WEBVTT 00:00.210 --> 00:00.900 Let's face it. 00:01.080 --> 00:03.510 What made cloud possible? 00:03.630 --> 00:09.150 Well, it was the web, of course, and the Web and websites. 00:09.420 --> 00:16.710 They represent such an important aspect of everything we do in information technology, it seems. 00:17.310 --> 00:25.500 But we have to understand that Web sites represent a very powerful foot printing opportunity for attackers. 00:26.040 --> 00:33.810 Website foot printing means there's this constant monitoring sometimes and analysis of a Web site. 00:34.530 --> 00:39.660 This is another one of those areas where it's painful for me as an instructor or a consultant. 00:39.660 --> 00:46.170 A lot of times because I'm examining an environment and I realize, oh, my goodness, the attackers 00:46.350 --> 00:51.630 have such better documentation and such better knowledge of this network. 00:51.810 --> 00:55.350 They've documented it much better than the organization themselves. 00:56.130 --> 01:03.390 You have to understand that there's a tremendous amount of information that can be gained from the HTTP 01:03.420 --> 01:09.140 headers that are being used in conversations, and these headers can be examined. 01:09.480 --> 01:15.660 Burp Suite Z Proxy Whap a laser web site informer. 01:15.930 --> 01:18.420 These are flashcard fodder. 01:19.020 --> 01:24.810 Remember, we're making flashcards for you when it comes to memorizing tools like this. 01:25.320 --> 01:26.960 For me, burp suite. 01:26.970 --> 01:31.020 I've been using that tool in aware of that tool forever. 01:31.410 --> 01:31.770 Right. 01:31.800 --> 01:33.380 Same with weaponize or so. 01:33.390 --> 01:34.530 A lot of these. 01:34.740 --> 01:41.400 For those of us that have been doing it in cybersecurity for decades, these things are common knowledge 01:41.400 --> 01:41.970 to us. 01:42.270 --> 01:50.670 But I realize it can be stressful for you realizing okay, burp suite, can analyze HTTP headers and 01:50.670 --> 01:57.900 then give powerful information about like the duration of sessions and even identity information that 01:57.900 --> 01:59.640 might be transmitted in the clear. 01:59.880 --> 02:03.090 So lots of information can be gained. 02:03.420 --> 02:12.720 And let's not forget that any common web browser today, Google Edge, anything, right? 02:12.870 --> 02:14.940 Chrome, anything you're using. 02:14.940 --> 02:20.850 I said Google sorry, Chrome, the Chrome browser, they're all going to allow you to examine the underlying 02:21.150 --> 02:21.780 HTML. 02:21.990 --> 02:30.300 Just imagine how much of that might not be sanitized by web teams that aren't following proper protocol. 02:30.540 --> 02:38.520 So there can be a lot of additional extraneous, dangerous information that's revealed in the underlying 02:38.760 --> 02:39.420 HTML. 02:39.420 --> 02:42.990 And that underlying HTML is so easy to take a look at. 02:43.530 --> 02:44.670 What about cookies? 02:44.730 --> 02:51.990 Sure, we know cookies are a security risk, but in this sense, what's happening with this cookie analysis 02:51.990 --> 02:59.190 is, once again, it's giving information about underlying operating systems or things of that nature 02:59.190 --> 03:00.810 that can then be attacked. 03:01.850 --> 03:03.590 As if we didn't have enough to worry about. 03:03.590 --> 03:05.210 We have webbed spiders. 03:05.540 --> 03:12.290 This is like the web data extractor and past hub, and these will go after employee names and email 03:12.290 --> 03:12.950 addresses. 03:13.280 --> 03:21.170 We have discussed tools like this before, reconnaissance with LinkedIn, for instance, but yet another 03:21.170 --> 03:22.880 way to do it is using the web. 03:23.330 --> 03:28.900 There's even user directed spidering products like once again, burp suite in web scarab. 03:28.910 --> 03:32.180 What a great name, web scarab and what does it mean? 03:32.210 --> 03:34.250 User directed spidering will again. 03:34.250 --> 03:39.080 It's going after user information for these systems. 03:40.010 --> 03:46.040 If that wasn't bad enough, remember that website mirroring tools exist. 03:46.310 --> 03:46.970 Wow. 03:47.150 --> 03:54.920 So let's say we have an attacker that's worried about being detected as he's doing a bunch of active 03:54.920 --> 03:56.900 reconnaissance against our website. 03:57.500 --> 04:06.170 He or she just makes a copy of our entire website and then they can study it and break it apart and 04:06.170 --> 04:08.450 really tear at it undetected. 04:08.840 --> 04:12.110 H t track and website copier. 04:12.110 --> 04:13.940 How's that for an obvious name? 04:14.180 --> 04:20.090 Website copier and HD track are tools you can do this with as well as and collector studio. 