WEBVTT 00:00:01.340 --> 00:00:06.630 Hey there, welcome to the course Reconnaissance with OWASP Amass. In here, 00:00:06.640 --> 00:00:11.650 we'll cover how to use some advanced recon techniques for enumerating domains. 00:00:13.540 --> 00:00:19.000 Your first step on a red team engagement is the recon phase, and in this phase, 00:00:19.010 --> 00:00:23.400 one of your main tasks is to enumerate all the domains of your target so 00:00:23.400 --> 00:00:26.060 then you can decide what you'll try to attack first. 00:00:27.640 --> 00:00:32.259 Usually what most people do is running some DNS queries to identify which 00:00:32.259 --> 00:00:36.020 domains belongs to a company, and although this works, 00:00:36.030 --> 00:00:38.860 it usually does not identify all the domains of a company. 00:00:40.040 --> 00:00:43.850 Nowadays, we have several more advanced techniques for domain enumeration, 00:00:43.860 --> 00:00:46.550 which will return you way more valid domains to test. 00:00:47.740 --> 00:00:48.370 For example, 00:00:48.380 --> 00:00:52.050 we can search open source databases for all the domains related to a 00:00:52.050 --> 00:00:56.860 company, or we can check the history of the certificates generated for 00:00:56.860 --> 00:01:01.700 a company, or we can use some APIs to third‑party tools to get domain 00:01:01.700 --> 00:01:06.550 information, or we could even check some web archives to see if there's 00:01:06.560 --> 00:01:11.790 any domains in the past that were open to the public. As you can 00:01:11.790 --> 00:01:15.570 imagine, doing all those advanced recon techniques manually takes a lot 00:01:15.570 --> 00:01:16.050 of time. 00:01:16.740 --> 00:01:21.150 For this reason, we have the Amass tool, which automates all those techniques I 00:01:21.150 --> 00:01:24.150 mentioned before, as well as a few other recon techniques. 00:01:25.940 --> 00:01:29.290 The Amass tool was mainly developed by Jeff Foley and 00:01:29.300 --> 00:01:32.090 Anthony Rhodes, and thanks to those guys, 00:01:32.100 --> 00:01:34.650 we can save a lot of time doing a red team engagement. 00:01:35.540 --> 00:01:38.690 If you never heard about Jeff or Anthony before, I do 00:01:38.690 --> 00:01:40.250 recommend you checking their work. 00:01:40.640 --> 00:01:42.760 They have a lot of interesting publications out there. 00:01:44.040 --> 00:01:47.890 The OWASP Amass tool can be described as a tool for performing 00:01:47.890 --> 00:01:52.050 network mapping of attack surfaces and external asset discovery 00:01:52.060 --> 00:01:53.760 using open source information gathering. 00:01:54.540 --> 00:01:57.960 Also, we can do a lot of active reconnaissance techniques with this tool. 00:01:58.740 --> 00:01:59.600 In other words, 00:01:59.610 --> 00:02:03.460 Amass uses several passive and active techniques to find 00:02:03.460 --> 00:02:05.250 as much domain information as possible. 00:02:07.940 --> 00:02:11.130 What I love about Amass is that it is an open source tool, 00:02:11.150 --> 00:02:13.270 meaning that if you access this GitHub page, 00:02:13.280 --> 00:02:17.290 you can download the source code for free or you can even edit the 00:02:17.290 --> 00:02:19.650 source code and customize it for your needs. 00:02:20.840 --> 00:02:21.310 Also, 00:02:21.320 --> 00:02:25.540 it is important to remember that Amass is part of the OWASP project, 00:02:25.580 --> 00:02:28.460 which stands for Open Web Application Security Project. 00:02:29.440 --> 00:02:31.220 If you never heard about OWASP before, 00:02:31.230 --> 00:02:36.060 I definitely recommend you checking it out. As I mentioned before, 00:02:36.060 --> 00:02:40.480 Amass allows us to discover the attack surface of our target, and 00:02:40.480 --> 00:02:44.570 this tool uses several advanced recon techniques to identify domains 00:02:44.570 --> 00:02:48.590 and IPs related to our target, so then we can pick which domains we 00:02:48.590 --> 00:02:49.560 want to focus first. 00:02:50.740 --> 00:02:51.280 Also, 00:02:51.290 --> 00:02:54.810 Amass has a really cool feature in which it generates a graph 00:02:54.820 --> 00:02:57.660 showing the relationship between the domains and the sub domains, 00:02:58.440 --> 00:03:01.630 and you've seen our demo how this graphic can be helpful to 00:03:01.630 --> 00:03:02.960 better understand our target. 