WEBVTT 00:00:01.740 --> 00:00:02.240 Hey there. 00:00:02.250 --> 00:00:05.150 Welcome to the Technical Information Gathering with theHarvester. 00:00:05.640 --> 00:00:06.290 I'm Ricardo. 00:00:06.300 --> 00:00:09.250 I'm a cybersecurity consultant with years experience in the field. 00:00:09.550 --> 00:00:12.140 In here you'll learn how to collect tons of valuable 00:00:12.140 --> 00:00:14.150 information for your red team engagement. 00:00:15.240 --> 00:00:15.600 So, 00:00:15.610 --> 00:00:17.940 imagine that you just got assigned to red team engagement 00:00:18.020 --> 00:00:20.150 against the globomantics.com company. 00:00:20.940 --> 00:00:23.550 Your first step is getting information about your target. 00:00:24.040 --> 00:00:27.110 So, did you know that you can actually gather tons of information about 00:00:27.110 --> 00:00:29.350 your target just by doing some searches on the internet? 00:00:29.840 --> 00:00:30.660 Yes, that's right. 00:00:30.670 --> 00:00:32.950 Without sending a single packet to our target we can 00:00:32.950 --> 00:00:34.650 gather tons of valuable information. 00:00:35.540 --> 00:00:38.260 For example, we can use search engines such as Google, 00:00:38.260 --> 00:00:41.150 Yahoo, and Bing to get information about Globomantics. 00:00:41.940 --> 00:00:44.560 In just a few seconds we can do a few searches and find 00:00:44.560 --> 00:00:46.350 subdomains that we could attack later. 00:00:47.040 --> 00:00:49.850 Sometimes the main website of a company is really secure, 00:00:50.030 --> 00:00:52.650 but their other systems may not be such as the email 00:00:52.650 --> 00:00:54.350 server or the HR applications. 00:00:55.440 --> 00:00:55.890 Also, 00:00:55.900 --> 00:00:58.390 we can use the same search engines to find email 00:00:58.400 --> 00:01:00.050 addresses related to this company. 00:01:00.440 --> 00:01:01.200 As you may know, 00:01:01.290 --> 00:01:05.170 Google indexes data from several websites so you can find email 00:01:05.170 --> 00:01:07.750 addresses even if they're posted in a different website. 00:01:09.040 --> 00:01:09.880 And more than that, 00:01:09.890 --> 00:01:13.030 we can use those search engines to find sensitive files 00:01:13.040 --> 00:01:14.550 that may be exposed to the public. 00:01:15.140 --> 00:01:15.730 For example, 00:01:15.740 --> 00:01:18.880 you may find metric diagrams or even database backups that may 00:01:18.880 --> 00:01:20.750 be useful later in the red team engagement. 00:01:21.540 --> 00:01:22.070 And also, 00:01:22.080 --> 00:01:24.520 we can use sites such as LinkedIn to find more 00:01:24.520 --> 00:01:26.250 information about the employees of a company. 00:01:26.870 --> 00:01:30.210 In a few minutes we can quickly find the name of key people in the company, 00:01:30.400 --> 00:01:32.910 which can be really useful for social engineering attacks. 00:01:34.110 --> 00:01:36.430 And the best part about this is that we can search as much 00:01:36.430 --> 00:01:39.140 as we want because it's not illegal to search data that is 00:01:39.140 --> 00:01:40.150 exposed on the internet. 00:01:41.040 --> 00:01:43.140 And also your target will never know that you're 00:01:43.140 --> 00:01:44.400 searching for their information. 00:01:45.330 --> 00:01:47.830 And if you want to get a little more invasive you can also do 00:01:47.830 --> 00:01:50.110 some queries and scans against some of the Globomantics 00:01:50.110 --> 00:01:51.850 servers that are internet facing. 00:01:52.590 --> 00:01:53.140 For example, 00:01:53.220 --> 00:01:57.050 you can do DNS queries and port scans to get more information about the servers. 00:01:57.740 --> 00:01:58.350 As you can see, 00:01:58.470 --> 00:02:01.240 there is a lot of user information that you can get from the internet. 00:02:03.040 --> 00:02:06.190 All those queries and searches can be done manually; however, 00:02:06.250 --> 00:02:09.000 it would take a lot of time to manually search for all that information. 00:02:09.440 --> 00:02:11.250 For this reason we have theHarvester. 00:02:11.640 --> 00:02:13.790 And with this tool we can automate all those searches 00:02:13.790 --> 00:02:16.650 that I mentioned in the previous slide, which will save us a lot of time. 00:02:17.840 --> 00:02:20.300 TheHarvester tool was originally published by Christian 00:02:20.300 --> 00:02:22.550 Martorella from the Edge Security Group. 00:02:23.040 --> 00:02:25.490 And this tool is currently maintained by a lot of people, 00:02:25.550 --> 00:02:28.880 including Matthew Brown, Jay Townsend, Lee Baird, 00:02:29.050 --> 00:02:30.000 and Janos Zold. 00:02:30.190 --> 00:02:33.750 And thanks to those guys our life as a red team specialist is way easier. 00:02:34.740 --> 00:02:35.800 By definition, 00:02:35.960 --> 00:02:38.450 theHarvester is a tool for open source intelligence 00:02:38.450 --> 00:02:41.470 gathering and also to help determine a company's external 00:02:41.470 --> 00:02:42.850 threat landscape on the internet. 