WEBVTT

00:00:01.640 --> 00:00:02.270
Hey there.

00:00:02.280 --> 00:00:03.750
Welcome to the lab environment.

00:00:03.750 --> 00:00:08.160
In here I have my Kali Linux machine version 2021.

00:00:08.940 --> 00:00:12.050
To get started, let's install the Amass tool here.

00:00:12.050 --> 00:00:14.660
The installation process is really simple.

00:00:15.440 --> 00:00:23.160
First, let's open the terminal, and then let's run a sudo apt‑get update.

00:00:25.040 --> 00:00:33.270
And when that's completed, let's run sudo apt‑get install amass, and that's it.

00:00:33.280 --> 00:00:36.030
This will install and configure the Amass tool in

00:00:36.030 --> 00:00:37.660
the Kali Linux virtual machine.

00:00:38.540 --> 00:00:40.540
And this process might take a few minutes,

00:00:40.550 --> 00:00:43.860
so I'll speed up this video to save you some time.

00:00:43.860 --> 00:00:49.760
To test if the installation worked, I'll run the command amass ‑h,

00:00:50.140 --> 00:00:52.370
which will show you the help page.

00:00:52.370 --> 00:00:54.850
And take a look, it seems that it works now.

00:00:55.740 --> 00:00:59.250
As you can see here, Amass is divided into different modules.

00:00:59.740 --> 00:01:03.370
For example, we have the intel module, the enumeration module,

00:01:03.380 --> 00:01:06.420
the visualization module, and so on.

00:01:06.420 --> 00:01:10.560
And the cool part is that those modules are kind of independent.

00:01:11.240 --> 00:01:15.060
So for example, if I want to know all the features of a specific module,

00:01:15.070 --> 00:01:19.850
I can just use amass, then the module that I want to use,

00:01:20.540 --> 00:01:25.460
and then ‑h, which will give us the help page for that specific module.

00:01:26.840 --> 00:01:27.340
Take a look.

00:01:27.340 --> 00:01:27.850
In here,

00:01:27.850 --> 00:01:30.290
we can see a list of all the parameters that we can

00:01:30.290 --> 00:01:31.850
use with the enumeration module.

00:01:33.140 --> 00:01:33.660
Perfect.

00:01:33.670 --> 00:01:37.570
Okay, so enough of introductions, let's start to use this tool.

00:01:37.570 --> 00:01:41.460
To commemorate the potential target of a domain is really simple.

00:01:41.940 --> 00:01:45.860
I'll use amass, then the module enum,

00:01:46.640 --> 00:01:50.660
and then the flag ‑d to define the domain that I want to enumerate.

00:01:51.540 --> 00:01:54.060
In my case, I'm using globomantics.com.

00:01:55.340 --> 00:01:58.540
Also, if you want, you can have multiple domains as a target.

00:01:58.550 --> 00:02:00.050
You just need to use comma.

00:02:01.240 --> 00:02:04.560
And this what we see here is the most basic command that we can run.

00:02:05.440 --> 00:02:07.660
But in here I will add a few more options.

00:02:08.440 --> 00:02:10.680
For example, I will add ‑src,

00:02:10.680 --> 00:02:14.860
because I want Amass to show us where the data's coming from.

00:02:15.840 --> 00:02:19.470
And then I will also add ‑ip to indicate that I want to

00:02:19.470 --> 00:02:21.660
see the IP addresses for each target.

00:02:22.740 --> 00:02:26.350
And to finalize, I want to save all the results somewhere.

00:02:26.350 --> 00:02:27.420
In here,

00:02:27.430 --> 00:02:31.210
I'll use the flag ‑dir and put the name of the directory

00:02:31.220 --> 00:02:32.850
in which I want the data to be saved.

00:02:34.140 --> 00:02:35.320
Pretty easy, right?

00:02:35.320 --> 00:02:36.760
Now, let's run this.

00:02:38.340 --> 00:02:40.840
So what Amass is doing in the background is searching

00:02:40.840 --> 00:02:43.850
across several open source databases for domains and

00:02:43.850 --> 00:02:46.050
sub‑domains related to Globomantics.

00:02:46.940 --> 00:02:51.280
Also, Amass is checking if the discovered domains are actually reachable.

00:02:51.280 --> 00:02:54.200
And this process might take a few minutes,

00:02:54.200 --> 00:02:56.750
so I'll speed up this video to save us some time.

00:02:59.040 --> 00:02:59.540
Done.

00:02:59.550 --> 00:03:02.600
As we can see, Amass found two potential targets.

00:03:02.600 --> 00:03:06.990
And more than that, on the left side we can see where the information came from.

00:03:06.990 --> 00:03:10.960
And on the right side we can see the IP addresses of those domains.

00:03:12.040 --> 00:03:14.910
One important thing to note is that Amass only shows

00:03:14.910 --> 00:03:16.450
us targets that are resolvable.

00:03:17.240 --> 00:03:21.550
So if you compare this result here with the result of other recon tools,

00:03:21.560 --> 00:03:24.560
you might think that Amass is not discovering everything.

00:03:25.540 --> 00:03:29.140
But the reality is that the other tools usually do not test to

00:03:29.140 --> 00:03:31.260
see if the domain is actually reachable or not.

00:03:31.840 --> 00:03:34.860
And this means that we end up with a lot of false positives.

00:03:34.860 --> 00:03:38.860
But in here, Amass does not give us any false positives.

00:03:39.240 --> 00:03:41.960
Those two found targets are for sure available.

00:03:43.240 --> 00:03:43.800
Also,

00:03:43.810 --> 00:03:46.740
in here we're using the Globomantics domain, which is

00:03:46.740 --> 00:03:48.810
a testing domain from Pluralsight.

