WEBVTT 00:00.610 --> 00:04.030 Let's talk some other foot printing techniques. 00:04.420 --> 00:10.660 In fact, there's so many of these unfortunately, so many different vectors in which we can be foot 00:10.660 --> 00:11.170 printed. 00:11.500 --> 00:18.310 I need to do a video after this one because we need to talk about email, foot printing, DNS, foot 00:18.310 --> 00:20.020 printing in that next video. 00:20.560 --> 00:27.760 So network foot printing is certainly a major category that we need to be concerned about at the very 00:27.760 --> 00:28.360 least. 00:28.540 --> 00:33.760 There is going to be this attempt to gain network range information. 00:34.120 --> 00:40.720 The attacker needs to know the subnet addressing that you are utilizing so they can begin their attacks. 00:41.290 --> 00:46.900 One way they get information like this is with a common tool called traceroute. 00:47.050 --> 00:57.880 Traceroute utilizes ICMP packets and the time to live in order to trace a path from your router to a 00:58.330 --> 01:03.010 from your workstation to a destination workstation. 01:03.280 --> 01:09.250 This typically includes the routers along the path, although there's a lot to that. 01:09.280 --> 01:10.180 Let me show you that. 01:12.130 --> 01:19.390 So here you can see I've brought up the command prompt and I am going to do let's see now I'm on windows 01:19.390 --> 01:22.330 so I believe the command will just be trace. 01:22.330 --> 01:26.950 And that's one tricky thing on Cisco routers, it'll be trace root. 01:26.950 --> 01:31.720 On some devices, it'll be trace Artie on some devices, just trace. 01:32.050 --> 01:34.660 But let's just try one real quick here. 01:34.930 --> 01:42.550 We'll try Yahoo.com out and we probably have to spell out trace root here in Windows. 01:43.480 --> 01:45.370 So let me try that syntax. 01:45.370 --> 01:48.430 No patch about trace Artie. 01:49.060 --> 01:49.690 All right. 01:49.690 --> 01:56.710 Third time is a charm, and that shows how long it's been since I've done this on a Windows system. 01:57.100 --> 01:58.390 But anyways, there we have it. 01:58.420 --> 02:01.270 We are trace routing to Yahoo.com. 02:01.630 --> 02:09.490 By the way, Brian McGann, a friend of mine that is an instructor at Inter Network Expert in Ecom. 02:09.490 --> 02:18.850 He sent me the funniest video once it was of a true like script kitty explaining the traceroute output 02:19.210 --> 02:25.810 and I responded, See, if we just say things as instructors with great confidence, anyone will believe 02:25.810 --> 02:26.680 anything we're saying. 02:27.670 --> 02:33.700 It was such a hilarious video because this young script, Kitty, was so convinced that he knew what 02:33.700 --> 02:38.740 this output was telling him, and he told a very convincing story about what this output was. 02:38.740 --> 02:40.780 And of course, he was totally wrong. 02:41.500 --> 02:45.460 Well, I picked one heck of a great example here. 02:45.460 --> 02:48.670 This was a total coincidence, but it worked out great. 02:49.000 --> 02:56.740 When I did my traceroute to yahoo.com, it started reporting about the path notice. 02:56.740 --> 03:04.060 It started at my system and the very first router hop it went to was my wireless access point. 03:04.240 --> 03:11.470 Sure enough, at 19216801, that is an RF C 1918 private IP address. 03:11.740 --> 03:17.650 That is part of the scope that is used for home networks or small office networks. 03:17.920 --> 03:20.290 That's what I'm broadcasting from right now. 03:20.560 --> 03:23.320 That is my home office device. 03:23.620 --> 03:25.090 That's the first hop notice. 03:25.090 --> 03:27.760 It is not resolved to a DNS name. 03:28.120 --> 03:31.570 Then we start getting DNS resolution taking place. 03:31.780 --> 03:39.730 We hit a router that is at Spectrum, my current Internet service provider and look at there, there's 03:39.730 --> 03:41.710 the IP address of that device. 03:42.100 --> 03:46.330 We then hit a Tampa charter dot com router. 03:46.330 --> 03:48.490 There's the IP address of that device. 03:49.090 --> 03:55.240 These tools are critical, as you can see, for foot printing the network. 03:55.510 --> 03:59.800 By the way, we are also getting response times as well. 04:00.010 --> 04:04.450 So that's additional great information. 04:04.840 --> 04:12.700 And these are the types of reconnaissance attacks that are used against the ethical hacking in the headline 04:12.700 --> 04:17.080 features, many of them that we're going to be discussing throughout this course. 