There's one more passive recon tool that we're going to learn about in Caleigh, and that is recon in
G.
That's short for reconnaissance.
Next generation.
So we're going to open up recon engy and get started.
There's been some big updates to recon in G in version five and beyond.
We want to show you how to use the new version of recon in G.
So we can actually use the command line to run this or we can come up to our Caleigh menu, come to
information gathering and scroll down a little bit, you'll see Rickon in G.
There we go and we can see that we're using the one of the newer versions.
This is actually already a couple of versions behind the reconned version 5.1, but it didn't do a sudo
app, get pseudo Apte update and pseudo Apte upgrade.
So what I'm going to do is actually install some of the tools that we'll need to use.
You'll see that it comes up now in version five and and newer with no modules enabled or installed.
Will we need to use the marketplace command to install some of those commands into recon?
And we're actually going to choose some specific tools for reconnaissance.
There are tools for vulnerability analysis.
Lots of things that recon engy can do these days.
Terrific update from Tim Thomas.
But so we're going to do a marketplace, install recon
marketplace, install recon.
And this is going to go out to the Rickon Energy Marketplace and install all of the Rickon modules,
you can see we can gather information about companies contacts, domain's hosts, you name it, credentials.
There may be information on people's usernames and passwords out there on the Web.
It'll take a couple of moments to install all of those modules, and you may see some errors on your
screen like this.
It just says that there is no API key.
There are a lot of these searches, like Shodan, like Twitter, where you can enter an API key if you
have an account.
Sometimes a paid account for some of these services, but that will give you access to even deeper searches
within each of those platforms.
But reconning G is great just the way it is.
I'm actually going to look for a tool called Hack or Target.
So I'm going to say marketplace.
Search hacker target.
And it's found recon domains hosted Sacher Target.
It is installed.
So we got that as part of our recon package.
Just a moment ago and doesn't have dependencies.
Doesn't require one of those API keys.
So we can just use hacker target to gather some information about organization.
I'm going to say module's.
Let's clear the screen here.
Modules load recon slash domain's dash hosts.
And you can use your tab key to autocomplete here.
Hacker Target H.H. Tab.
And then we need to figure out what options we need to specify.
So a hacker target you can see is a command line driven or recon.
Engy is a command line driven tool and hacker target requires some action.
So we're gonna say options list.
It says we need to set a source.
So many say options.
Set source analysts at the source.
This is the domain that you want to gather more information about.
For me, I'm using you, Daddy, to you, because that's one of the organizations I've worked with for
a long time.
And then I can run.
So replace option set source you Inchy Daddy to you with CNN dot com or with the organization you want
to learn more about.
And then press run and you can see it found one hundred thirty four total new hosts.
So that means that there are 134 servers listed in the hacker target open source free database out there.
And if I say show hosts,
show hosts, it'll give me a nice clean table with all of those machines.
Now, in here, you might want to look for certain things like of VPN is like single sign on.
You might find an L that or directory server.
You might find name servers and s you might find old web servers that may not be being used or you might
find a development server dev.
So depending on what you're looking for in your organization.
This is a really quick way to find out.
Number one, if you have more servers than you realized were publicly available, it gives you the IP
address so you can verify those.
So it's a really handy tool as an ethical hacker.
We want to know whether we're exposing more information down on the Internet than we mean to or if our
client that's hired us to do some ethical hacking testing for them has information that they've forgotten
about.
It's also a great way on a big production network to find out if you've got some public services that
you just forgot about.
Maybe there used to be somebody who used a server called you in GSB, but it's not in use anymore and
nobody knows where it's located.
The IP address is the first step in figuring out where that service might be and what might be running
on it, because we can do more advanced scans.
Well, this is as far as we're going to go on a public network because we don't want to I don't have
the permission of even my university to do a scan against them.
But we're going to see in the next lesson how to use in MAP to take it to the next step.
Once we found a candidate host, we might want to gather more information about that service.
If it's a server that we've forgotten on our network, we want to figure out what's running on that
server and whether it might have been compromised.
We'll see how to do that within map.
Coming up next.