Hello, my name is Stefan.
Welcome to this lecture.
In this lecture, we are going to learn about information gathering phase reconnaissance.
The information gathering phase is a crucial step in any security assessment.
Bug bounty hunters and security professionals emphasize the importance of this phase as it lays the
foundation for the entire process.
During the information gathering, the goal is to discover assets and enumerate the attack surface of
the target to obtain as much relevant information as possible.
Every piece of information gathered can potentially contribute to the success of the security assessment.
In this lecture, we are various data points are collected, including usernames, passwords, hostnames,
IP addresses, external providers, internal services and version banners.
These details provide insights into the target's infrastructure and potential vulnerabilities.
The information obtained during this phase becomes invaluable for subsequent stages of the security
assessment.
So there are numerous reconnaissance tasks that can be performed during an assessment.
And one powerful tool for information gathering is Nmap Scripting Engine.
NSC.
NSC offers internal results obtained from scans as well as external data sources that complement other
standalone tools by utilizing all available resources, security professionals and ethical hackers increase
their chances of finding critical information that could compromise a target's security.
Paying attention to the small details is crucial during this phase, as it can yield significant dividends.
And Nmap is a well known for its robust information gathering capabilities, such as operating system
fingerprinting, port enumeration and service discovery.
However, with the inclusion of NSC and Map scripting engine, additional information gathering task
can be performed.
These tasks include obtaining additional IP address information, checking for malicious activities
associated with the host, using external databases, discovering new targets through the external databases,
brute forcing DNS records, parsing SSL certificates and collecting valid email accounts.
So let's explore some practical examples of these techniques here.
So here we will.
In this section we will do we will perform IP address geolocation.
So geo locating an IP address can help system administrators and threat intelligence analysts identify
the geographical origin of a network connection.
NSA scripts such as IP here so IP geolocation.
Maxmind.
IP geolocation.
Oh, actually, let's write it.
Write it down on the notepad here.
So the NSA scripts.
IP Geo Location Maxmind.
IP geo Location IP info Database DB IP Geo Location.
Geo Plugin IP Geolocation.
Your location.
Um.
IP geolocation mapping.
Map being here.
IP Geolocation.
IP Geolocation Map.
Google.
I be.
Geo location map.
HTML enable geolocation.
These these plugins these NSA scripts enable geolocation of remote IP addresses by leveraging external
services or databases.
So getting information in this lecture, we are in this section.
We are also going to learn how to get information from who is records.
So who is records contain valuable details about domain registrations, owners ownership information
and registration dates.
So NSA scripts load security professionals to query who is servers and extract relevant information
for their assessments.
In this section, we will also learn about how to obtain a trace root geolocation information.
So a trace road is a network diagnostic tool that maps the path between a machine and a target.
So NSA scripts provide geolocation information for each hop in the trace route, aiding in network analysis
and understanding the targets, information and infrastructure.
So we will also query Shodan to obtain target information.
So Shodan is a specialized search engine that scans and indexes of internet internet connected devices,
NSA here.
So we can also the Shodan is we can also use the Shodan online here Shodan here.
So here this Shodan.
As I said, Shodan is a special specialized search engine that scans and indexes Internet connected
devices and NSC script allows security professionals to query Shodan's database and gather information
about specific targets, including open ports, running services and potential vulnerabilities.
So sorry here.
So we will also in this section, we will also learn how to collect valid email accounts and IP addresses
from web servers.
NSA scripts can identify valid email accounts associated with the web server, which can be useful for
social engineering or targeted attacks.
So these scripts also extract IP addresses linked to the web server, providing further insights into
the target's infrastructure.
In this section of our course, we will learn about how to discover hostnames pointing to the same IP
address, which is DNS related.
NSA scripts can help identify multiple hostnames that resolve to the same IP address, so this information
can reveal subdomains or alternative ways to access the target.
Expanding the attack surface.
We will also learn how to discover host names by brute forcing DNS records because brute forcing DNS
records involves systematically generating and querying possible host names to find the valid associated,
uh, valid ones associated with the targets.
So NSA scripts streamline this process, saving time and effort during the assessment.
And lastly, in this section we will learn how to match services with public vulnerability and adversaries
and picking the low hanging fruit.
So NSA scripts compare the services identified on the target with a public vulnerability to adversaries.
This has identified known vulnerabilities that can be easily exploited.
Focusing on low hanging fruits maximizes the efficiency of the assessment.
In conclusion, the information gathering phase is a critical aspect of any security assessment.
By leveraging tools like Nmap and its NSA scripts, security professionals can gather valuable information
about a target's assets attack surface and potential vulnerabilities.
The practical examples provided demonstrate the various techniques available for IP address geolocation
who is record retrieval traceroute analysis Shodan Querying email account, the IP address collection
hostname discovery and matching services with public vulnerability adversaries.
Incorporating these techniques into the security assessment enhances the ability to identify and mitigate
the risks effectively.