WEBVTT

00:00.990 --> 00:02.129
Hey, everyone, welcome back to the

00:02.130 --> 00:03.899
course. So in the last video, we

00:03.900 --> 00:05.759
went ahead and ran a command

00:05.760 --> 00:07.439
with our tool Zend map, which again

00:07.440 --> 00:09.000
is just a goofy version of any map.

00:09.330 --> 00:11.189
We went ahead and checked the to

00:11.190 --> 00:12.299
see if we could find out the

00:12.300 --> 00:13.619
operating system of our target,

00:13.890 --> 00:15.029
which in this case, our target

00:15.030 --> 00:16.769
system was the server or the

00:16.770 --> 00:18.329
Playbook zero one server,

00:18.660 --> 00:20.399
which is a Windows Server 2012.

00:20.820 --> 00:22.079
And we also checked to see if any

00:22.080 --> 00:23.459
ports were open, which again, we

00:23.460 --> 00:24.539
were able to see that, yes, they

00:24.540 --> 00:25.529
were.

00:25.530 --> 00:27.359
So in this video, we're going to

00:27.360 --> 00:28.889
talk about DEG as well as finger, a

00:28.890 --> 00:30.419
couple of commands and we can run to

00:30.420 --> 00:31.710
potentially gain information.

00:31.830 --> 00:32.830
So Digg is a tool or

00:34.020 --> 00:35.939
a tool command that

00:35.940 --> 00:37.165
we can use to potentially

00:37.920 --> 00:39.249
do DNS zone transfer.

00:39.270 --> 00:41.129
So in our lab today,

00:41.130 --> 00:41.909
we're not going to actually be

00:41.910 --> 00:43.289
successful at it. And I'll show you

00:43.410 --> 00:45.179
or I'll talk about why that is

00:45.720 --> 00:46.889
in this particular environment.

00:47.250 --> 00:48.569
But you could potentially use it to

00:48.570 --> 00:49.829
do a Dinesen transfer.

00:50.280 --> 00:51.505
But that being said, most

00:52.200 --> 00:54.060
companies are secured against that.

00:54.720 --> 00:56.129
But you may if you're targeting like

00:56.130 --> 00:57.599
a smaller organization as part of a

00:57.600 --> 00:59.369
penetration test, you may find that

00:59.370 --> 01:00.409
their their

01:01.350 --> 01:02.849
web server may be vulnerable to this

01:02.850 --> 01:03.929
type of attack.

01:05.080 --> 01:06.389
And then we'll use a finger command

01:06.390 --> 01:07.379
where we'll just take a look and see

01:07.380 --> 01:08.720
if there's other user accounts on

01:08.730 --> 01:09.509
the particular system.

01:09.510 --> 01:10.510
So I've left up from

01:11.370 --> 01:12.209
the previous lab.

01:12.210 --> 01:13.229
I've left that up because most

01:13.230 --> 01:14.369
people are just going to be
continuing

01:14.370 --> 01:16.380
through. So all you want to do here

01:16.410 --> 01:18.209
with Zend map is just minimize it.

01:18.210 --> 01:19.709
So this little dash on the top right

01:19.710 --> 01:21.209
here, just go ahead and click on

01:21.210 --> 01:22.919
that. Might take a second or so, but

01:22.920 --> 01:24.269
it will minimize it. And all we want

01:24.270 --> 01:25.859
to get to is our command window or

01:25.860 --> 01:27.209
our terminal prompt that we've had

01:27.210 --> 01:28.210
open before.

01:28.590 --> 01:29.849
What you want to do here is you can

01:29.850 --> 01:31.709
either close it out or you

01:31.710 --> 01:33.389
can hit the enemy a couple of times

01:33.390 --> 01:34.390
and get back to the

01:35.220 --> 01:36.569
the prompt there.

01:36.570 --> 01:38.187
So you'll come back there and I'm

01:38.280 --> 01:40.140
just going to type clear and then

01:40.230 --> 01:41.309
enter just to clear out that

01:41.310 --> 01:42.310
previous command.

01:43.320 --> 01:44.549
All right. So all we're going to do

01:44.550 --> 01:45.550
now is we're already

01:46.650 --> 01:48.019
past all these other steps.

01:48.020 --> 01:49.439
So if you continue on with the from

01:49.440 --> 01:50.849
the previous lab, then you're past

01:50.850 --> 01:52.550
all these initial steps here of

01:52.770 --> 01:54.360
logging into the Windows 10 machine

01:54.840 --> 01:56.457
opening, the viewer typing in the

01:56.580 --> 01:57.959
password, connecting to the Calli

01:57.960 --> 01:59.739
machine, opening the terminal.

01:59.760 --> 02:01.259
We're actually past all those steps.

02:01.260 --> 02:02.309
So steps one through six.

02:02.550 --> 02:03.569
If you continued on from the

02:03.570 --> 02:04.949
previous lab, you're good to go.

