>> Hey guys. Welcome back to
the Cyber Kill Chain course on Cybrary.
This is Abdulrahman A. Alnaim.
In this episode, we're going to start
>> our target attack.
>> Step 1, reconnaissance.
Going back to the kill chain,
we had these seven steps that we went over.
The first step is reconnaissance,
and I pointed this before that reconnaissance
sometimes is overlooked,
especially when it comes to [inaudible].
However, reconnaissance is one of
the most important step in this kill chain,
because reconnaissance is the base that you
build your whole attack on.
As I said before, we're going to use
the information that we gain today,
an organization, delivery,
exploitation, and then
continuously using it until the end of the attack.
You need to get as much information as possible.
In reconnaissance, you want to gather
information on the target
before actually starting the attack.
There are two ways of doing reconnaissance;
there's passive, and active.
Passive is the one that you want to spend your time in.
Because in passive,
the target does not even know
>> that you're actually trying
>> to attack him because you're looking
for publicly available information,
you're not interacting with the target,
you're not trying to do any network sweeps,
you're not trying to do
any vulnerability assessments, or anything.
You're just going through the Internet,
looking for information that is publicly available.
You can take your time in passive.
However, when it comes to active,
and I've seen this before in a number of companies;
as soon as you ping them,
they will notice that someone is
actually trying to interact with our systems.
You want to be sure,
>> or the attacker wants to be sure that
>> he pays more attention, or
he tries to be more passive than active,
because you don't want them to know
that you're actually doing anything,
and that step is too early in
the attack for them to actually notice you.
In passive, again,
some people call it footprinting,
you're looking for publicly available information.
This can be Whois, nslookup,
there's a couple of other websites
that you can go and visit,
and we're going to go through them in a minute.
Also social media tend to be one of the best resources,
because we tend to put
a lot of information in social media,
LinkedIn is one of the most popular.
When you go to LinkedIn,
visit your friend's page on LinkedIn,
you'll find certifications.
When someone is certified in supporting a Cisco device,
most probably his company
>> uses that Cisco device itself.
>> The same thing goes for Linux,
Windows if he is certified in Red Hat.
Most probably his company, or the company that he works
for uses Red Hat.
Social media is one of the things that a lot of
hackers spend time in, especially in reconnaissance.
It's not only systems,
it's also something that you might find of interest.
If you go to someone's Facebook page,
and you find that he's
interested in scuba diving as an example,
or he's interested in
horseback riding, or something like that,
you can design a phishing email, or
a social engineering campaign direct
to that guy, and catch his interest.
As a scuba diver,
you would send them something like,
the Great Barrier Reef is dying.
You need to go there before it all goes away.
Click here to find
the best deals for the Great Barrier Reef.
Any diver, when he hears something like that,
he would be, okay, I have to go
now or the Great Barrier Reef is going.
Most probably he'll be clicking.
The last thing is dumpster diving.
Dumpster diving is one of
the most disgusting things that I've ever heard of.
They actually go to dumpsters.
Basically when companies finish
from a piece of paper, or something like that,
they don't usually thread
it or get rid of it in a secure manner.
A lot of companies just throw it in the garbage,
a lot of employees just
don't think, and just throw it in the garbage.
All of these documents,
all of these manuals go to the dumpster at the end.
Someone can jump in there,
look into this company's dumpster,
and then find out that they have this manual.
Some people actually like passwords,
some people like the configuration
that they actually did,
or if you have a hardening document, or
a technical configuration baseline in your company,
someone might have his hand on it.
Let's do a couple of passive reconnaissance.
Again, we'll try to spend as much time here as we can.
The first thing that I want to do is
go here and just say, whois.
Then let's say cybrary.it.
The first thing that you noticed
is admin contact is hidden,
technical contact is hidden.
There's a lot of information here.
One was the website created,
the last update, and so on.
In many other organizations,
you'll find the contact name out there.
You'll find contact email,
you'll find a lot of information
about who's supporting this website.
That's extremely important because usually admins,
or web admins, or
system admins have excessive privileges.
If an attacker wants to hack someone,
usually go for these guys, the whales,
the people that actually make a difference, and have
access to a lot of information.
Who is basically we're just checking
>> a public database.
>> We did not even interact with the systems,
with Cybrary IT system, or anything like that.
The next thing that we're going to do is nslookup.
Nslookup, what we're doing,
again, we're going to go to Cybrary.
What we're doing is we're trying
to find out the IPs of nslookup.
From the IP, you can say
which country this is hosted on.
There's a lot of other information that you can
get such as there are three servers,
they seem all to be in the same country.
However, in other websites,
you'll find a lot more information.
Obviously Cybrary, it
pays attention to these things, and that's why
they're the best training center in the world I guess.
We'll go to the next one,
which is the websites that I was talking about.
We have Censys.
We're skipping here.
The first thing is Censys.
In this case, we're going to do the same thing exactly,
so cybrary.it, [NOISE] hit ''Enter''.
Then this website will give us a lot
of hosts and a lot of information about Cybrary.
It gives you all of the servers,
where are they hosted,
the URLs, what are the open ports, and so on.
