WEBVTT 00:00.790 --> 00:01.210 Yes. 00:01.210 --> 00:09.400 We know this is a critical area when it comes to cyber security, and that is the many, many techniques 00:09.400 --> 00:12.790 that can be used to footprint against our organization. 00:13.360 --> 00:20.680 Yes, this is yet another look at more techniques that could be availed by attackers. 00:21.220 --> 00:22.690 Think about e-mail. 00:22.900 --> 00:26.290 Now, we're not talking about the contents of an e-mail. 00:26.470 --> 00:32.590 No, we're talking about everything that can be gleaned from just capturing the e-mail packets. 00:32.950 --> 00:39.940 Recipient system information would include things like potentially geo location when it was received, 00:39.940 --> 00:47.080 when it was read, how long it was read, whether there was proxies in use, what's the OS, what's 00:47.080 --> 00:49.770 the browser, what's the forward email address? 00:49.780 --> 00:51.190 What's the device type? 00:51.340 --> 00:54.370 What path did the email take notice? 00:54.550 --> 01:01.390 There's a lot of valuable information that attackers could glean here, and we're not even getting into 01:01.390 --> 01:04.340 the details of what they can get from email headers. 01:04.360 --> 01:11.950 This is a virtual treasure trove of information, so it's no surprise that email tracking tools often 01:11.950 --> 01:16.480 beloved by attackers include info gear and email tracker. 01:16.480 --> 01:21.790 Pro again will be adding these to flash cards for you so you can keep them all straight. 01:22.600 --> 01:27.400 Remember, geolocation is possible thanks to public IP addresses. 01:27.400 --> 01:33.880 Giving away location websites to help with this include IP to location and IP location finder. 01:34.270 --> 01:38.950 Plenty of tools leveraging the ability to geo locate. 01:39.760 --> 01:46.060 Now DNS is something else that is really problematic with too much information a lot of times being 01:46.060 --> 01:46.480 shared. 01:47.050 --> 01:54.490 I will never forget the first time I registered a domain with the WHO is service and allowed them to 01:54.490 --> 01:56.200 publish all my personal information. 01:56.500 --> 02:02.230 We're talking your personal phone number, your personal address, your personal email, all of it. 02:02.680 --> 02:08.080 So this is maintained by the right are not easy for me to say. 02:08.290 --> 02:10.660 The registry of internet, whatever. 02:10.660 --> 02:19.900 Right, the RDR and I'll look up the exact ah you know, mnemonic name there, three letter acronym 02:19.900 --> 02:21.790 and I'll flash it on the screen for you. 02:21.940 --> 02:25.960 But this registry service that maintains the WHO is database. 02:26.620 --> 02:30.760 Oftentimes all we need to do is tell them to remove our personal info. 02:30.790 --> 02:39.280 Or when we are registering, like when I register with a WRC, I pay like an extra dollar $0.99 to have 02:39.280 --> 02:41.090 the information proxy. 02:41.140 --> 02:43.780 So my own personal information won't appear. 02:44.410 --> 02:50.260 Now, I'll admit that when I did this mistake, I wasn't hacked. 02:50.560 --> 02:54.730 But what did happen that was a nightmare was I was spammed. 02:55.090 --> 02:55.730 Yes. 02:56.080 --> 03:03.970 So they took my email address, my personal email address, and every single website designer on the 03:03.970 --> 03:10.250 planet started emailing me and some texting me because remember, they had phone number information. 03:10.270 --> 03:11.630 So it's a nightmare. 03:11.800 --> 03:14.020 You don't want to be hacked or spammed. 03:14.170 --> 03:15.460 Watch out for that. 03:15.470 --> 03:17.800 Who is database information that is public? 03:17.800 --> 03:18.280 Look up. 03:18.760 --> 03:20.350 How about reverse lookups? 03:20.980 --> 03:23.410 Let's not forget how DNS normally works. 03:23.740 --> 03:28.780 We have an address, WWE Yahoo.com that we want to go to. 03:28.930 --> 03:30.910 We need the IP address to get there. 03:31.330 --> 03:34.180 Well, reverse lookups do the opposite. 03:34.480 --> 03:41.920 DNS recon, for instance, can take an IP address, go into the DNS system and tell you what you are. 03:41.920 --> 03:44.980 URL that IP address is associated with. 03:45.340 --> 03:50.410 Notice how reverse lookups can be the best friends of the reconnaissance attackers. 03:50.680 --> 03:52.060 They have the IP. 03:52.210 --> 04:00.190 They're trying to figure out what domain is it a part of the review of the DNS records I wanted to do 04:00.190 --> 04:06.610 right here with you so that you understand these are the record types that are often being sought after. 04:06.860 --> 04:12.760 There's the host record type, the fundamental host record, and that is in a record type. 04:13.240 --> 04:21.460 If you see DNS records that carry in acts, these are the domains mail servers is for hostname servers. 04:22.090 --> 04:25.600 And then we have to remember we have a C name record type. 04:25.900 --> 04:29.410 This is how we can alias to a particular host. 04:29.770 --> 04:39.040 For example, maybe we have server one dot acme dot com and we want this to be available at WW W dot 04:39.040 --> 04:40.150 acme icon. 04:40.240 --> 04:48.670 We can create a C name alias so that when someone goes to WW dot acme dot com, they're actually taken 04:48.670 --> 04:52.330 to the server one dot act mi.com. 04:52.630 --> 04:57.880 Notice we can create another alias for some other server purpose. 04:58.360 --> 05:00.160 So C names are very common. 05:00.880 --> 05:02.440 There's the S01 record. 05:02.440 --> 05:05.740 This is the start of a 30 record for the domain. 05:06.370 --> 05:09.100 And then there's SRP service records. 05:09.520 --> 05:16.450 Now, these aren't all of the types of DNS records that you might encounter, but these are ones I want 05:16.450 --> 05:19.150 you to know absolutely verbatim. 05:19.720 --> 05:24.550 Well, we're going to have more fun in this chapter with our discussion of foot printing. 05:24.640 --> 05:25.240 Next up.