:41.600 the windows servers that it has attracted around 229 00:11:41.600 --> 00:11:43.800 the world to be directly connected to the internet. 230 00:11:44.700 --> 00:11:47.800 Sakura, you can see that there are above two million 231 00:11:47.800 --> 00:11:50.400 devices. Retained as a result. 232 00:11:50.400 --> 00:11:53.400 For Windows Server. We can see the amount in various 233 00:11:53.400 --> 00:11:56.300 countries. We can see where you're supposed to call and 234 00:11:56.300 --> 00:11:59.200 we can seat up organization. You can even see 235 00:11:59.200 --> 00:12:02.700 products and we could even sort out based on certain versions 236 00:12:02.700 --> 00:12:05.600 of Windows server. For example, right now 237 00:12:05.600 --> 00:12:08.800 my stuff is using Windows Server, 2019. And I 238 00:12:08.800 --> 00:12:11.600 think ideas on your vacation is going to release sometime soon 239 00:12:11.600 --> 00:12:14.400 if it's not already released, but there's 240 00:12:14.400 --> 00:12:17.700 a lot of organizations and even users 241 00:12:17.700 --> 00:12:20.000 around the world. Who's you see? How much more older version of 242 00:12:20.300 --> 00:12:24.400 Windows server? For example, there's Windows Server 2008 243 00:12:23.400 --> 00:12:26.800 2012 as well. So that's 244 00:12:26.800 --> 00:12:28.700 it. For example, I click this year. 245 00:12:29.100 --> 00:12:32.300 What is due now? It will filter the results for me 246 00:12:32.300 --> 00:12:33.100 and show me. 247 00:12:34.500 --> 00:12:37.900 A very specific result for 248 00:12:37.900 --> 00:12:40.400 Windows Server, 2008 R2 in the 249 00:12:40.400 --> 00:12:46.500 price is for 250 00:12:45.500 --> 00:12:48.200 Maltese be. So 251 00:12:48.200 --> 00:12:51.300 I thought it up routing system. And sometimes, if you 252 00:12:51.300 --> 00:12:54.300 are attacking a system from across into that, you'll need 253 00:12:54.300 --> 00:12:57.300 to look for some call. Delois. Hi, Aunt. Ruth's the lowest high 254 00:12:57.300 --> 00:13:00.300 and fruits are pretty much the sounds of a very easy 255 00:13:00.300 --> 00:13:03.500 to break into because the vulnerabilities are very Wiley. 256 00:13:03.500 --> 00:13:06.100 Nude on pops. Organization did not pass shoes on 257 00:13:06.100 --> 00:13:09.200 her abilities. The cool thing is if we click 258 00:13:09.200 --> 00:13:13.600 on one of these will get much more specific information about the 259 00:13:12.600 --> 00:13:15.200 actual silver. No, keep in 260 00:13:15.200 --> 00:13:18.900 mind that we are not talking and you on right now, we are not tired targeting 261 00:13:18.900 --> 00:13:21.300 any political organization when users around the 262 00:13:21.300 --> 00:13:24.600 world. What should Anna showing us has publicly available 263 00:13:24.600 --> 00:13:27.300 information at anyone around, will come see. 264 00:13:27.300 --> 00:13:30.400 So for example, that I click on this 265 00:13:30.400 --> 00:13:33.300 was organization here, simply by clicking the IP, 266 00:13:33.300 --> 00:13:34.400 you can get more 267 00:13:34.500 --> 00:13:37.800 Spell information. I could see all open ports, these 268 00:13:37.800 --> 00:13:40.400 Porter, service ports. And as you know, is Super 269 00:13:40.400 --> 00:13:43.700 Sport. Simply is opened to accept 270 00:13:43.700 --> 00:13:47.000 incoming message or to send a 271 00:13:46.500 --> 00:13:49.700 message on EC Porters 272 00:13:49.700 --> 00:13:52.300 open on Lexi Savoie. It simply means 273 00:13:52.300 --> 00:13:56.700 that this was running specific services or applications 274 00:13:55.700 --> 00:13:58.300 would require this also upon 275 00:13:58.300 --> 00:14:01.600 the cool thing about Sudan, as it 276 00:14:01.600 --> 00:14:04.400 will show you a little description about each of 277 00:14:04.400 --> 00:14:07.600 these ports. As you go down food and shows us the bombing finish 278 00:14:07.600 --> 00:14:10.500 as well. Sometimes, when 279 00:14:10.500 --> 00:14:13.300 