>> Hey, guys, welcome back to
the Cyber Kill Chain course in Cybrary.
This is Abdulrahman Alnaim and in today's episode,
we're going to start our targeted attack.
First step is reconnaissance.
As I've said before and we discussed,
there are seven steps of the cyber kill chain.
The first step, and as they said,
the most important step is reconnaissance.
Because you can think of reconnaissance as
the base of the attack when
you have good reconnaissance,
it would make the next few steps a lot easier.
You want to have good reconnaissance to
build a successful targeted attack on top of this.
In reconnaissance, we gather information on the target
before the actual attack
That's the whole goal of reconnaissance.
There are a number of ways or types of reconnaissance.
There's passive and active reconnaissance.
Passive, what we're doing is we're looking
for publicly available information on the Internet.
We're not interacting with the target.
We are trying to keep our distance.
In this phase, you can take your time
because the other side does
not really know that you're actually
started a targeted attack on them.
However, on active,
there's an interaction with the other side.
They can discover the reconnaissance going
on and then their defense based on that,
I've seen a number of companies that
monitor ping attacks to their server.
As soon as they get a ping attack,
they would actually investigate that ping attack,
where did it come from and what is
the intention of that ping attack.
Let's start with passive reconnaissance.
A lot of people call this footprinting
>> because what we're doing is we're looking for
>> publicly available information on the Internet.
We're not yet there while we communicate with
the target of this attack.
There's a number of techniques that are used
during reconnaissance or passive reconnaissance.
The first one is Whois [NOISE] and Whois would actually
give us a lot of information about the target.
Let's say we're going to
cybrary.it and this would give us the website.
It would also give us the admin of the website
and this information might not seem that interesting,
however, admins usually have
excessive privileges and if you're
planning on doing a social attack,
that's the guy you want to go for.
Because usually, he has
system admin beautiful was the next
and he has these privileges that no one else might have.
The first thing is Whois, we covered that.
The second thing is nslookup.
Let's say you have
cybrary.it but you don't actually know the IP.
A lot of people would do is they're going to ping it,
but otherwise they're just said ping is
considered to be an active attack,
an active reconnaissance because
you're actually communicating with end device.
However, nslookup is not
because what you're actually doing,
in nslookup, you're querying the DNS,
you're not actually communicating with the end device.
I'm going to copy this.
We're going to use it in the next example.
Let's go to the next one.
Censys. Censys is a website that is publicly available
and has a lot of information
about websites around the Internet.
You'll get a lot of information from Censys
that would help you during this phase.
Let's paste the IP that we just copied
here and look at the permission that would give us.
It would give us the IP address.
It would give us the routing of the IP address.
It would give us the location
of the server who's hosting it.
What is the version of TLS.
We would actually show with us the
[inaudible] is disabled and so on.
You want to spend more time here,
because if I type cybrary.it,
I would get pages and pages and pages of host IPs
and addresses that are somewhat related to cybrary.
The other example that I want to show you this Shodan,
and I'm going to do the exact same thing.
I'm going to paste the IP first,
keeping in mind that
that's not the only IP that there is,
we just saw three IPs.
If I go back to Censys,
I'm going to get a lot more
IPs than the ones that I get in Whois.
[NOISE] It would actually give us
this map and open ports and
>> services that are available.
>> Let's look at cybrary.it and
then we'll look at what output do we get.
We get a number of outputs is not
the only single one that we get before.
Most of them are in the United States.
This is the same information, however,
I'm getting the technology that they're using.
I know they're using Ruby on Rails and so on.
The next thing that I want
>> to talk about is social media.
>> Social media is a good thing
when you look at the big picture.
We started communicating with each other.
We started to learn more using social media.
However, sometimes we tend to share
a lot more than we should on social media.
There are two examples here.
The first one is the technologies that I'm using.
Let's say I work for the company and
then I add to my LinkedIn account,
saying that I can support
Cisco model XYZ and Brocade Switch XYZ2.
What happens is basically I'm
telling the attackers or the hackers,
my company uses this and this models.
This model is their firewall and this model is
their switch or a lot that they're actually using.
This might not seem like something that
is interesting to the hacker, however,
it really is because when you give him
>> this information,
>> he knows exactly what basically vulnerabilities
you might have in the future.
Or if you ever have a zero day,
trust me, he'll be the first to jump on it.
The other aspect is social media,
this is the social aspect of social media.
If you go to a less professional type
of social media like Facebook or any app,
the Instagram or any of
these less professional than LinkedIn,
where we share our personal information
rather than our professional information.
You'll find a lot of information that would
help an attacker to build a profile on someone.
You would know if he's interested
in scuba diving or in horseback riding
>> or he loves cars,
>> or soccer or football or something like that.
Then you can build a profile about this guy.
Imagine if this guy was the admin that we just
saw on Whois and he was
interested in something that you were
able to catch his interest
using one social engineering attack.
The last thing that I want to talk about here
is dumpster diving and
it's the most disgusting of the passive reconnaissance,
but it's also the only one that is actually physical.
A lot of companies disposed
their information in not so secure way.
What they do is they just throw it in the garbage
and then from the garbage back to the dumpster.
What hackers can do is jump into
this dumpster and collect this information.
If they have any manuals,
if they have any contracts,
if they have any information
>> that they don't really want
>> to share with anyone out there,
the hacker or the attacker would have
access to it through their dumpster.
We covered reconnaissance and passive reconnaissance.
Let's go back and answer these questions.
What is the purpose of reconnaissance?
The purpose of reconnaissance is to build
the base of a successful targeted attack
by collecting and gathering as much information
as possible that would help me in later stages.
Second is what are the two main types
of reconnaissance and we covered this.
There's the active where you interact with
the target and there's the passive
which we covered and you don't interact
and try to gather information
publicly available on the Internet.
Third is how is posting information
on social media help adversaries?
As we said, we're
giving a lot more information than we should.
What systems that we support?
What are the interest of system admins and so on?
The last question is the IP I get
from running nslookup on the company's website,
there's only one I need.
That's actually not true because there's a lot
of links that are hidden from
Whois or nslookup because they're sublinks
>> or they're not available for nslookup because
>> they're not supposed to be accessed directly.
In today's video, we covered
the step 1 of the cyber kill chain reconnaissance.
We talked about passive reconnaissance,
and we went through a couple of
example of passive reconnaissance.
In the next video,
we're going to talk about
active reconnaissance phase and
active reconnaissance technique. See you then.