00:03:05.240 --> 00:03:06.320 In the previous slide, 00:03:06.330 --> 00:03:09.650 I mentioned that Amass has some more advanced recon techniques, 00:03:10.040 --> 00:03:12.050 and you might be wondering what are those? 00:03:13.040 --> 00:03:15.860 Amass has several ways of discovering new domains, 00:03:16.340 --> 00:03:19.680 but the ones that I've found more interesting are brute forcing, 00:03:19.690 --> 00:03:24.350 alterations, reverse WHOIS, and searching web archives. 00:03:25.640 --> 00:03:29.070 The domain brute force you might have heard before. Basically, 00:03:29.070 --> 00:03:32.360 Amass tries several non‑subdomain names. 00:03:33.040 --> 00:03:33.650 For example, 00:03:33.660 --> 00:03:36.020 if you are doing the recon against the Globomantics 00:03:36.020 --> 00:03:40.130 domain, Amass will try web.globomantics, 00:03:40.130 --> 00:03:44.760 mail.globomantics, ftp.globomantics, and much more. 00:03:46.140 --> 00:03:48.670 The domain alterations is basically mutating the 00:03:48.670 --> 00:03:50.760 domain names to find similar servers. 00:03:51.340 --> 00:03:56.650 For example, let's say we found a server called dc01.globomantics.com. 00:03:57.440 --> 00:04:04.760 Then Amass will also try dc02.globomantics.com and dc03.globomantics,com. 00:04:06.240 --> 00:04:08.550 The reverse WHOIS is an interesting one. 00:04:09.340 --> 00:04:13.740 First Amass does a basic WHOIS search against our target domain, and 00:04:13.740 --> 00:04:16.680 then extracts some key information, for example, 00:04:16.690 --> 00:04:19.149 the email address of the administrator of that domain. 00:04:19.839 --> 00:04:24.290 Then Amass does a reverse search looking for all the domains registered for the 00:04:24.290 --> 00:04:27.360 same email address, which might result in similar domains. 00:04:28.840 --> 00:04:31.960 And finally, the web archive is also an interesting one. 00:04:32.640 --> 00:04:37.640 Basically, Amass uses web archive websites to find old websites related to 00:04:37.640 --> 00:04:42.160 Globomantics, and from those archives you can find domains that might not even 00:04:42.160 --> 00:04:45.160 be available anymore and might be worth checking it out. 00:04:46.240 --> 00:04:49.120 Those are just some of the techniques that Amass performs in the 00:04:49.120 --> 00:04:52.750 background, and for this reason I think Amass is one of the best 00:04:52.750 --> 00:04:54.360 tools for identifying subdomains. 00:04:56.840 --> 00:04:59.540 If you're familiar with the red team kill chain methodology, 00:04:59.550 --> 00:05:03.160 we can map the Amass tool to the recon phase of this process. 00:05:04.140 --> 00:05:08.190 In here, we use Amass to discover subdomains and IP 00:05:08.190 --> 00:05:09.860 addresses related to our target. 00:05:11.840 --> 00:05:14.480 Also, if you're familiar with the MITRE ATT&CK framework, 00:05:14.490 --> 00:05:17.260 we can map this course to the reconnaissance phase. 00:05:18.540 --> 00:05:21.980 In this phase, we focus on one main technique which is 00:05:21.990 --> 00:05:24.150 Search Open Technical Databases. 00:05:25.340 --> 00:05:29.990 Inside of this technique we cover three main sub‑techniques, which are 00:05:29.990 --> 00:05:36.600 DNS, WHOIS, and digital certificates, and the good news is Amass performs 00:05:36.610 --> 00:05:38.660 all those techniques automatically for us, 00:05:39.340 --> 00:05:42.360 which means that we're doing all those searches with just one tool. 00:05:44.540 --> 00:05:46.810 If you want to follow the demos of this course, 00:05:46.820 --> 00:05:48.950 all you need is an attacker machine. 00:05:49.940 --> 00:05:50.530 In here. 00:05:50.540 --> 00:05:52.990 I'm using a Kali Linux virtual machine, 00:05:53.000 --> 00:05:56.060 but you can actually use Amass in any Linux version you want. 00:05:56.540 --> 00:06:00.650 The installation process is really simple. So, if you're ready, 00:06:00.660 --> 00:06:02.160 let's go to our lab environment.