you click on Lexi public IP, or without 280 00:14:13.300 --> 00:14:16.200 a result inside. Oh, shoot on. It will show you 281 00:14:16.200 --> 00:14:19.300 known for abilities as well. Some of the most scariest 282 00:14:19.300 --> 00:14:22.600 things, as if you click on images, it will 283 00:14:22.600 --> 00:14:26.100 show us. Let's see, for example, 284 00:14:26.100 --> 00:14:29.900 if you click on images, this should 285 00:14:29.900 --> 00:14:32.600 take a few seconds to load up, but 286 00:14:32.600 --> 00:14:34.300 it would simply what is going to show us. 287 00:14:34.400 --> 00:14:37.200 It's all the logins or like a 288 00:14:37.200 --> 00:14:41.000 login screen off a Windows Server machine. So, as 289 00:14:40.100 --> 00:14:43.500 we can see, these are the actual 290 00:14:43.500 --> 00:14:46.700 screenshot of what he can buy show done. Again. 291 00:14:46.700 --> 00:14:49.900 This is publicly available information. So, please 292 00:14:49.900 --> 00:14:53.700 don't use this information for anything malicious or any 293 00:14:53.700 --> 00:14:56.600 sort of thing up, me, carry you to any sort of legal 294 00:14:56.600 --> 00:14:59.400 problems. Another site with mentioned School 295 00:14:59.400 --> 00:15:02.900 census, census required to have a user 296 00:15:02.900 --> 00:15:05.500 account. Actually, leverage of power. All sensors 297 00:15:05.500 --> 00:15:08.700 sensors are sort of like Shootin. It 298 00:15:08.700 --> 00:15:10.600 gives you an additional information about 299 00:15:11.400 --> 00:15:15.000 Ibiza, human insert into senses 300 00:15:14.300 --> 00:15:17.700 another cool side. We can check the, 301 00:15:17.700 --> 00:15:20.400 let's see. The web application of a tiger web 302 00:15:20.400 --> 00:15:25.100 server is called Netcraft simply identify 303 00:15:23.100 --> 00:15:27.600 the running applications services 304 00:15:26.600 --> 00:15:29.400 and Technologies or photography of 305 00:15:29.400 --> 00:15:32.600 silver website, which 306 00:15:32.600 --> 00:15:36.500 is not kraft.com on what you're looking for. Is 307 00:15:35.500 --> 00:15:39.200 a very special box that 308 00:15:39.200 --> 00:15:43.300 says, what's that side running errands? I 309 00:15:43.300 --> 00:15:46.300 do mean such as what c h, e d p, s colon slash 310 00:15:46.300 --> 00:15:50.900 slash www.pandora.com. 311 00:15:50.900 --> 00:15:53.400 Al.com. And we 312 00:15:53.400 --> 00:15:57.900 can simply had this look like on here to begin our search. And 313 00:15:56.900 --> 00:15:59.800 this is going to be 2 in the results for 314 00:15:59.800 --> 00:16:03.500 all the Technologies at this web service actually running. So 315 00:16:02.500 --> 00:16:05.500 right now, it's currently well. It 316 00:16:05.500 --> 00:16:08.900 has no finish analyze website and you can see here. 317 00:16:08.900 --> 00:16:11.500 The first dated was seeing the primary 318 00:16:11.500 --> 00:16:14.600 language. We can see the site 319 00:16:14.600 --> 00:16:17.400 where the site is located way to 320 00:16:17.400 --> 00:16:22.000 serve public, ipv4. And IPv6. Do 321 00:16:20.100 --> 00:16:23.900 you mean information registration to 322 00:16:23.900 --> 00:16:26.400 missions? Well, we can see IP address 323 00:16:26.400 --> 00:16:29.500 of the descriptions. I could even get a 324 00:16:29.500 --> 00:16:32.400 geographic location as well. Be Sony 325 00:16:32.400 --> 00:16:34.500 IP addresses that were used on the silver. 326 00:16:34.900 --> 00:16:37.500 We can get the SSL TLS 327 00:16:37.500 --> 00:16:41.100 information, for its data, encryption. Dr. 328 00:16:40.100 --> 00:16:43.800 Rice between the web browser, web server the 329 00:16:43.800 --> 00:16:46.500 city, petite information. We can even see 330 00:16:46.500 --> 00:16:49.400 the net profit trying to eat to and what are the web 331 00:16:49.400 --> 00:16:52.200 application. What it's possible to the pool or 332 00:16:52.200 --> 00:16:55.800 talk with his phone, number to the heartbeat attack. We can 333 00:16:55.800 --> 00:16:58.900 see the whole thing information as well, so we can see where this 334 00:16:58.900 --> 00:17:03.000 will settle for a. Of time. The systems 335 00:17:01.100 --> 00:17:04.400 are two, who's staying there, while 336 00:17:04.400 --> 00:17:07.500 I web application, in this case, you can see some rock 337 00:17:07.500 --> 00:17:10.500 stars who sings optician a, but we 338 00:17:10.500 --> 00:17:14.100 are not able to see the actual web application platform itself. 