02:05.340 --> 02:06.809
If you have it, then go ahead and

02:06.810 --> 02:08.849
pause this video and just follow

02:08.850 --> 02:10.198
the steps to go through and launch

02:10.199 --> 02:11.699
the terminal window that you see in

02:11.700 --> 02:12.910
the background right there.

02:14.250 --> 02:15.990
All right. So if you've

02:16.200 --> 02:17.459
passed the video and come back after

02:17.460 --> 02:18.569
you've done those steps, or if you

02:18.570 --> 02:20.236
just continue on from the previous

02:20.310 --> 02:21.509
lab and you followed along with the

02:21.510 --> 02:22.980
steps that I just did, then we

02:23.160 --> 02:24.777
should all be a step number seven

02:24.840 --> 02:25.840
right here.

02:26.100 --> 02:27.029
So we're just going to go ahead and

02:27.030 --> 02:28.670
type in this particular command.

02:28.890 --> 02:29.968
And again, our attempt

02:31.080 --> 02:32.429
at least is to try to transfer the

02:32.430 --> 02:33.430
zone.

02:33.510 --> 02:35.099
As I mentioned already, it should be

02:35.100 --> 02:36.766
unsuccessful in this attempt based

02:36.840 --> 02:38.069
on the security settings of this

02:38.070 --> 02:39.393
lab. But I just want you to

02:39.660 --> 02:41.099
understand what we're kind of doing

02:41.100 --> 02:42.100
here.

02:42.180 --> 02:43.169
So let's go ahead and type this

02:43.170 --> 02:44.249
command in here. So we're going to

02:44.250 --> 02:46.800
do this, dig a SFR

02:47.100 --> 02:48.100
practice.

02:49.830 --> 02:51.449
Our IP address at the end here, so

02:51.450 --> 02:53.116
let's go ahead and do that now, so

02:53.370 --> 02:54.380
let's type in dig.

02:54.540 --> 02:55.709
So just like we normally do, we'll

02:55.710 --> 02:56.759
do a kind of step by step.

02:56.760 --> 02:58.349
We'll type in, dig all lowercase,

02:58.830 --> 02:59.830
we'll put a space,

03:00.780 --> 03:02.039
and then we're going to type in a

03:02.240 --> 03:03.900
SFR Oliver case,

03:04.650 --> 03:05.790
a F.R.

03:06.000 --> 03:07.169
We'll put another space

03:08.730 --> 03:09.719
that we're going to type in

03:09.720 --> 03:10.679
practice.

03:10.680 --> 03:12.479
So we'll practice with an S

03:13.170 --> 03:14.710
Dash Labs dot com.

03:16.050 --> 03:17.369
So again, all lowercase here.

03:17.370 --> 03:19.319
So practice with

03:19.320 --> 03:21.509
an S Dash

03:21.510 --> 03:22.510
Labs dot com and

03:23.520 --> 03:25.019
then finally we'll put a space in

03:25.020 --> 03:26.219
them. We're going to put our IP

03:26.220 --> 03:28.139
address here. So the 192 dot

03:28.140 --> 03:29.819
one six eight zero one.

03:30.390 --> 03:31.390
So one nine two

03:32.280 --> 03:34.229
one six eight zero.

03:35.300 --> 03:36.300
Not one.

03:37.070 --> 03:37.889
All right, so once you've talked

03:37.890 --> 03:38.930
that and just go ahead and get the

03:39.140 --> 03:40.279
key and her keyboard is going to go

03:40.280 --> 03:41.750
ahead and run the command, and

03:41.840 --> 03:42.979
you'll see almost immediately it

03:42.980 --> 03:43.980
actually felt right.

03:44.330 --> 03:45.889
And that's because we this

03:46.070 --> 03:48.169
particular set up is secured against

03:48.170 --> 03:49.459
us. So we should get that immediate

03:49.460 --> 03:50.460
failure.

03:51.620 --> 03:53.419
What you normally would see if this

03:53.420 --> 03:54.919
was successful, as we would actually

03:54.920 --> 03:56.569
get some output regarding the DNS

03:56.570 --> 03:58.650
transfer, that we were successful.

03:59.420 --> 04:00.859
So a couple of simple questions.

04:00.860 --> 04:01.759
You know, question number two, we

04:01.760 --> 04:02.689
actually just answered.

04:02.690 --> 04:04.669
So do you see any of the zone

04:04.670 --> 04:05.839
information? Were we able to

04:05.840 --> 04:06.919
actually transfer the zone?

04:07.370 --> 04:08.899
You'll see in this case that we were

04:08.900 --> 04:10.160
not successful in that.

04:10.870 --> 04:12.487
And so we do see some information

04:12.680 --> 04:14.180
regarding what we were trying to do

04:14.300 --> 04:16.040
with practice labs,

04:16.250 --> 04:18.110
dotcom and then the IP address here.

04:18.529 --> 04:20.146
But we were not successful in our

04:20.329 --> 04:21.329
attempt.

04:22.130 --> 04:23.239
And then the first question here,

04:23.240 --> 04:24.199
what is Digg stand for?

04:24.200 --> 04:25.240
So I did not mention this.

