Let's go over some tools.
The first tool for passive reconnaissance that I recommend that we're going to look at is recon and
now we of is one of the most powerful tools for conducting passive reconnaissance, using open source
intelligence.
So this is normally one of the first tools that you want to run when you're doing reconnaissance for
like a penetration test, because I'm going to let you gather a lot of different information and you
can learn stuff like, you know, IP addresses, how companies name their accounts.
So, you know, do these first initial and then last name is a first name, DOT, last name, stuff
like that for all locations like where the servers are located, where businesses are located, you
can actually figure out, you know, users like what users are on the network, you know, and you can
combine that, you know, with IP addresses or account naming conventions.
I can actually get user names.
You can also get email addresses because those are typically publicly available.
Or if you just know the naming convention and you know the name of the company's domain, you can make
a list of email addresses and you can also you can find passwords because there's plenty of password
breached databases online that I probably have that have been released to the public.
And you'll see that a lot of people use passwords.
They might have had one of their accounts in the past breached before and their password has been out
there.
And they might use that password everywhere else.
You never know.
So you can get a list of passwords and then there's just a ton more of information that we can get from
Recology.
So it's a very, very useful and robust tool for conducting passive reconnaissance without even being
detected.
OK, so if we actually want to go about installing we kind of energy with somebody just going to run
these commands really quick.
So you're going to get Klown on the recon energy get repository and we're going to paste it into that
folder right this up reconning.
So it's going to create that kind of energy directory inside this directory and then that's what it's
going to be.
And then if we want to execute it, what is going to change to that directory?
And then we're going to do a slash reconning and then we're going to be good to go.
We could check out the user interface.
So let's go ahead and try that out.
So back in the colonics machine.
So let's go ahead and run reconning kind of.
And when you run it, you're going to see this nice little Simmi picture pop up.
The first thing you might want to do is type in help is going to give you a list of all the different
commands that you can do right now.
You can kind of explore and play with these yourself.
We're not going to go over all of these.
Go ahead.
The first thing we want to do is look at the bottom, where you see it as workspaces so you can create
different workspaces to kind of logically separate things and have some structure.
Like maybe you're looking at two different domains.
You might want one workspace for each one and you can work inside of each one, you know, kind of keep
things separated in your own space.
We can create one.
So workspaces create ethical hacking.
So now we're inside of the ethical hacking workspace now where the power of reconned energy comes from
is from all the modules, these modules, we can look at them with the marketplace come in.
So Marketplace Search is going to give us a list of all the different modules.
So it has links to a lot of different things you can do that can look for stuff on Twitter, GitHub,
Shodan, IO virus, total, all kinds of different stuff being Google, all kinds of stuff is on here.
So it's very, very powerful tool.
You can really gather a lot of information from it.
OK, so one we're going to use right now is called Hacker Target.
So we're going to load we're going to install that module.
So what we can do is marketplace.
Install hacker target.
So now that module is downloaded and now we can do modules, load hacker target and is actually going
to, you know, open it, open up that module and take us into there.
So one thing we could do is type in info and it's going it's just going to give us info about it.
So uses Hacker to target dotcom API, different host names for our target area for our source.
So right now I had this set before for Google dot com, but if you you can do options list and it'll
show the different things that you can actually set.
So right now I have a set of Google dot com, but if you want to change it to something else, you two
options, set source, maybe like Facebook dot com or something, you know.
So now the source is set to that.
So let's actually go back to Google dot com just because that's what I wanted to do, keep it nice and
neutral.
So Google dot com.
So now we have our source set to Google dot com so we can actually go ahead and run this and it's going
to gather information for us.
So run and enter.
So now I found this finding all kinds of stuff on the Internet, IP addresses, host names of different
things related to Google dot com.
So we found a total of five hundred and one different hosts.
OK, and these are public shows.
And of course, Google has thousands of servers, probably.
So that's probably what a lot of these are.
So you can already see like kind of the power behind this tool, especially if you're working with a
very specific domain for a very specific company.
So this can be something where if you're on a princess and you're trying to figure out, you know,
maybe there is a server out there that, you know, that they're not really monitoring very closely.
If you can get a list of all of them, like maybe 10 servers, you can go ahead and look into them and
maybe find weaknesses on one, you know, just from this open source intelligence right here.
So very, very useful tool.
There's also other modules that we can use.
So if you want to extract this module, you just type in back.
And we're still inside of the ethical hacking workspace.
So another one that we can install is marketplace install.
We can install the Google one.
So Google UniSuper site on the Web.
So we're going to install that and then we're going to load it.
So modules load Google.
There we are.
You don't have to finish this.
You just hit internal autocomplete and go to the right one.
So what we can do here once again is just type in info.
So this harvest host from Google dot com using the site search operator.
If you know some Google hacking, then you know what that means.
You're just going to find PREDACIOUS, find it, use Google to search the entire Web script web for,
you know, the different hosts.
And then it's going to, you know, update the host table with whatever results that it finds we can
do options list again, even though it's right there.
So options list, so source.
So we can change that if we want.
So options said source.
Let's say we want to do Amazon.com or something.
There we go.
Cool.
So now we can run.
And it's going to find it's going to go on Google is great, Google for all the different sites linked
to emphasize it was finally a bunch of different subdomains, all kinds of stuff.
So it's finding lots.
OK, so of course, these are gigantic companies that have thousands and thousands of pages and such.
So it's going to fill it's going to fill up that database.
So a lot of different things that it is finding.
So it's pretty cool.