339 00:17:14.600 --> 00:17:17.400 We have to send the policy 340 00:17:17.400 --> 00:17:20.300 daddy Mark additional technology started being 341 00:17:20.300 --> 00:17:23.200 used within the web application of the web server 342 00:17:23.200 --> 00:17:26.100 as well. Such information will be very useful 343 00:17:26.100 --> 00:17:29.400 to a tractor because Detroit African. Now 344 00:17:29.400 --> 00:17:32.700 look for any sort of vulnerabilities Within These well applications and 345 00:17:32.700 --> 00:17:34.800 try to attempt to exploit it. 346 00:17:37.200 --> 00:17:40.800 Additionally, we can even try to perform DNS enumeration. 347 00:17:40.800 --> 00:17:41.900 I want to talk. 348 00:17:42.900 --> 00:17:45.400 So we can begin by Alexia playing all command 349 00:17:45.400 --> 00:17:48.100 prompt in windows. Are you can use a n s look up to 350 00:17:48.100 --> 00:17:51.700 so you can see me type and ass. Look up on Breast Center Loop. 351 00:17:51.700 --> 00:17:54.500 Sorry. I spelled it wrong. So and as look up 352 00:17:54.500 --> 00:17:57.100 an answer, I was going to 353 00:17:57.100 --> 00:18:00.300 return your DNS server that you are using. So I'm currently 354 00:18:00.300 --> 00:18:03.800 using call swear. I'll probably go. So I 355 00:18:03.800 --> 00:18:06.500 could change it to Alexa for a sample. Google 356 00:18:06.500 --> 00:18:10.200 public, DNS, which is 8888. It 357 00:18:09.200 --> 00:18:12.200 answer. Now on this is going 358 00:18:12.200 --> 00:18:15.700 to query while it was sent all these queries now to Google 359 00:18:15.700 --> 00:18:18.700 DNS server. So for example, if I 360 00:18:18.700 --> 00:18:20.900 use, let's say set tight. 361 00:18:23.600 --> 00:18:26.200 Equally, honestly, I switch with 362 00:18:26.200 --> 00:18:30.300 www.microsoft.com. This is 363 00:18:30.300 --> 00:18:33.400 going to be two in the DNS record for me 364 00:18:33.400 --> 00:18:36.200 of this web server. Should I would say 365 00:18:36.200 --> 00:18:39.400 going to give me the ipv4 address of this web server? 366 00:18:40.300 --> 00:18:42.200 Additionally, I can do set type. 367 00:18:43.500 --> 00:18:47.200 Equal Amex, Amex specifies, 368 00:18:46.200 --> 00:18:52.000 the Miller Shayne Silver's only, which 369 00:18:51.100 --> 00:18:55.000 is microsoft.com his answer, 370 00:18:54.700 --> 00:18:57.200 right here. We actually 371 00:18:57.200 --> 00:19:00.700 get the email server for the 372 00:19:00.700 --> 00:19:02.100 microsoft.com do mean. 373 00:19:03.700 --> 00:19:06.900 Freedom, or we can specify to all. 374 00:19:06.900 --> 00:19:10.000 So we could see a subtype equal 375 00:19:09.300 --> 00:19:12.400 all on this. Should give me all the records were 376 00:19:12.400 --> 00:19:15.300 able to go to do mean. So let's switch back 377 00:19:15.300 --> 00:19:19.000 for microsoft.com. His answer on. This 378 00:19:18.200 --> 00:19:21.400 should take Hoops. I actually finish already 379 00:19:21.400 --> 00:19:24.600 so that screw up on 380 00:19:24.600 --> 00:19:27.900 here. You can see all the internet addresses, the game 381 00:19:27.900 --> 00:19:30.600 servers be considered public name 382 00:19:30.600 --> 00:19:33.400 server. The primary nameservers. We can see 383 00:19:33.400 --> 00:19:36.500 any sort of additional DS record. Team have 384 00:19:36.500 --> 00:19:39.200 entered on the Indiana. Sue has publicly available 385 00:19:39.200 --> 00:19:42.100 to anyone on the internet. 