04:25.250 --> 04:26.720
So if you want to post a video

04:27.110 --> 04:28.279
on Google it real quick or if you

04:28.280 --> 04:29.719
actually know that information, just

04:29.720 --> 04:30.709
go ahead and think through what that

04:30.710 --> 04:31.710
might stand for.

04:33.550 --> 04:35.265
All right, so Dig stands for domain

04:35.680 --> 04:36.905
information, Gropper, the

04:37.540 --> 04:39.255
name is kind of creepy with the web

04:39.540 --> 04:41.139
of the last part of it there, but

04:41.140 --> 04:42.904
basically domain information gropers

04:43.180 --> 04:44.350
is what Digg stands for.

04:44.530 --> 04:46.870
And again, it's basically used

04:47.140 --> 04:48.459
in one capacity or at least in the

04:48.460 --> 04:49.749
capacity. We would want to use it as

04:49.750 --> 04:51.318
a penetration tester for our DNS

04:51.670 --> 04:53.079
on transfer or at least attempting

04:53.230 --> 04:55.389
to do a DNS zone transfer

04:56.200 --> 04:57.549
or at least move on to the next part

04:57.550 --> 04:58.749
of our lab here. Again, we're going

04:58.750 --> 05:00.159
to be using the finger command and

05:00.160 --> 05:01.329
this will wrap up this particular

05:01.330 --> 05:02.330
lab.

05:02.530 --> 05:04.269
So here at a terminal window, this

05:04.270 --> 05:05.559
go ahead and type clear if you want

05:05.560 --> 05:07.059
to and hit enter or you can just

05:07.060 --> 05:08.060
move on with the lab.

05:08.380 --> 05:09.189
It's kind of up to you.

05:09.190 --> 05:10.449
I always like to just clear it out

05:10.450 --> 05:12.069
and move on to the next command that

05:12.280 --> 05:13.280
I'm going to be doing.

05:14.460 --> 05:16.028
So in this situation, we're just

05:16.350 --> 05:18.629
going to be typing in finger space,

05:19.440 --> 05:21.389
lowercase s space root,

05:22.530 --> 05:23.879
so it's going to touch that and also

05:23.880 --> 05:25.920
finger space

05:26.130 --> 05:27.630
dash lowercase s

05:28.230 --> 05:29.230
space root all

05:30.120 --> 05:31.120
lowercase.

05:32.530 --> 05:33.729
All right, so go ahead and run that

05:33.730 --> 05:35.347
command by pressing turn keyboard

05:35.350 --> 05:36.149
there.

05:36.150 --> 05:37.569
What we're specifically looking for

05:37.570 --> 05:39.369
is to find out if we find any other

05:39.370 --> 05:40.370
users logged

05:41.200 --> 05:42.669
in besides route, because obviously

05:42.670 --> 05:44.589
we specified route and that's

05:44.590 --> 05:45.619
our route user there.

05:45.820 --> 05:47.486
So you see in the background there

05:47.980 --> 05:49.389
the answer to question number one

05:49.390 --> 05:50.949
here. Do we see any other users

05:50.950 --> 05:52.329
logged in if he has read the

05:52.330 --> 05:53.199
username there?

05:53.200 --> 05:54.817
So we do see that there is a user

05:54.880 --> 05:56.252
log in which in this case is

05:56.500 --> 05:57.609
actually route, which again, we

05:57.610 --> 05:58.610
specified.

05:58.840 --> 06:00.219
So we can jot that down if we wanted

06:00.220 --> 06:01.719
to. But we see that there's no other

06:01.720 --> 06:03.459
users, at least on my end, and you

06:03.460 --> 06:05.139
should not have a different result.

06:05.150 --> 06:06.099
You should have the exact same

06:06.100 --> 06:07.269
result here. You should just see

06:07.270 --> 06:08.199
route.

06:08.200 --> 06:09.249
And so that's our user.

06:09.400 --> 06:11.017
Now thinking, too, that along the

06:11.170 --> 06:12.970
context of doing a penetration test,

06:13.210 --> 06:14.679
this is a one command that we could

06:14.680 --> 06:16.297
potentially use to see if there's

06:16.420 --> 06:17.859
other users on the system.

06:17.890 --> 06:19.654
So, for example, if we typed in just

06:19.720 --> 06:21.490
finger dash s,

06:22.390 --> 06:23.649
we could potentially see if there's

06:23.650 --> 06:25.839
other users on the system besides

06:25.840 --> 06:26.799
our route user.

06:26.800 --> 06:27.969
And you see in this case that, hey,

06:27.970 --> 06:28.970
nobody's logged on.

06:30.030 --> 06:30.809
All right, so this video was

06:30.810 --> 06:31.829
discovered a couple of simple

06:31.830 --> 06:33.251
commands, the dig tool or did

06:33.660 --> 06:35.130
command, as well as the finger

06:35.220 --> 06:36.809
command. And the next video, we're

06:36.810 --> 06:37.619
going to jump in to our

06:37.620 --> 06:38.879
vulnerability scanning.