-: Okay, so for now, we took a look at couple
of tools used for information gathering,
but what happens if some of the tools
stop working or if they get outdated?
What are we going to do?
We cannot depend on certain tools.
If a tool breaks we must find our way
around to do the task either using other tool
or by creating that tool ourselves.
Well, luckily there are a lot of tools available
for us to download online and we cannot cover all of them.
But what is important to cover is how we can download them.
So in this video, we're going to be searching
for an information gathering tool that we can
download online and then run in Kali Linux.
And the best place where we can find those
to download is GitHub.
Most of you, if you are either a developer
or a programmer are already familiar with GitHub.
And for those of you who don't know what GitHub is,
GitHub is world's largest community
of developers that build and share their software.
So let's see how we can download
some additional tools from there.
First of all, open up your Firefox
and when we download tools,
we either know exactly which tools we want to download
so we search them by their name
or we have no idea what tools even exist.
And this is the case where we don't even know what we want.
We only know that we are looking
for a tool used for information gathering.
So let's just type that.
In search bar type information gathering tools GitHub.
Up here, information gathering tools, GitHub, press enter.
Okay, so let's just click and go with the first link.
Information Gathering Tools.
Make sure that it is from the GitHub page
and down here it'll output us with bunch
of different tools that are used for information gathering.
As we can see in the description,
scan all possible TLDs for a given domain name.
Information gathering, website reconnaissance.
This is a program to detect probability of admin page
and we got bunch of different tools.
If we go to some other links,
we will also see some other tools available.
So from the second link we get the Sherlock,
the Photon, fsociety and Testing Bible.
If I go all the way down here is the Harvester.
Remember this tool we used in the previous video?
And by the way, if you didn't test out once again
whether you managed to get some
of the results with it, try it out right now.
And down here we will get Discover
which is also a known tool, Raccoon, Striker, Red Hawk,
Sand Map, and bunch of others as well.
And let's just go with any one of them.
Let's just go with this one.
Let us read the description.
It says all in one tool for information gathering,
for ability scanning and crawling.
A must tool have for all penetration testers.
Okay, so it seems interesting, let us click on it.
Click on Red Hawk and here is the page of the tool.
These are all of the files that the tool has.
We can see them right here.
Down here we got read me.
This is what we can perform with Red Hawk,
so we can read what are our available options with it.
And down here, released versions, change log.
Down here we also get how we can install it,
how to configure it, and we get usage.
Now, sometimes you will need to install some
of the requirements that tool needs
in order to run, and you can almost always
find the commands that you must run on this tool page.
So as we can see right here,
we got the usage and installation.
So all we need to do is follow both of them.
And different tools might need different requirements
but this is something that you will get better
at the more tools you install.
However, to just download the tool from GitHub
you will always use the same command.
And for this command,
what we need to do is we need to copy the link to this tool.
So copy up here, this link, right click copy.
Let us lower this page and open our terminal.
And the command is Git Clone.
And by the way, make sure that you're
in the slash desktop directory before you run this.
Then type Git clone space
and then paste the link and press enter.
And this is the command that we use to
download a tool from GitHub.
As we can see right here, it downloaded all of the files.
And right now on our desktop
we got the folder called Red Hawk, which is our tool.
And also keep in mind that sometimes once you're searching
for a tool, you might need to download multiple
different tools before you run into a good one.
So let's test this Red Hawk tool out.
Let's see whether it is any good.
To run it, well, we don't know how to run it,
but we can go to the Red Hawk directory
and see what files we got right here.
So we got some PHP configuration files, functions, PHP.
These are all of the files
that we really are not interested in at the moment.
If there was for example, a usage file,
we would most likely want to read that
in case the tool is complicated.
But for now, we got this Red Hawk dot PHP file.
And out of all of these files, this is the file
that seems to be the tool.
So how can we run this?
Well, first we notice what type of file it is.
It is a PHP file.
So to run it we must type PHP.
And then the file name, if it was for example, a Python file
we would type Python and then the file name.
So depending on which file type it is, we run it like this.
So PHP, Red Hawk dot PHP and press enter.
It'll load this with its banner and it tells us right here
that some of the modules are missing
and it tells us that we can try fix command
or we can simply just install ourselves using terminal.
So let's see whether this tool will install it for us.
If I type fix, checking if curl module is installed
curl module not installed
and installing curl operation requires sudo permission,
so you might be asked for password.
This asks us for sudo password and let's input it.
And it seems to be downloading the curl module
for us automatically
and we don't need to run other commands.
It is also installing the second thing, that I'm missing.
So let's just wait for this to finish.
And it tells us right here
job finish successfully, please restart Red Hawk.
So let's clear the screen and run.
Once again, PHP Red Hawk.
And right now we don't get any error messages right here.
It only asks us which website we want to scan.
So let's just go with Google, why not?
Let's see, what are the available options that we have,
enter one for HTTP or enter two for HTTPS.
And since Google is HTTPS, of course, we'll select two.
And here are all of the available options that we can use
with our Red Hawk basic recon.
Site title, IP address, CloudFlare detection.
So let's see, just the basic recon of Google.
If I type number zero, it should perform the basic recon.
And here are some of the basic output for Google.
So we got site title to be Google,
IP address, web server, CloudFlare.
And it seems to be stuck at CloudFlare,
so let's just control C it.
It could be just a bug.
And let's run it once again, type google.com,
type two for HTTPS and let's go once again
with zero just to see whether
it'll perform it correctly right now and nevermind.
It seems to be stuck at CloudFlare once again.
So let's just go with other options and test them out.
Now this is what I'm talking about.
Maybe if you don't like this tool,
maybe you want to consider going
and finding some other one.
But for now, we only tested one of the options.
So let's go with other ones as well
and see what else can we get?
The whois lookup, let's go with that one.
And we get the whois response for our Google.
Good. So this option seems to work.
It tells us scanning complete, press enter to continue.
So let's continue and let's go with geo-IP lookup.
This should tell us the coordinates of the Google
and it does tell us the country,
the IP address, the latitude and
longitude, but city and state seems to be unavailable.
Let's go with another option.
We got grab banners, DNS lookup, subnet calculator
and nmap port scan.
And this option right here is something
that we are not going to run right now
since this is something that we cover
in the scanning section.
The subdomains scanner is also something
that we are not going to be doing right now.
These options as well.
So these are just some of the advanced options
that we are going to cover later on.
So we won't be running them at the moment.
We can go with, for example
DNS lookup to check out which DNS servers it has.
And here is the output.
So this tool seems to be pretty good.
It does give us some of the information for Google.
Now of course, there are other options that we didn't run
and that I would advise you not to run
since some of them can be considered
advanced scanning methods.
But nonetheless, we will be covering them
in the next section.
So for now on what we did is we managed
to find the random tool on GitHub,
install it and get it to work.
We also tested it out
and it did give us some of the information.
Now what I want you to do for the next video
is try to download the same way a tool called Sherlock.
It is also tool from GitHub.
We saw it up here.
If I go one step back to this page,
the first tool that we saw was I believe, called Sherlock.
Try to download this tool.
It is a tool that is used to discover different accounts
on different platforms based
on the user names that you specify.
Try it out and we will see how to download it
and run it in the next video.