WEBVTT

00:00:01.540 --> 00:00:03.250
Welcome back to our lab environment.

00:00:03.840 --> 00:00:04.290
Now,

00:00:04.300 --> 00:00:07.780
let me show you how we can run stealthy scans and how we can

00:00:07.780 --> 00:00:10.460
gather open source intelligence from our target.

00:00:11.840 --> 00:00:16.160
The idea of a stealthy scan is only using passive information gathering,

00:00:16.640 --> 00:00:19.850
meaning that we are not doing any kind of probing against our target.

00:00:20.640 --> 00:00:23.710
We're not doing aggressive scans, neither vulnerability

00:00:23.710 --> 00:00:27.450
scans. Basically, we're just gathering information that is

00:00:27.450 --> 00:00:29.160
publicly available on the internet.

00:00:30.040 --> 00:00:32.670
And because this is known invasive information gathering,

00:00:32.680 --> 00:00:35.560
we can use some more interesting targets in this demo.

00:00:36.740 --> 00:00:41.660
For example, let's say I want to get more information about the nasa.gov domain.

00:00:42.340 --> 00:00:50.100
I can type sniper ‑t, and then our target domain. Now, to make

00:00:50.100 --> 00:00:54.710
sure that this is a stealthy scan, I must use the flag ‑m and

00:00:54.710 --> 00:00:58.750
then the option stealth, and this means that we are just doing

00:00:58.750 --> 00:01:00.160
passive information gathering.

00:01:01.140 --> 00:01:04.690
Also, since I want to perform some open source information gathering,

00:01:04.700 --> 00:01:11.640
I use the flag ‑o to enable the whole scan and ‑re to enable the

00:01:11.640 --> 00:01:17.030
recon mode. And once I run this, Sn1per will execute all the passive

00:01:17.030 --> 00:01:19.860
scans in its library. And more than that,

00:01:19.870 --> 00:01:23.220
they also try to get information from open source databases.

00:01:23.230 --> 00:01:25.640
For example, information from LinkedIn,

00:01:25.650 --> 00:01:31.510
Twitter, and other social medias. As you can see, this scan is still running

00:01:31.520 --> 00:01:33.660
and you've already found a lot of interesting information.

00:01:34.340 --> 00:01:38.930
For example, here we have a list of a lot of NASA employees. And again,

00:01:38.940 --> 00:01:42.680
all of this is public information and Sn1per is just collecting that

00:01:42.680 --> 00:01:46.200
information for us. As this might take a few minutes,

00:01:46.210 --> 00:01:48.660
I'll speed up this video so we don't have to wait.

00:01:52.540 --> 00:01:54.250
Then, the scan is now completed.

00:01:54.940 --> 00:01:58.260
Now, let's go to the report folder and see what we have in there.

00:01:59.240 --> 00:02:05.740
Remember, this reports folder can be accessed in this path here, user, share,

00:02:05.980 --> 00:02:14.460
sniper, loot, workspace, and then nasa.gov. In here, there are two reports, and

00:02:14.460 --> 00:02:17.450
that's because I ran a scan earlier today as a test.

00:02:18.240 --> 00:02:21.560
So, let's open the latest report and take a look what is inside.

00:02:23.640 --> 00:02:24.090
Perfect.

00:02:24.090 --> 00:02:26.570
Take a look. There's a lot of information. And again,

00:02:26.580 --> 00:02:29.160
we're not going to have time to go through every single detail.

00:02:29.640 --> 00:02:33.360
But now, the interesting part here is that we have some old information.

00:02:34.440 --> 00:02:35.030
For example,

00:02:35.040 --> 00:02:39.140
we have here a list of all the employees that work for NASA, and

00:02:39.140 --> 00:02:41.250
this information probably came from LinkedIn.

00:02:42.740 --> 00:02:46.640
Also, we have a list of several NASA subdomains, and this

00:02:46.650 --> 00:02:48.360
probably came from google searches.

00:02:49.840 --> 00:02:51.430
Pretty cool, right? And again,

00:02:51.440 --> 00:02:54.800
all this information is also stored in attacks format

00:02:54.810 --> 00:02:56.350
instead of the workspace folder.

00:02:57.140 --> 00:02:57.890
So if you want,

00:02:57.900 --> 00:03:01.660
you can create custom scripts to automate even more your writing process.