04:20.810 --> 04:29.240 I remember using HD track decades ago and that was to take the documentation of the vendors website 04:29.240 --> 04:37.010 that was often crashing and highly unavailable at times, and I mirrored it to my own private network. 04:37.160 --> 04:43.190 And then I actually ended up printing it at one point and burning it to CD and having all kinds of fun 04:43.190 --> 04:44.960 with it once I mirrored it. 04:45.290 --> 04:50.900 That was an example of completely authorized copying of public information. 04:50.900 --> 04:56.990 I might point out I have never, nor will I incriminate myself in any of these videos. 04:57.740 --> 04:59.480 Hey, this one's fun. 04:59.480 --> 05:01.610 It's the Wayback Machine. 05:01.880 --> 05:10.520 So this certainly seems like a fun tool to take and look at your crappy website 25 years ago. 05:10.610 --> 05:17.240 And notice this was over 25 years ago, and I had a post about who is hacking who. 05:17.480 --> 05:25.160 So 25 years ago, the the hacking subject was forefront on my mind at my blog. 05:25.520 --> 05:26.060 Something. 05:26.300 --> 05:26.980 Boy, oh, boy. 05:26.990 --> 05:32.030 My blog looks better than this today, I'm happy to say, just to have some fun. 05:32.030 --> 05:36.050 I couldn't resist pulling up Cisco from 1996. 05:36.410 --> 05:43.070 Now I'm so old that I was all over this website at this time, and it really amazes me how long ago 05:43.070 --> 05:51.050 that was, because when I look at this website, it seems like just maybe ten years ago, the Cisco 05:51.050 --> 05:52.150 website looked like this. 05:52.160 --> 05:54.830 I mean, I remember it that vividly. 05:55.220 --> 05:56.480 That sad, I guess. 05:56.480 --> 05:57.200 Real sad. 05:57.590 --> 06:04.310 Anyways, while the Wayback Machine is fun hours and hours of entertainment for you in the family, 06:04.640 --> 06:08.480 the Wayback Machine is also a reconnaissance tool, right? 06:08.720 --> 06:15.860 Maybe you're still using certain tack and your wayback version of your website didn't hide that fact 06:16.130 --> 06:17.150 like you are now. 06:17.510 --> 06:22.370 So they can go back in time and look at what you've done with your site. 06:22.670 --> 06:23.580 That's not good. 06:23.600 --> 06:26.150 That tool suddenly looks a lot less fun. 06:27.120 --> 06:29.730 What about extracting web links? 06:29.760 --> 06:30.270 Sure. 06:30.300 --> 06:33.480 Octopus net peek spider link extractor. 06:33.630 --> 06:40.080 They're all great at indexing and providing a nice cozy list of everything that you link to. 06:40.320 --> 06:43.950 And what about gathering word lists from your Web site? 06:44.250 --> 06:48.270 These word lists can then be fed into dictionaries for password cracking. 06:48.570 --> 06:48.980 There's. 06:48.990 --> 06:49.480 See? 06:49.860 --> 06:52.950 Well, and that product. 06:53.160 --> 06:58.930 Probably not pronounced that way, but I literally do not know how that would commonly be pronounced. 06:58.950 --> 06:59.910 But anyways. 06:59.990 --> 07:07.140 SC Well, sure, it's a word list app that will assist in getting these word lists. 07:08.040 --> 07:13.410 Remember, something else that we are in the business of helping to protect is the metadata. 07:13.500 --> 07:15.780 That's the data about data. 07:15.990 --> 07:25.650 And there's all kinds of tools like Meta Gu fill EXIF tool, web data extractor that go after the metadata 07:25.830 --> 07:32.460 that might leak valuable information we don't want in the hands of the attackers. 07:33.450 --> 07:39.330 Now, I know this is kind of overwhelming and we're just talking about websites, but trust me, we're 07:39.330 --> 07:44.940 going to have a nice, long, long list of countermeasures that you're going to be using to make sure 07:44.940 --> 07:46.380 you don't fall victim here. 07:47.200 --> 07:53.830 By the way, the list goes on of other ways in which websites can be footprint dead. 07:54.460 --> 08:00.190 One of the things attackers will do is they'll monitor your site probably better than you are for changes. 08:00.520 --> 08:05.380 They'll be looking for contact info and cockpit contact info changes. 08:05.620 --> 08:08.470 They'll be looking for your web page posting patterns. 08:08.680 --> 08:15.220 And of course, they'll be analyzing what is getting traffic at your Web site and what isn't. 08:15.670 --> 08:23.260 All of this helps them build a road map for potentially a subsequent attack. 08:23.500 --> 08:24.100 Yikes. 08:24.370 --> 08:25.600 Thanks so much for joining me. 08:25.750 --> 08:28.750 Hope you enjoyed this video as much as I did making it.