WEBVTT 00:00:01.740 --> 00:00:02.320 Hey there. 00:00:02.330 --> 00:00:05.160 Welcome to the course, Reconnaissance with Sn1per. 00:00:05.840 --> 00:00:06.610 In this course, 00:00:06.620 --> 00:00:08.790 we'll talk about one of the most complete 00:00:08.790 --> 00:00:10.550 information gathering tools in the market, 00:00:10.940 --> 00:00:15.050 and you'll learn how to automate your reconnaissance to save you a lot of time. 00:00:16.640 --> 00:00:20.440 If you've worked in a red team engagement before or even in penetration testing, 00:00:20.450 --> 00:00:24.370 you know that the first and most important step is to gather as 00:00:24.370 --> 00:00:26.660 much information as possible about our target. 00:00:27.740 --> 00:00:31.690 Usually in a red team engagement, you need to gather the IP addresses, 00:00:31.700 --> 00:00:35.650 DNS data, network information, people information, 00:00:35.660 --> 00:00:40.230 open source intelligence, and much more. And trying to do this manually, 00:00:40.240 --> 00:00:43.260 it is virtually impossible. It would take too long. 00:00:44.340 --> 00:00:48.360 Usually, red team specialists have few tools to do this reconnaissance. 00:00:49.440 --> 00:00:50.150 For example, 00:00:50.150 --> 00:00:54.750 you can use Nmap to gather open ports or theHarvester to get email addresses. 00:00:55.440 --> 00:00:58.710 But the problem is that you have to use several different tools, 00:00:58.740 --> 00:01:01.160 and they always output in different formats. 00:01:01.740 --> 00:01:03.960 And that's where Sn1per can help you. 00:01:04.840 --> 00:01:08.560 Sn1per is a tool that does pretty much all the reconnaissance for you. 00:01:09.540 --> 00:01:13.800 It uses the most well‑known tools in the market to gather all the information 00:01:13.800 --> 00:01:18.930 you need for your red team engagement. With just one command, Sn1per will run 00:01:18.930 --> 00:01:22.380 several of the reconnaissance tools in the background and it will output 00:01:22.390 --> 00:01:24.860 everything in a format that is useful for you. 00:01:26.040 --> 00:01:29.810 Pretty cool, right? In this course, you'll see how easy it is to 00:01:29.810 --> 00:01:35.480 harvest tons of data with just one tool. The Sn1per tool is one of 00:01:35.480 --> 00:01:40.520 the most used open source tools for reconnaissance. This tool was 00:01:40.520 --> 00:01:42.450 developed by the XeroSecurity team. 00:01:42.840 --> 00:01:45.850 They actually started this tool as an open source project, 00:01:45.860 --> 00:01:48.560 and now they have some really interesting professional tools. 00:01:49.440 --> 00:01:49.970 Personally, 00:01:49.980 --> 00:01:53.180 I do recommend you checking out there website so then you 00:01:53.180 --> 00:01:54.960 can see all the cool projects they have. 00:01:56.540 --> 00:01:59.590 The Sn1per tool is the finest tool for discovering 00:01:59.590 --> 00:02:01.850 attack surface and prioritizing risks. 00:02:02.740 --> 00:02:03.370 Basically, 00:02:03.380 --> 00:02:07.020 it automates the most common reconnaissance techniques and returns to you 00:02:07.030 --> 00:02:09.850 all the information you need in one simplified format. 00:02:11.740 --> 00:02:14.860 The best part about this tool is that it's free for the community. 00:02:15.340 --> 00:02:18.660 You can download the source code in GitHub and start to play with it. 00:02:19.740 --> 00:02:20.830 As I mentioned before, 00:02:20.840 --> 00:02:24.590 Sn1per is one of the most complete tools for reconnaissance, and 00:02:24.590 --> 00:02:28.420 that's because it leverages several really well‑known recon scripts, 00:02:28.430 --> 00:02:32.860 like Nmap, theHarvester, WafW00f, and etc. 00:02:33.940 --> 00:02:36.480 And this means that with just one command line, 00:02:36.490 --> 00:02:39.870 you execute several really advanced recon techniques using 00:02:39.870 --> 00:02:41.860 the latest open source tools in the market. 00:02:42.940 --> 00:02:45.740 But one thing to note is that personally I recommend this 00:02:45.740 --> 00:02:48.120 tool only if you already have some experience in red 00:02:48.120 --> 00:02:49.750 teaming or penetration testing. 00:02:50.540 --> 00:02:53.450 And the reason for that is that Sn1per generates a lot of 00:02:53.450 --> 00:02:56.600 information and it might be overwhelming if you've never 00:02:56.600 --> 00:02:58.060 used any recon tool before. 00:03:00.540 --> 00:03:01.320 With Sn1per, 00:03:01.330 --> 00:03:04.650 we can perform both passive and active information gathering. 00:03:05.740 --> 00:03:08.580 Passive information gathering is when you gather data with 00:03:08.580 --> 00:03:10.260 minimal interaction to your target. 00:03:11.040 --> 00:03:12.970 For example, in a passive scan, 00:03:12.980 --> 00:03:16.830 we do not perform any type of port scan or vulnerability scans. 