There are a couple of terms that you'll hear when you're talking about Retime as an ethical hacker.
The first one is a numeration and the other is scanning where we're going to see how to do scanning
the active recon in just a moment.
But there are lots of types of a numeration we can do passively, like we might want to enumerate the
email accounts inside an organization.
So if I were trying to research an organization like a an attacker would, I would want to know who
works in that organization and how I could get in touch with them.
This you can see how this would be immediately useful for a phishing campaign like we learned how to
do back in the previous section.
But the harvester is one of the tools built into Kalli that will help us enumerate those e-mail accounts.
It'll help you see for your organization as an ethical hacker.
How many people's contact information is freely available out there?
Of course, you can do a regular Web search.
You can do a LinkedIn search to see who is posting one information about your organization.
But the harvester is a really handy tool built into Caleigh that will automatically compile results
from LinkedIn, from Google, from Twitter, from dozens of other sources out on the Internet.
So let's switch back over to Caleigh and FUBU, the Kelly up fresh.
We're going to go Kalli as the user name.
And Kelly is the password.
If you're on an older version of Caleigh Linux, you may use the username route and the password tours
t double o r.
I'm running a 20-20 a newer version of Caleigh after 2020 dot two.
It's Caleigh, Caleigh, everything 20-20 dot one and earlier will be route and tour.
Just roup spelled backwards as the username.
So Kalli.
And I'm going to click on the Caleigh menu at the top.
And find information gathering.
And I want to do some o cent analysis or open source intelligence analysis.
That means it's freely available, publicly available information.
And I'm going to use the tool called the Harvester.
Now, the harvester can also be run from the command line.
But the nice thing is when we run the harvester from the command line, from the Caleigh menu option,
it automatically gives us a help page for the harvester.
We can increase the size here just a bit.
There we go.
So you can see that the harvester has a help option and it gives us some information.
It takes a few options dash D for the domain.
So if I wanted to search information about the University of North Georgia, I would say dash d n g
Dudi to you.
We can limit the number of results if we only want a certain number.
So if you're at a big organization, you might do a dash l.
That's a lowercase L a 50.
And then we can use various sources.
We see the dash B right down here.
So with this information, we know just enough to be able to do a quick the harvester search.
I'll do a control l to clear the screen.
I'm going to say the harvester, the H-E Harvester and it's a capital H and the harvester dash d u n
g Dudi to you.
And here you should put the organization you're interested in gathering more information about whether
that CNN dot com, whether that's a company that's hired you, whether it's your school.
That's a really good place to get started, to gather some publicly available free information.
Everything that you're doing here is still passive.
You're not scanning their network.
You're looking at Google results and Twitter results and LinkedIn results.
In fact, let's do a LinkedIn search first.
So we'll do a dash.
B, LinkedIn.
And let's just see what the harvester gets for us.
Now, it may take just a few moments to run a harvester surge, depending on the source, depending
on the size of your organization.
All right.
And for my organization, the University of North Georgia, you can see it covered a lot of results
in very little time.
So we found 61 candidates here that had some connection to UMG.
But in our case, you can see we had several people who have a last name of UMG or own.
So we do have some actual people who'd work at UMG.
You'll find that by University of North Georgia.
So get some information inside organization.
But because you engy is also a last name, we didn't get a lot of information that we could use there.
So let's try our next search.
Let's run the harvester on you and.
I'm going to do control l to clear the screen and the up arrow and I'm just going to change the source.
And now go to B Google.
And once again, this may take just a little bit of time to run, but it's worth the wait.
And we can see the harvester gathered a little bit of information on our organization.
I can see Professor Yang's information.
I can see a help desk e-mail that may be useful.
In fact, if I were doing a social engineering campaign and had the permission of the organization,
I might send as an e-mail pretending to be help desk.
Uesugi to Professor Yang.
So that Dr. Yang might be tempted to click through that e-mail.
Dr.
Dr. Yang's a really good computer science professor, so I don't think he's going to do do that.
But this is a really good example.
How would you quickly gather just a little bit of information?
Now, if we want a full the harvest to report on an organization, we can do that as well.
Let's clear the screen and I'm going to type the harvester dash d.
N g dash B all.
And I'm going to say dash f.
Report dot astm.
So this F is a file and output file where we can store all of the information that the harvester gathers
about the organization.
Now, I just.
You chose you, Angie, because it happens to be the university where I teach you the day.
But that's a place where in the Dashty you put whatever organization you were looking out for as an
ethical hacker.
So if we give this command a run with a Dashty of your organization, the Dash B of all and the dash
F of report, it'll take several minutes to complete.
But when we come back, we'll be able to see that report and see what information is publicly available
about our organization using just a couple of quick search results.
And it's going to take several minutes to run all of the different skins that come in the harvester.
But if you run across an error, just as a quick troubleshooting note, you see down here, it says
there's no such file or directory API keys dot Yamal.
This is because there are some paid services that you can use through the harvester.
It integrates with paid search engines and of subscription accounts so that you can search for things
like devices through showed and other sources.
But all we need to do to get rid of that error is to actually create an API keys dot yaml file.
So says there's no API keys diam on a copy so that I don't misspell that control l and I'm just going
to say echo.
Actually, we can just say nothing into and then paste.
Clipboard.
And what this will do is create an empty file called API keys, dot yaml so we won't run into that error.
And if it's taking too long for you to do the all report, you can just blend your reports by doing
like LinkedIn and Google.
And press enter.
It will do a search of just Google and LinkedIn.
Or you can look through the help and choose any of the other sources.
And we can see that it says it's created a report and the report name that we used was just reporting
that ASTM Al.
So I'm going to clear the screen and I'm going to say Firefox report that a female.
And you can see by running Firefox from the command line with the name of the file that existed report,
not H.T. email.
I can see some information from the harvester.
It not only gathered some e-mail addresses, hopefully in some names from linked in it gathered hundreds
of servers that have been used over the years.
Domain names.
Now, these are old entries for the most part, but they're around 130 servers on our campus network.
So that's a really important resource to know is out there.
We can see some emails, some hosts.
See some things from virus total.
We see more hosts.
We can do a little information down here, we can see that we got a Bat 864 e-mail addresses.
And so if we do control F and then search for mail, we will see career services, we'll see names of
people.
In fact, I'm wondering, is there a Bryce and pain we can control F and search for Bryson?
And it didn't find me in there.
But that's OK.
Our university does a good job of keeping old information off the Internet.
But you can see once it's on the Internet, it may be there for forever.
So we found lots of host information, lots of IP addresses.
A good number of email addresses.
We have about 4000 employees, I believe.
So about 864 were in there in some place.
And you can see where all of the results came from, from our all search.
So some really useful information.
If you have trouble using the harvester.
Feel free to rerun it.
Just hit the up arrow and press enter again.
It'll give it another try.
If you have the any of the API keys errors, we showed you how to fix that.
And in the next lesson, we're gonna see how to use the next tool recon in G together.
Even more information about servers on the network.