That's one example.
The other one is Shodan,
which you need an account,
there's a free account and then
there's an upgrade account.
I have a free account.
I'm going to do the same thing again.
>> Again, what we're doing now,
we're not talking to the back-end server,
or we're not communicating
to establish server, or anything.
If we look at this, again,
it would give us some information
about the technologies that are used,
the ports that are open,
what are the services available,
they have an SSL certificate, and so on.
Again, this is a very high level example.
I did not get into details here.
However, if you take each and
every IP and then who has this IP
and then who has the other IP, and do it recursively,
you'll gain a lot of information that would actually
help you during the attack.
Let's go back to our slides.
This is the passive reconnaissance footprinting
where we're looking for publicly
available information on the Internet.
Once again, you want to spend
as much time as you can here,
gather as much information as you
can here before moving to
the active part of reconnaissance,
which is more technical audience,
starting with interaction with the server.
It can be a vulnerability scan,
it can a web application scan.
The example that I'm going to show
you is a fingerprint scan.
What we're time to do,
is basically we're trying to know what
kind of server are we communicating to.
I got the IP before,
and I know what's the IP that I'm communicating to.
However, I don't know what the server is.
I don't know what ports are exactly open.
I know the web ports that are open, 80 and 443.
However, I need more information
, and that's fingerprinting.
A great tool to do that is Nmap.
I'm going to leave a link to
Nmap and a couple of documentation that has to
do with Nmap in the Resources page.
Then this time we're not going to [inaudible].
We're going to use scanme.nmap.org,
which is a public website by
Nmap themselves to test
their scanners and we're allowed to use it,
but not obviously overuse it.
I'm going to run this. I'm going to get the dash,
or I'm going to get the operating system
of the server host in scanme.nmap.org.
Let's go back to the top,
and I got of the IPs out there.
I have the ports, I have Port 8,
which is basically web,
and then I have 22, which is SS8.
For some people, this is promising,
you can go and look into it.
Then you have a couple of other sources.
When you look at OS,
because they don't actually login to the OS and they
cannot basically run a command on those OS's,
it's an aggressive OS guessing.
They get a number of sources that
are basically available from the outside,
and then based on that guess, the OS,
so the randomization in the reply of the ping,
the open ports as an example,
as a search would give you
an indication that this is more of
a Linux server rather than a Windows server and so on.
You find a number of operating system.
Most of them are Linux,
differentiate from one to another.
But this would give you an idea.
But imagine if there's an open port here,
and I can go through the ports one by one.
But imagine if there's an open FTP port here.
That would give me an idea,
there's an open FTP port,
I can use it later on in delivery
or in one of the following stages.
The same thing goes if I have
a VNC port open.
I know that there's a task that there's
unsecure remote access available for me to go ahead
and try to either boot force it or maybe it's just
wide-open or is using a default password.
That's active reconnaissance.
Moving to the post-assessments question now.
Now that we've covered
the active and passive reconnaissance,
what is the purpose of reconnaissance?
I talked to all about this in a bit.
I said reconnaissance is the base of an attack.
We're building the attack based
on the information that we get from the reconnaissance.
We're trying to get as much information as we
can and reconnaissance to help us go through the steps.
So reconnaissance is like
the stop at the beginning of the race where you want to
get all of your energy and all of
your excitement for the upcoming race.
So reconnaissance is one of the most important steps.
What are the main types of reconnaissance?
We said there is passive and active.
Passive reconnaissance is when
you do not interact with the end system.
Then active reconnaissance is when
you interact with the end system.
True or false: Ping and
nslookup are example of passive reconnaissance.
That's actually false. Nslookup is passive.
However ping you're communicating with the end server.
A lot of people use ping to get the IP, however,
nslookup would give you the IP as well without
interacting with the end server or the target server.
How is posting information on
social media help adversaries?
We've talked about this in a little bit.
We said that any information that you post
whether your LinkedIn your certifications or
any interest that you have can be used
against you in a social engineering attack.
If you post a certification supporting
XYZ system on LinkedIn or on your resume,
I'll be able to know that your company support
that system or has this system.
If it's a firewall, I know your company has
a firewall it puts into a device and
your company has a device that's
a operating system or server
operating system, I'd know that too.
On the other hand, when it comes to social aspect,
as a hacker, I
can create a phishing campaign against
a certain employee using
the information that are available on his Facebook,
Twitter, or Instagram account.
Using this information, I can design
a campaign that is targeted specifically to this guy.
Next, the IP I get from running an nslookup
on the company's website is the only one I need.
That's actually not true because
a lot of the IPs that you get from
nslookup are your load balancers or your gateway IPs,
and you need to do more research there.
Again, as I said,
when you go through a census,
>> and [inaudible] and so on,
>> you need to take each and
every IP, and then search it more.
The resources, I'm going to
>> leave a link to [inaudible],
>> there you can go and explore yourself.
In this brief lecture,
we discussed the reconnaissance step of the kill chain,
active, and passive recon.
We went over a couple of
examples of active, and passive recon.
In the next episode we're going to talk about
weaponization phase, and techniques.
Thank you so much, and see you in weaponization.