00:03:16.830 --> 00:03:20.880 In a passive information gathering, we usually gather data using 00:03:20.880 --> 00:03:24.130 third‑party sources of information, such as WHOIS records, 00:03:24.140 --> 00:03:27.160 DNS queries, open source intelligence searches, 00:03:27.170 --> 00:03:28.680 social media searches, 00:03:28.800 --> 00:03:33.320 search engine recon, and much more. And again, note that we 00:03:33.320 --> 00:03:35.450 are not directly poking our victim domain. 00:03:36.040 --> 00:03:39.060 We're basically collecting all the data that is available on the internet. 00:03:40.340 --> 00:03:43.360 On the other hand, we have the active information gathering, 00:03:43.740 --> 00:03:46.860 which means that we directly interact with our victim computer. 00:03:47.640 --> 00:03:50.040 For example, in active information gathering, 00:03:50.050 --> 00:03:53.320 we perform Nmap port scans, vulnerability scans, 00:03:53.430 --> 00:03:55.650 web application probing, and much more. 00:03:57.140 --> 00:04:00.960 One thing to note is that performing active information gathering might be 00:04:00.960 --> 00:04:04.760 illegal if you don't have the proper authorization, so make sure you have a 00:04:04.760 --> 00:04:09.520 formal document allowing you to do active information gathering. For passive 00:04:09.520 --> 00:04:12.830 scans, we're just getting information from what is already available on the 00:04:12.830 --> 00:04:14.560 internet, so this is usually fine. 00:04:16.740 --> 00:04:19.060 If you're familiar with a red team kill chain, 00:04:19.070 --> 00:04:23.430 we can map Sn1per to the recon phase of this process. The 00:04:23.430 --> 00:04:26.740 Sn1per tool allows us to gather tons of technical and 00:04:26.740 --> 00:04:28.550 nontechnical information about our target. 00:04:29.940 --> 00:04:33.190 Also, if we map this course to the MITRE ATT&CK framework, 00:04:33.200 --> 00:04:35.760 you'll note that we cover one main phase in here, 00:04:36.140 --> 00:04:40.310 which is reconnaissance. Inside of reconnaissance, 00:04:40.320 --> 00:04:43.170 we cover several techniques with the Sn1per tool, 00:04:43.180 --> 00:04:46.260 such as active scanning, gather host information, 00:04:46.270 --> 00:04:49.840 gathering network information, search technical databases, 00:04:50.050 --> 00:04:53.850 search open source websites, and even gather identity information. 00:04:54.840 --> 00:04:57.450 And in my opinion, that's the cool part about Sn1per. 00:04:57.940 --> 00:05:01.800 While most of the tools only cover one or two techniques, in here, we 00:05:01.800 --> 00:05:04.660 cover almost everything you need during the recon phase. 00:05:06.840 --> 00:05:08.540 Okay, so enough of theory. 00:05:08.550 --> 00:05:12.400 Let's talk about what we will see in our demos. In here, we'll perform 00:05:12.400 --> 00:05:19.040 reconnaissance against two domains, globomantics.com and nasa.gov. On the 00:05:19.040 --> 00:05:23.540 Globomantics domain, we'll use both active and passive techniques with 00:05:23.540 --> 00:05:26.580 the intention of finding open ports, vulnerabilities, 00:05:26.590 --> 00:05:28.000 DNS records, 00:05:28.010 --> 00:05:34.480 IP ranges, and much more. On the nasa.gov domain, we'll use only passive 00:05:34.480 --> 00:05:37.560 scans and also some open source intelligence research. 00:05:38.440 --> 00:05:40.860 And the idea here is finding subdomains, 00:05:40.940 --> 00:05:43.750 employee names, email addresses, and etc. 00:05:45.340 --> 00:05:48.470 And note here that the Globomantics domain is a domain that I have 00:05:48.470 --> 00:05:53.060 authorization to perform active scans, so then I can run vulnerability 00:05:53.060 --> 00:05:58.080 scans and port scans. For the NASA domain, as we don't have permissions 00:05:58.080 --> 00:05:59.680 for doing any vulnerability scans, 00:05:59.690 --> 00:06:03.700 we only perform passive scans to gather data that is already available on the 00:06:03.700 --> 00:06:07.960 internet. And, we'll not be poking the NASA website itself. 00:06:08.440 --> 00:06:08.940 Instead, 00:06:08.950 --> 00:06:11.880 we'll use the information from search engines and social 00:06:11.880 --> 00:06:13.860 media to get all the information for us. 00:06:14.940 --> 00:06:15.500 Remember, 00:06:15.510 --> 00:06:19.460 you can only perform active scans if you have written authorization for that. 00:06:21.640 --> 00:06:24.190 If you want to follow this demo on your own environment, 00:06:24.200 --> 00:06:28.020 all you need is just your attacker machine. In here, I'm 00:06:28.020 --> 00:06:29.960 using a Kali Linux virtual machine, 00:06:29.970 --> 00:06:32.960 but you can actually use any Linux distribution you want. 00:06:33.740 --> 00:06:36.260 So, if you're ready, let's go to our demo environment.