Pending information gathering with Metasploit in this nature, we will analyze the very expensive and
active techniques of information gathering in detail, actually not in the lecture in this section of
our view.
Then of course, from the beginning, we will analyze the most commonly used and most commonly neglected
techniques of passive information gathering and then later reserves.
We will focus on gaining information through the port scanning.
Metasploit has several built in scanning capabilities, as well as some third party tools integrated
with it to virtually and changed the process of port scanning.
We will analyze both the image scanners as well as some of the people or Third-Party scanners, which
work over the Metasploit Framework.
So let's move onto the receipts and start our process of gaining information about our target.
So we will start information gathering with the company domain name and get information about the company,
search for subdomains to find targets, check for honeypot and gather email addresses and much more.
So how to do it.
The Metasploit Framework has several modules that for information gathering.
So in this recibe, you will learn how to use some of these modules.
However, I recommended that you will export all the axillary modules available in the framework.
So let's we will start first name DNS record scanner here.
So let's start our Metasploit here, and you can see the actual it's in.
I will increase the font of my terminal little bit with, you know, actions or preferences and here
behavior.
Surely.
Here is increased from a little bit.
So let's open Limitless, what can you see it, actually?
Clearly.
Yes.
So now we will start, um, Nathan, vertically, so immersive console, immersive console here.
So.
The teeniest DNS records Cannon and Enumerator axillary model can be used to gather information about
a domain name from giving the in a server by performing various DNS queries such as loan transfers or
reverse lookups, Asari records brute forcing and other techniques to run the axillary model.
We use the use command followed by the model we want to use.
In this case, we will run here.
Uh, x dos here.
U.S.
And we will use auxiliary auxiliary.
Gather.
A new D.A..
As you can see, we are now using this, actually.
And then, uh, then, uh, you can then we can use the intercom to display the information about the
model, such as there are two basic options and this great describes here descriptions here, as you
can see here.
Um, so this model is provided by Carlos Perez and this is the Carlos Perez Opera, uh, kind of his
email address and website.
So as you can see here, basic options, we have the and we will give the target's domain name and uh,
we can give the enemy and the NSA any record.
So initiate his own transfer against each DNS record.
Actually, we can see here threats for any word here.
Threats.
It's a default one.
And.
This expansion by replacing the tilde with a T in until the list, we can enumerated the takes the record
as here.
So to run the model, we need to set the domain names.
So and to make it, uh, run a bit faster, we will set the thread number to ten.
So as you can see, we have variable here.
This is the domain.
This is the target domain.
So in this case, our target domain will be our website.
Take means dot com.
So check out this very first website here.
Take pins dot com.
As you can see here, this is our website in Web, so.
Yes, close it, and then we will set the website to our domain, so set domains, so we're we are assigning
our variable name here.
As you can see, there's a domain name and actually we can see, for example, airport as well.
In this case, the airport is default 59 53.
But in this case domain, we have to assign domain.
Our target domain and these, as you can see here, this is the what is our opportunity to target port
TCP port.
So this is a default one and this is the target domain.
So we will pinged our target domain, shall not change assigned domain.
Take bins that.
So as you can see, our domain is, um, ticketmaster.com, so let's use info again.
As you can see here in our domain, current setting is changed, and this is that tech means that come
now.
And after that.
We will set the trips to 10 or faster scanning, so threads set.
Rats here, as you can see, this is a threat is default one.
So how many threats do you will have the manifester your scanning will be?
So three and threats 10.
And after that, as you can see, let's run Infocom.
And again, as you can see, our domain is ticketmaster.com and our trade is 10.
So now let's run our exploit run.
As you can see here, uh, looking at that, we can see that we are able to obtain several DNS records
from the power of good domain, as you can see here, this is our website is Namecheap hosting and this
is the IP address of our hosting and this is the subdomain for male and DNS Namecheap hosting, as you
can see in the civil information here.
But we that's more we have to do more.
So the DNS record scanner and enumerator actually remodel can also be used for active information gathering
using its brute forcing capabilities by setting enum.
So let's change it.
So as you can see here, this this is the enum BRT.
This means brute force VRT is fast, as you can see it.
So what this does, the bit is brute force subdomains and host names.
We had this simply supplied more or less so in the next section, we will, uh, do that.
I'm waiting you in the next issue.