>> Hey guys.
>> Welcome back to this
>> cyber kill chain course in Cybrary.
>> This is Abdulrahman Alnaim
>> and in today's episode
>> we're going to continue reconnaissance.
>> As I said before,
reconnaissance might be one of
the most important steps during a targeted attack.
The hacker wants to gather
as much information as possible during reconnaissance.
Reconnaissance will help him,
in the following six steps.
It would make life a lot easier
>> when you have all of the information handy,
>> and you know what to expect during an attack.
Well, we only covered the passive
>> type of reconnaissance
>> where we got the IPs,
>> we got the URLs,
we got the users.
We went through social media,
we know who's the system admin, and so on.
However, we still need more information
>> that would help us later on.
>> Something that would help us in delivery,
something that would help us in installation,
and even in organization.
The passive reconnaissance was looking
>> for publicly available information,
>> now we need to get more active
>> we need to start interacting with the target.
>> We need to get this information,
but from the target.
This can be technical and non-technical,
keeping in mind that
the target is not necessarily a system.
In technical, a vulnerability
scanning is one of the most popular activities here.
Because what you're doing
>> is you want to find the vulnerability
>> that you would exploit.
>> Running a vulnerability scan is
very popular during reconnaissance.
You will get what are the available services.
You'll get what are the vulnerable
services that are used.
You'll also get the vulnerable OS
if they're using a vulnerable OS,
something they're using a web application
>> or the system is hosting a web application.
>> Some of the scanners would actually give you
>> the vulnerabilities end of application
>> or the dependencies that are used by the application.
>> Keeping in mind that web applications
usually are extremely targeted.
Because oftentimes the application server
hosting the web application is
running as root or administrator,
so if you get access to a vulnerability
that would allow you to run code on the application.
You will run code as root
>> because you will run as the application server
>> or running the web application.
>> Vulnerability scanning is crucial.
You want to use all of the information
>> that you get from passive, the IPs, the links,
>> the URLs dependencies,
or the communication that we got from the passive
>> and run a vulnerability scan against it.
>> Obviously, you want to be as quiet as possible
>> because you don't want the target
>> to notice any scanning that is going on.
>> The second thing is fingerprinting.
In fingerprinting,
>> what we're to get is what are the open services.
>> What are the available services?
What are the open ports?
Most importantly, what is the OS?
One of the most popular tools is nmap,
obviously nmap does a lot more than that.
There's also a virgin up nmap
that is GUI-based and called Zenmap.
I'm going to leave in the resource pages,
>> links to nmap, Zenmap
>> and resources that would help you
>> get information about nmap and Zenmap.
Let's go here.
>> Nmap provides a offset
>> that is out there to be scanned.
>> Obviously, you'll have to be polite
scanning it and not overdo it.
Overscore the scanme.nmap.org.
Let's run the scan and see what
information we're getting back.
As I said, what we want
>> from the scan is the open ports,
>> the available services
>> and most importantly, the OS itself.
>> We don't have this information.
The open ports, I know,
you might say and sensors or shouldn't we got
this information that 80 and 443
>> were opened in Cybrary.
>> However, this is obvious because
>> these are web applications and web applications
>> tend to use 80 and 443.
However we need to get more information
about the operating system here.
We get Port 22 open, which is a subset.
This would give us an indication
that is actually a Linux.
The other thing that they do
>> to guess the OS is TCP sequence.
>> TCP sequence would actually give the nmap
some information that would help them make
>> an educated guess about the operating system.
>> Obviously, we got a number of operating systems.
They're all in the 90s guessing score.
But all of them actually are Linux operating systems.
That's nmap.
>> This is the information that we got from nmap.
>> Sometimes you'll get something like an open FTP port
>> or even a VNC port that is open.
>> I've seen this before a VNC port was open.
When you go to your browser and run
any VNC application targeting that port,
you get automatic GUI based connection
to the server hosting the application.
The next thing is web applications scanning
and this would give you hidden links.
It would give you also
>> a few [inaudible] through an application
>> would give you all the links available,
all of the services available,
the dependencies available.
You can also look at
>> if they have a portal for administrators,
>> a portal for employees.
This would be given using web applications scans.
One of the most famous applications
scanning tools are burp Suite or ZAP,
and these are both proxy scanning the tools.
The other type of active reconnaissance
>> is not technical.
>> The first one that is not very popular,
>> however, it can happen is physical interaction,
>> where an attacker would actually go
>> and communicate with the target.
>> Again, the target is not necessarily a system.
However, they can talk.
He can meet with him or see him
>> or follow him to a bar or a cafe
>> or something like that,
>> and start communicating with him.
>> The other thing is social media.
Again, it's often used as a hub
for active reconnaissance to where a message on
Facebook or an email in LinkedIn would be
sent to one of the target employees
>> or the target system admin with
>> an interesting information
>> or interesting Garfield or something like that,
>> that the hacker got during
the passive reconnaissance space.
Then more interaction between
the hacker and the target
>> would give the hacker more information about
>> the targeted system or the target himself.
We covered reconnaissance, active and passive.
We have a number of questions.
True or false.
Ping and NSlookup are examples of
>> passive reconnaissance.
>> Well, NSlookup is but ping
is not because you're communicating
>> with the Nserver or the target server.
>> I've seen a lot of companies with
good security operations centers that they actually
monitored the ping attack and investigate
any malicious or something that will look malicious,
even if it was just a ping attack.
However, in NSlookup what you're doing is
you're querying the DNS.
The second is how can I determine the OS of the target?
As I said, one way as Nmap,
a lot of vulnerability scanners would
actually try to predict the OS as well.
A 100 percent is not usually feasible
>> because this information is hidden.
>> In three years what would a vulnerability scan
>> add to my targeted attack?
>> As I said, you would get the vulnerable services,
you would get the open ports,
you would get if there's a vulnerability
>> in the whole application or the dependencies
>> hat are used by the application.
>> Finally, how can an attacker use
social media in active recon?
As I said, he can use the information
that he gathered during
the passive reconnaissance
>> and create a targeted campaign
>> as peer phishing attack on a system admin
>> or an employee can get his passwords.
>> He can get him to click a link that would run
something inside of the target and so on.
In today's lecture we covered Step 1
>> of the cyber kill chain reconnaissance.
>> We covered active reconnaissance
>> and we went through
>> a number of examples of active recon.
>> In the next video,
we're going to talk about weaponization.
The phase and weaponization techniques.
>> See you then.