So right here actually says it found 20, 20 hosts.
So that's pretty neat.
So these are there's a lot of different modules that we can use to find information, like maybe we
want to gather a list of those.
OK, so another module I want to show you guys is the Nekrasov module.
So we're just going to install that one and then do modules load net craft and then let's do a quick
info's so we can figure out, you know, what it is.
So it's going to harvest host from that crap dot com and then update the host table as well.
And we'll look at that shortly.
So you set the source here as well.
So the options search source, let's say we want to do do hackers dot com.
There we go.
Cool.
See what we can find from this.
Right.
Here we go.
That was actually pretty quick because there's a little bit more specific and probably a much smaller
site.
So we using that craft to actually, you know, get us some different hosts.
So it didn't pull out IP, IP addresses or anything, but it did pull out some different, like subdomains
that maybe we can look at.
It could, you know, some of them could be have some vulnerabilities.
So there's different ways that we can gather this, you know, open source intelligence and really get
a lot of hosts together.
So if we have, you know, free range to try to hack into a network, the best way to do it is to figure
out, you know, what holes are actually out there.
OK, so there's another one that we can actually use to say we want to gather some email addresses,
OK, or some, you know, just gather some users or something.
One that we can use the Who is Peel's CS module.
So let's do that and then let's load it.
So modules load who is and you just hit enter and then we can do info.
So it's going to start searching the Internet and Harvest's p.l.c..
Your point of contact data from, you know, who is queries for a given domain.
So let's actually set it equal just to not put people's personal information out there.
See if you can find anything on my domain.
So let's do options source and then its numbers are.
Com, they would go and then run and see what we can find.
No contacts found.
Great.
They can't find any of my stuff on the Internet.
That's perfect.
So let's try to set the source to.
Google.
Or let's try it, hub dotcom.
There you go.
So it's all open source, so it's all you know, it's legal.
So we're getting some, you know, some good e-mail addresses here.
First and last names, all kinds of different stuff is all publicly available information.
And so then we can use this information for and maybe for some social engineering attempts, sending
him a malicious link, stuff like that.
So it's pretty neat.
OK, so there's another module I want to show you guys again for, looking for some e-mail addresses.
So Marketplace install PGP and of course, search so we can do that and then we can load the modules
of modules, load PGP on the search and then we could do it in full, just learning a little bit more
about it.
So it pretty much searches online for email addresses for domain.
So let's go ahead and let's see the options here are just source again.
So options set source.
And this time let's do Bing dot com.
There we go.
Cool Bing dot com.
So now we going to run this and it's going to gather a lot of information.
So it gathered a lot of different.
This one is probably fake.
Johnny Appleseed or Bong none.
So Bing seems like they're pretty smart.
They have like some fake addresses and stuff out there.
So what is pretty useful?
So there's a couple of different ways that you can actually, you know, figure out IP addresses and,
you know, for for you to play in some aspects attacks, different things like that.
OK, so there's another module I want to make you guys aware of just because if it can be very, very
useful, you know, when you're actually doing a penetration test, you know, out in the real world,
it's going to be this Hebb p underscore its module.
So what this does it all the emoticons accounts in your database that you've gathered and compares it
against, have I been on site?
And it lets you know the pastors are actually leaked before.
So you use that information to go actually find those pastors online?
I'm not just going to show this just because of the sensitivity behind it, because, you know, kind
of would be me assisting and compromising some people.
So I'd rather not do that.
But I just want you guys to know the capability, because this can be very helpful.
You know, in the real world, you know, when you're actually doing penetration tests and trying to
help a company protect themselves, you can let them know, hey, they've been compromised.
And I was able to go online really quick and get their password and log into your stuff.
So you just install that and it's going to tell you right here that will likely fail if you don't have
the key API key for it is also you'd have to go to the website and actually get the API key and you'll
be able to use the keys.
Eckermann like if you do help, you see there's a Keys command right here.
Let you put in just a different API keys because some modules require those keys actually be used and
these are usually the more powerful ones like this one.
Pretty useful.
So there's keys and then you add your API key and you'll be good to go.
OK, so one last module I want you guys to be aware of is the HTML module.
So it's going to allow you to actually create a report so you can go ahead and install it.
And what we can do is you can ignore that one right there so we can do modules, load HMO and then do
a infocom.
And it's going to show us the different options and it just creates an e-mail report so you can look
at everything that you gathered so far.
So we have to set some options here.
Those are all required.
So we're going to give an option for them or at least for the first two.
So let's do options.
Site creator.
And here we go.
And Options said.
Customer.
Udemy students, there we go, so now we can actually run this and it's going to create a report, so
it created the report in this location.
So we can actually just if you want to just like catch the report, you can actually go to any of your
browser.
So I should be able to just copy this.
ASI is copyists.
And let's put it in our browser and see what happens.
So it's actually going to go ahead and load it and it says, hey, we have five hundred twenty six holes
here.
We found 20 contacts.
It'll actually show us the holes that we found.
It's pretty cool.
Is actually, you know, organized very well, has IP addresses in there.
If we had any other information, would fill out these other columns as well.
And then it has the contacts.
So we have some names, e-mail addresses, different stuff.
These are most likely fake.
Some could be real, some could be fake, but whatever.
So this is pretty, pretty powerful tool, I think is very useful, especially when you do an external
penetration testing.
You're really trying to get in from the outside.
Usually anything is fair game, so it's just real work.
So I hope that you think that you think that or see the power of every kind of energy.
And I hope that you actually play around with it more and master it, OK?