00:03:48.810 --> 00:03:52.110
But just to show you how powerful this tool is,

00:03:52.120 --> 00:03:54.160
I'll run the same enumeration technique,

00:03:54.170 --> 00:03:56.820
but now against the NASA website.

00:03:56.820 --> 00:04:00.410
In here I'll also include the flag ‑norecursive,

00:04:00.410 --> 00:04:03.690
so then this scan only looks at one level of

00:04:03.690 --> 00:04:05.860
subdomains and is a little bit faster.

00:04:08.940 --> 00:04:11.360
Then take a look, we can already see some domains in here.

00:04:12.040 --> 00:04:14.670
But because NASA has tons of subdomains,

00:04:14.680 --> 00:04:18.930
this search might take it around 20 to 30 minutes. But in

00:04:18.930 --> 00:04:21.279
here, as we're not interested in hacking NASA,

00:04:21.290 --> 00:04:22.560
I'll just cancel the scan.

00:04:24.240 --> 00:04:24.870
Perfect.

00:04:24.880 --> 00:04:27.860
Now, let me show you one more cool feature of Amass.

00:04:28.540 --> 00:04:32.600
I'll run the same enumeration command that we're running, but I will also

00:04:32.600 --> 00:04:37.520
include the flag ‑brute here. And with this option enabled, Amass will try

00:04:37.520 --> 00:04:39.860
to brute force the name of the subdomains.

00:04:40.540 --> 00:04:41.720
Also, as always,

00:04:41.730 --> 00:04:45.160
I'm including here the directory where I want the data to be saved.

00:04:46.040 --> 00:04:49.150
And note that it can save multiple scanned results in the same

00:04:49.150 --> 00:04:53.970
directory. And when I run this, Amass will try thousands of null

00:04:53.970 --> 00:04:56.850
subdomain names, and hopefully we'll have some matches.

00:05:00.240 --> 00:05:01.140
Perfect, take a look.

00:05:01.150 --> 00:05:03.680
We didn't find anything more than we found before.

00:05:03.910 --> 00:05:07.440
It is pretty much the same domains. But in any case, it is interesting

00:05:07.440 --> 00:05:10.970
that it runs this brute force mode against your targets because, in your

00:05:10.970 --> 00:05:15.960
case, you might find more domains than expected. The Amass tool saves a

00:05:15.960 --> 00:05:17.950
DNS word list in this folder here,

00:05:18.340 --> 00:05:23.280
user/share/amass/wordlists. In here you can see all the

00:05:23.290 --> 00:05:26.950
out‑of‑the‑box DNS brute force lists. And if you want,

00:05:26.960 --> 00:05:30.460
you can create your own DNS brute force list and put it in this folder.

00:05:32.040 --> 00:05:34.760
Now, let's take a look in the intel module of Amass.

00:05:35.540 --> 00:05:38.240
This will try to use some more advanced features to

00:05:38.240 --> 00:05:39.950
find potential domains to attack.

00:05:40.740 --> 00:05:41.350
For example,

00:05:41.360 --> 00:05:50.620
let's use this command here, amass intel ‑asn. Basically, this command

00:05:50.630 --> 00:05:53.760
will try to find all the domains related to an ASN.

00:05:54.740 --> 00:05:55.290
For example,

00:05:55.300 --> 00:05:58.990
let's take a look on the ASN from Globomantics. We can get

00:05:58.990 --> 00:06:00.960
this information from a previous scan.

00:06:01.640 --> 00:06:02.960
Take a look; it is right here.

00:06:05.040 --> 00:06:05.620
Perfect.

00:06:05.630 --> 00:06:05.900
Now,

00:06:05.900 --> 00:06:09.070
once I run this, Amass will start to search for all

00:06:09.070 --> 00:06:11.460
the domains related to this ASN.

00:06:12.540 --> 00:06:17.120
In our case, because the Globomantics domain is hosted on Amazon AWS,

00:06:17.130 --> 00:06:21.560
we find several other services hosted in AWS, and

00:06:21.560 --> 00:06:24.050
unfortunately those are not interesting for us.

00:06:24.940 --> 00:06:26.910
And actually, this is really important to remember.

00:06:26.910 --> 00:06:29.080
Whenever you're doing a red team exercise,

00:06:29.090 --> 00:06:32.560
make sure you're attacking a server that is part of your client domain.

00:06:33.340 --> 00:06:35.280
Sometimes, like in this case here,

00:06:35.290 --> 00:06:37.810
when the infrastructure is shared across several clients,

00:06:37.840 --> 00:06:41.260
you might see targets that are not part of your client infrastructure.

00:06:41.940 --> 00:06:44.850
And if you try to hack them, you're going to be committing a crime.

00:06:46.240 --> 00:06:47.010
Okay, cool.

00:06:47.020 --> 00:06:50.090
So one last thing I want to show you is how to perform a

00:06:50.090 --> 00:06:58.680
reverse WHOIS lookup. For that I'll use amass intel ‑whois, and

00:06:58.680 --> 00:07:01.360
then ‑d and the Globomantics domain.

00:07:02.640 --> 00:07:03.340
After that,

00:07:03.350 --> 00:07:07.030
I will just put ‑dir and the directory that I want to save the

00:07:07.030 --> 00:07:12.710
results. When I run this, Amass will check the WHOIS information for

00:07:12.710 --> 00:07:16.900
the Globomantics domain and then will try to find other domains with

00:07:16.900 --> 00:07:19.750
similar information, for example,

00:07:19.760 --> 00:07:23.250
if any other domain has the same email addresses associated to it.

00:07:24.740 --> 00:07:27.240
As you can see, in our Globomantics case,

00:07:27.250 --> 00:07:29.850
there is nothing else similar, but that's fine.

00:07:29.860 --> 00:07:31.360
It is always worth checking that.