386 00:19:42.700 --> 00:19:45.400 Additionally, we can 387 00:19:45.400 --> 00:19:48.700 use for your suit in Kali Linux, help us perform DNS 388 00:19:48.700 --> 00:19:51.200 enumeration. So to do 389 00:19:51.200 --> 00:19:55.000 this, let's click on the Cali icon here. Click 390 00:19:54.700 --> 00:19:57.800 on information gathering 391 00:19:57.800 --> 00:20:00.900 and we can see Daddy has DNS 392 00:20:00.900 --> 00:20:03.100 analysis. Let's click on that 393 00:20:03.100 --> 00:20:06.200 and it's like the DNS in them too. 394 00:20:06.200 --> 00:20:09.400 So that's why 395 00:20:09.400 --> 00:20:12.100 I open the application. We can see a lot of options are 396 00:20:12.100 --> 00:20:15.200 available. So they get started. Let me 397 00:20:15.200 --> 00:20:20.200 clear screen so we can see this a bit more and to 398 00:20:19.200 --> 00:20:22.800 actually perform it dies in numeration on 399 00:20:22.800 --> 00:20:26.000 as a Target. We can use a common DNS, you know. 400 00:20:30.300 --> 00:20:33.400 Like so use Dash D to specify do 401 00:20:33.400 --> 00:20:36.600 mean and then to specify do my name, which is 402 00:20:36.600 --> 00:20:40.700 Microsoft and Jessica answer. Apparently I 403 00:20:40.700 --> 00:20:41.500 missing something. 404 00:20:42.600 --> 00:20:46.400 So, let's see what I'm missing. So do 405 00:20:46.400 --> 00:20:50.100 you ask, you know, I need to specify the options 406 00:20:49.100 --> 00:20:53.000 to actually use 407 00:20:52.100 --> 00:20:55.600 on. Let me do just stopped. 408 00:21:01.200 --> 00:21:04.800 I need to specify Google DNS server, space 409 00:21:04.800 --> 00:21:07.400 on the URL, look up 410 00:21:07.400 --> 00:21:08.700 the results of a command block in. 411 00:21:09.200 --> 00:21:12.800 So simply by using DNA Sanam, 412 00:21:12.800 --> 00:21:16.100 you specify the DNS server come 413 00:21:15.100 --> 00:21:18.100 out together with a DNS server. If you want 414 00:21:18.100 --> 00:21:21.900 to use as a query and then I'll do mean on within 415 00:21:21.900 --> 00:21:24.500 a few seconds. It was able to actually perform the 416 00:21:24.500 --> 00:21:27.200 query to Google DNS. Able to retrieve all of 417 00:21:27.200 --> 00:21:30.600 these records for us. They are records or premature 418 00:21:30.600 --> 00:21:34.000 whose addresses are simply the public IP addresses. 419 00:21:33.700 --> 00:21:36.400 Assigned to the. Do means we can 420 00:21:36.400 --> 00:21:39.500 see the name suicide are also associated with 421 00:21:39.500 --> 00:21:42.800 a do mean, we can also see the mule Silver's 422 00:21:42.800 --> 00:21:46.300 on currently detected too, and we 423 00:21:46.300 --> 00:21:49.400 can see, even do the whose name's look really similar, 424 00:21:49.400 --> 00:21:53.000 but it's actually two different IP addresses for the 425 00:21:52.300 --> 00:21:55.700 motor to will attempt to perform Xoom transfer, 426 00:21:55.700 --> 00:21:58.400 which is a vulnerable to talk to, 427 00:21:58.400 --> 00:22:01.900 to retrieve various Zone, 428 00:22:01.900 --> 00:22:04.700 records from a Target DNS server and 429 00:22:04.700 --> 00:22:07.400 Diesel records may contain. Let's see 430 00:22:07.400 --> 00:22:09.200 confidential private in 431 00:22:09.200 --> 00:22:13.100 Nissan does regarding two assets networks, 432 00:22:12.100 --> 00:22:15.500 even whose only to Northside of 433 00:22:15.500 --> 00:22:16.500 analyzation at work. 434 00:22:17.600 --> 00:22:20.400 In this way. Do you take a look at understanding the 435 00:22:20.400 --> 00:22:24.300 fundamentals of osint, which is open source intelligence. I 436 00:22:23.300 --> 00:22:26.800 have gained experience and Performing 437 00:22:26.800 --> 00:22:29.300 open source intelligence using popular tubes. 438 00:22:30.600 --> 00:22:33.500 In the next video will take a look up performing Network 439 00:22:33.500 --> 00:22:36.200 on Port scanning for your husband, a 440 00:22:36.200 --> 00:22:39.100 formative for you and I will see you in the next one.