Welcome to part three of this module
in this video.
We're going to be taking a quick look at a very old program called Dimitri which is short for deep magic
information gathering tool.
Dimitri is another command line information gathering tool that will take either a hostname or an IP
address as input and then attempt to gather more information such as additional subdomains email addresses.
And it will even perform port scans of the host.
The program was written in C by James Craig.
Deliberated for a long time about where I should place this module because given its age.
Dimitri is not as useful and therefore not really as widely used as some of the better programs out
there.
There are other tools in Cali that arguably to a much better job of collecting this kind of information.
It has come prepackaged with the operating system for many many years now going all the way back to
the earliest days of backtrack so it still has its uses and it is a classic.
Therefore I'll present it now before we go into the bigger programs such as and map and z map.
With that being said let's go ahead and get into it.
The information categories available can be broken down into active and passive and as you can see I've
broken them up into the available options that you can use with Dimitri so under passive you've got
the ability to do who is lookups on IP addresses or a domain name of a host.
You can set it to retrieve net craft data.
You can tell it to search for domain any subdomains any email addresses that it finds.
It does the searching on Google and I believe a few other now defunct services under the active section.
You can set it to do a port scan and then it will also try to read the banner information for each port.
You have this option as well to change the TTL setting.
The default is two seconds but you can change that depending on your network that you're going against.
This last option the TAC o or dash 0 just allows you to save the output to a text file if you don't
specify this when you run the program.
The data you collect will just be pushed through the terminal and will be lost when you close the window
and Dimitri has no database capabilities such as recon Angie has
sort of launched Dimitri just go to applications
information gathering and it will be right at the top of the list or we can open up a terminal window
and just type Dimitri with no arguments.
This is as I said a fairly simple program by the standards of most open source intelligence tools and
when you run it without any specifications you will just get a list of the basic options.
However Dimitri also has a fairly detailed man page which can be viewed by typing man Dimitri pressing
Enter
you can pull it up yourself and read through it if you wish.
Now you can run Dmitri without specifying any options at the command line other than of course the target
information such as the IP address or hostname.
If you do decide to run it this way it is going to run with most of the options set to default for legal
reasons.
I strongly recommend that you specify the types of options that you want so that you can be absolutely
certain that you are conducting all of your scans in a manner that is consistent with any local laws
that may be applicable to you.
One thing to consider is that you may not want to do both active and passive reconnaissance.
At the same time if you're using this program to scan sites out on the Internet that you do not have
express written permission to scan you could potentially be doing something illegal in some jurisdictions
unauthorized port scanning might be against the law and in truth the law as it is written seems to vary
widely from jurisdiction to jurisdiction.
It's extremely murky so always be 100 percent certain that you have direct written permission before
conducting any port scans on machines you do not personally own.
Always be lawful and ethical during your pen tests.
So with that admonition out of the way let's go ahead and look at the passive recon options.
I'm going to run it with multiple options at the same time and then we're going to take a look at the
results within the terminal.
I'm not going to bother saving it to a file this time although we could do so by adding the AU option
so the syntax for running Dimitri is going to be Dimitri dash W N S E and our target is going to be
scanned me Dot and map dot org.
However before I execute this command I'd like to take a moment to quickly show you that the site I
am passively scanning which is scan me Dot and map dot org has given express written permission to perform
this type of operation both with the end map utility as well as other port scanners like Dimitri as
you can see from the text on the screen though there are limits to this permission so please don't try
to run any brute force crackers or perform any constant excessive scans as this sort of activity is
not authorized or appreciated.
So now we're telling Dmitri to perform a who is look up against the domain to try to obtain net craft
information as well as any subdomains that it can find.
Hit enter here and of course it is important that you spell Dmitri correctly
and this may take a moment
already found the host IP usually Dimitri is pretty fast but because some of the search functions that
it uses are out of date it can slow down on occasion against certain targets.
Right now it's gathering information with Google
in the interest of expediency.
I think I will just make a recording cut here and resume the video after Dimitri has finished gathering
its information.
Well that took a bit longer than I expected to complete and we didn't really find much of anything with
the passive scan although I wasn't expecting to I believe the reason that it ended up taking so long
as it was attempting to search AltaVista and each time it tried to search AltaVista it it didn't get
anywhere for obvious reasons.
And I had to wait for it to time out so you may run into that issue.
This is another example of this tool being rather dated but now we'll look at using the active recon
options.
We'll be doing a port scan and then getting any banner information available from the target.
So this is pretty simple.
The command will be Dmitri be scanned me DOD and map Borg
remember to add the O in there if you want to write this to an out.
The output to a text file here we're telling it to do a t c p port scan.
It's not doing any UDP scans it is reading the banner information and one word of caution about this.
Well it is doing port scans.
It's actually pretty slow so this may take a few minutes to complete.
Please just be patient and once again in this recording if this ends up taking more than a couple more
seconds I'm going to make an edit.
So your search will probably be quite a bit longer.
All right so it finally finished and you can see that it scanned one hundred and fifty ports and one
hundred and forty three of those were in a closed state and it found two specifically open ports twenty
two and eighty.
So that's basically it in a nutshell.
Not nearly the depth that an end map scan would have given us but it is a pretty good start.
I think and maps results are considerably more detailed and of course and map but I don't wish to speak
ill of such an old and well established program as Dimitri.
I think there's a lot of nostalgia behind this program for a lot of people.
Like I said It dates all the way back to the earliest iterations of backtrack which was the operating
system that predated Cally Linux.
So there's a lot of sentiment where Dimitri is concerned anyway I realized this was a short video but
Dmitri really is a relatively simple program and there isn't a whole lot to go into here.
Its users are pretty simple and straightforward when all is said and done.
The mere fact that it still uses the now defunct AltaVista for its look ups is proof that you should
probably consider using more current tools for your reconnaissance operations.
But it's a little piece of Kelly's past and it still has its uses every now and again.
So I hope you enjoyed it.
Thank you.