Instructor: Welcome back.
Since this is our first video in information gathering,
we're going to start off with something easy.
Let us see how we can identify our target
and get its IP address.
We're going to check how we can do this,
both actively and passively.
Let's do it with active information gathering first.
So this means we are going to interact with our target.
So just go on Google and pick a website
that you want to use for this.
It can be any website that you want,
and you can also use the ones the I will show in this video.
First, open up your terminal, and what we are going to do
for the first test, I'm going to use this website.
(Keys clacking)
This is just some university page that they picked,
and what we can do to get its IP address is to ping it.
Most of you will already be familiar with Ping tool,
since it is installed by default on any operating system.
By pinging this website or any other website,
we're sending something called ICMP packets to that website,
and if we get responses back that means
that website is up and running.
But what we also get,
besides that response, is the IP address.
So let's try it out.
I will leave this link right here, and I will just add
at the beginning: ping, space, and then hit Enter.
And it seems that we are not getting any responses back,
but what we did get is an IP address.
Here it is.
And we are not getting responses back
from this side because it is probably blocking ping probes,
which some websites often do.
Let us try another site to see how it looks
once we get responses back.
So to stop this, you can simply just press CTRL + C,
and it'll tell us 32 packets transmitted
and 100% packet loss.
Now this doesn't mean that this website is offline,
since if we visited this link right here or this IP address,
we would open a page to that website.
But just in case, let us see how it looks like
once we get the response back from the ping command.
If we try to ping a big website, for example, like Facebook,
so let's type ping facebook.com.
Here we get an IP address of Facebook and we can CTRL + C,
since we can notice that we are getting packets back,
which means Facebook is up and running and also responding
to our ICMP packets.
Just to note, this IP address right here is just one
of the IP addresses that Facebook uses.
So for you, once you ping it, you will probably
get a different result.
Okay, what we saw right here, is an example
of active information gathering to get the IP address,
since we directly send packets to these websites.
Another tool you can use to get IP
from a website is called NS lookup.
So if I go down here and type nslookup
and then the name of the website,
which in our case, let's try with the first one,
which is this one.
And once again you can test any website you want with this.
It doesn't matter.
If I press enter, it'll give me this response,
which says server and address right here.
But this is not the IP address of this website.
This is just my router and where the result
or where the IP address of this website is is down here.
Here it is.
If we compare this one, and we go back to the ping command,
you will notice the IP address is the same.
So we got the same result, which is good.
Let's try the same with Facebook.
So just type right here nslookup facebook.com.
(Keys clacking)
And we also get the IP address of Facebook.
Now if you wanted to do this passively,
you would search for this information,
such as IP address, over some other website.
Let us see how we can do that.
First of all, we want to open our Firefox,
and to do that, just click on this Kali Linux icon,
in the top left corner and type Firefox.
You should see Firefox ESR.
Click on it.
And what we're going to look
for is a website that provides us with IP address
of a different website.
And since I don't know any website that does that,
I will simply just go right here in the search bar,
and type what is an IP address of this website.
If I press Enter, it should probably give me a few results
of different websites that will do exactly what we want,
which is get the IP address of another website.
And let's go with this one, IP checker,
which is IPinfo.info.
If I click on it and down here,
we see something that says IP/Domain Checker.
We need to specify the IP address, the Domain, or URL.
And if we type the domain name of that first website,
so if I type the same domain name
and click right here on Check.
Okay, so some security check, select all traffic lights.
Let's select all traffic lights that we see.
And here is the result.
And you will notice that right here, we get even
more information than we ask for.
For example, here is the IP address of this website.
We also get from which country it is,
as it says right here in the brackets,
and we also get its geolocation, which says even the city.
We can also check it out on Google Maps if we wanted to.
Down here we get even more information, such as Reverse DNS.
Here we get information
about registration date, modification date, expiration date.
Down here we get some of the DNS servers,
and here we get its physical address.
So this is the exact location
to where this server is located.
Now this is just the same result, I believe, down here.
We also get some email addresses,
as we can notice right here.
All this could be useful for us,
depending on which type of attack we would plan.
Now, of course, we are not going
to be attacking this website,
since we do not have permission, but we are simply
just gathering information to see what can be retrieved
from the internet about this website.
And for now on we are getting a bunch
of information about it.
Now, similar response that we got right here,
we can get using a tool called Whois.
Whois not only gives us an IP address
of the pacified domain, but it also gives us a bunch
of other information about that domain.
It is already installed in Kali Linux, so let's test it out.
If I close this page, and type in my terminal Whois,
the same domain name, press Enter.
I will pretty much get the same information
that I saw previously on that website.
As we can see right here, we get those DNS Servers,
the registration date, modification date, expiration date.
We get the physical address and some other things,
such as ID Number, Tax ID,
which is not really of interest to us.
And let us also test this tool on Facebook,
since different websites might give different information.
For example, if I do the same on Facebook,
since it being a much bigger site,
it'll probably give us much more information as well.
So let's type it, whois facebook.com.
Press Enter.
Let me just enlarge the terminal,
so we can see everything clearly.
And if I scroll all the way up, we get some name servers,
Tech Street, City, State/Province, Postal Code.
We also get some phone numbers right here.
Here are some of the email addresses for the tech email.
So we get another email address, right here,
and even more phone numbers.
We get the city, the street.
If I go all the way up,
we can see that this is a whois response,
so this all information is public to us.
And this would be pretty much it.
This is all the information we get
for Facebook using Whois tool.
And, by the way, in real penetration tests
that you will perform,
all of the interesting information is something
that you want to write down in a report.
For now, we only saw how we can get basic information,
such as IP addresses, country origin,
physical address, and similar.
But later during information gathering and scanning,
we might find something that shouldn't be out there
on the internet,
and that would be called information disclosure.
It is something that client doesn't want to be seen,
but it is still publicly available.
So anything that you might think is interesting,
you would write down.
Okay, great.
Now we know how we can identify a target
by getting its IP address,
and also getting its physical address
and some other interesting information as well.
And even though this isn't really hard information to get,
it is a good beginning.
Let us see in the next video, what else can we find out?