04:18.070 --> 04:23.210 Now understand that I just got really, really lucky. 04:23.230 --> 04:27.430 Notice how everything enumerated in this path. 04:27.700 --> 04:29.500 That is absolutely. 04:29.500 --> 04:32.590 I mean, I need to go play the lottery right now. 04:33.040 --> 04:41.500 None of these devices were blocking the ICMP abilities, so everything was fully enumerated. 04:41.500 --> 04:50.800 And we DNS resolved every single IP address of every single router in the hop from source to destination. 04:51.100 --> 04:58.390 Normally when you are running a traceroute test like this against public destinations and as I just 04:58.390 --> 05:01.660 did, you're not going to get anywhere near that lucky. 05:02.320 --> 05:11.530 Now, by the way, if you need to circumvent ICMP filters, you could use TCP or UDP versions of TRACE 05:11.530 --> 05:12.460 that are available. 05:12.760 --> 05:17.680 We're going to have a lot more to say about this when we talk in-depth about scanning networks. 05:18.730 --> 05:26.260 By the way, tools like Traceroute, as you just saw, they are very, very useful in and of themselves, 05:26.260 --> 05:27.490 as you just saw. 05:27.970 --> 05:36.160 But understand that there's tools that wrap software around traceroute like path analyzer pro where 05:36.160 --> 05:44.170 it starts, you know, storing for you all of the records that you are finding with your traceroute. 05:44.170 --> 05:50.020 And as you're trace routing path after path after path and completely mapping a network, it's helping 05:50.020 --> 05:50.890 you with all of that. 05:51.190 --> 06:00.010 So sure enough, there is great software to enhance the raw capabilities of something simple and yet 06:00.010 --> 06:01.540 powerful like traceroute. 06:02.110 --> 06:03.530 How about social engineering? 06:03.550 --> 06:06.980 Yeah, we're going to have an entire chapter dedicated to it. 06:07.000 --> 06:14.140 Sadly, it is just the bane of our connected technology culture these days. 06:14.500 --> 06:19.840 But the social engineering we're talking about here, remember, is specific to foot printing. 06:20.080 --> 06:26.650 So this is where we worry about things like dumpster diving, going to the organization's bin and getting 06:26.650 --> 06:31.510 out documents that have tons of valuable social engineering info. 06:31.840 --> 06:33.460 Shoulder surfing. 06:33.460 --> 06:34.570 Not surfing. 06:34.720 --> 06:35.530 Surfing. 06:36.190 --> 06:41.400 My optical character recognition software did not do me justice there. 06:41.410 --> 06:48.550 It often thinks my F's are tees, but anyways, that's shoulder surfing as you know, and that is looking 06:48.550 --> 06:53.830 over the shoulder of someone and gaining information as they are working on their workstation. 06:54.070 --> 06:59.440 We know there's those screens that you can put in place where they would have to be directly in your 06:59.440 --> 07:01.360 line of sight to see everything clearly. 07:01.630 --> 07:04.840 Those are a must in high security environments. 07:05.140 --> 07:06.760 And how about eavesdropping? 07:06.940 --> 07:12.880 We're going to see lots of ways to do that, not just listening from, you know, behind the door. 07:13.120 --> 07:19.570 We're also talking about, you know, intercepting Bluetooth communications and things of that nature. 07:19.900 --> 07:28.210 These are all possibilities when it comes to social engineering being used for the bad, bad foot printing 07:28.390 --> 07:31.780 that we want to avoid against our systems. 07:32.440 --> 07:33.030 Yikes. 07:33.040 --> 07:40.360 And I almost stopped this video before mentioning the fourth big one here when it comes to foot printing 07:40.360 --> 07:42.910 in social engineering, and that's impersonation. 07:43.300 --> 07:51.040 We need to watch out for websites or actors that are impersonating legitimate individuals. 07:51.370 --> 07:52.060 Notice. 07:52.540 --> 07:53.470 Training. 07:53.500 --> 07:54.350 Training. 07:54.370 --> 07:55.220 Training. 07:55.240 --> 07:56.050 Training. 07:56.080 --> 07:56.770 Training. 07:56.770 --> 07:59.590 That's how you attack social engineering. 07:59.830 --> 08:02.260 There's no ifs, ands or buts about it. 08:02.710 --> 08:05.530 These attacks target your end users. 08:05.740 --> 08:08.450 They are always the weakest link in the chain. 08:08.470 --> 08:12.940 We've got to get them trained to not fall for any of this.