00:02:43.640 --> 00:02:46.540 This tool gathers emails, names, subdomains, 00:02:46.630 --> 00:02:49.850 IPs, URLs using multiple public data sources. 00:02:50.440 --> 00:02:51.170 And in my opinion, 00:02:51.330 --> 00:02:53.760 theHarvester is one of the most important tools during the 00:02:53.760 --> 00:02:55.750 reconnaissance phase of a red team engagement. 00:02:57.840 --> 00:03:00.820 What I love about theHarvester is that it is an open source tool, 00:03:01.030 --> 00:03:03.430 and this means that we can download the source code from 00:03:03.430 --> 00:03:05.710 GitHub and modify it as much as we want. 00:03:06.200 --> 00:03:06.730 For example, 00:03:06.740 --> 00:03:08.680 you can create your own search modules to find any 00:03:08.680 --> 00:03:10.050 specific information you may want. 00:03:10.840 --> 00:03:12.760 And another thing that I love about this tool is that it 00:03:12.760 --> 00:03:14.410 comes preinstalled with Kali Linux. 00:03:14.750 --> 00:03:17.500 So if you use this Linux distribution you are good to go. 00:03:18.440 --> 00:03:21.050 And I like with theHarvester we can perform a lot of 00:03:21.050 --> 00:03:22.810 non‑intrusive information gathering. 00:03:23.140 --> 00:03:25.500 And this means that we can get tons of information 00:03:25.510 --> 00:03:27.350 without even reaching our target server. 00:03:28.240 --> 00:03:31.550 For example, we can get DNS names, IP addresses, 00:03:31.910 --> 00:03:34.950 email addresses, LinkedIn profiles, and much more. 00:03:36.740 --> 00:03:39.010 So, if you're familiar with the red team kill chain, 00:03:39.020 --> 00:03:42.610 we can map theHarvester tool to the recon phase of this process. 00:03:43.190 --> 00:03:43.650 In here, 00:03:43.660 --> 00:03:46.230 we want to gather as much information as possible so we 00:03:46.230 --> 00:03:48.050 can create a proper exploitation plan. 00:03:49.340 --> 00:03:51.950 Also, if you're familiar with the MITRE PRE‑ATT&CK framework, 00:03:52.180 --> 00:03:54.550 in this course we will cover two main areas. 00:03:55.640 --> 00:03:58.210 The first one is the technical information gathering 00:03:58.450 --> 00:04:00.150 in which you cover four techniques. 00:04:00.770 --> 00:04:05.750 The first one is the T1250, which is determining domain and IP address space. 00:04:06.540 --> 00:04:09.340 And we also cover the T1255, 00:04:09.470 --> 00:04:12.810 which is discovering target logon in the email address format. 00:04:12.810 --> 00:04:15.780 And then we cover the T1251, 00:04:15.790 --> 00:04:21.480 which is obtaining domain and IP registration information and also the T1254, 00:04:21.490 --> 00:04:23.350 which is conducting active scanning. 00:04:24.400 --> 00:04:27.670 The second main theory for the MITRE PRE‑ATT&CK that we'll be covering is 00:04:27.670 --> 00:04:30.320 the people information gathering, in which you'll be covering the 00:04:30.320 --> 00:04:34.050 technique 1273, which is mining social media data. 00:04:34.740 --> 00:04:37.540 And that's a lot of techniques, right? And that's the reason that I believe 00:04:37.540 --> 00:04:41.310 that theHarvester is a really important tool because it allows us to discover a 00:04:41.310 --> 00:04:43.650 lot of valuable information in just a few clicks. 00:04:45.640 --> 00:04:48.700 So, before we go to the technical part of this course let's understand 00:04:48.700 --> 00:04:52.850 what we'll be doing in our demos. We'll be using theHarvester tool to 00:04:52.850 --> 00:04:55.420 gather information from all those data sources that we discussed in the 00:04:55.420 --> 00:04:59.780 beginning of this module. In here we're interested in DNS records, IP 00:04:59.780 --> 00:05:04.320 ranges, open ports, LinkedIn profiles, Twitter handles, and email 00:05:04.320 --> 00:05:06.440 addresses. And that's pretty cool, right? 00:05:06.640 --> 00:05:09.880 It is scary to think that just with one tool someone can get all 00:05:09.880 --> 00:05:14.510 this information about a company. For this demo all we need is a 00:05:14.510 --> 00:05:17.160 machine to run theHarvester. In my case, 00:05:17.170 --> 00:05:19.280 I will be using my favorite Linux distribution, 00:05:19.370 --> 00:05:21.850 which is the Kali Linux. In here. 00:05:21.860 --> 00:05:26.000 I will be using the version 2020.2, but you can use any other version. 00:05:26.240 --> 00:05:29.950 TheHarvester tool already comes preinstalled in any Kali Linux version. 00:05:30.810 --> 00:05:33.750 Also, I do recommend you having your system up to date. 00:05:34.340 --> 00:05:38.460 And for that you can run the commands apt‑get update and apt‑get 00:05:38.470 --> 00:05:41.450 upgrade so then you have the latest Kali Linux version. 00:05:42.340 --> 00:05:45.970 So enough of talking, let's go to our Kali Linux machine and see how 00:05:45.970 --> 00:05:48.580 to gather some information about globomantics.com.