WEBVTT 00:00:01.440 --> 00:00:03.530 Let's start our information gathering by doing some 00:00:03.530 --> 00:00:05.850 passive searches for DNS records. 00:00:06.440 --> 00:00:09.520 My idea here is that I want to find out the subdomains of 00:00:09.530 --> 00:00:12.450 Globomantics so later I can try to exploit them. 00:00:13.540 --> 00:00:21.250 So, I'll start by typing python3, then theHarvester.py and then a few options. 00:00:21.690 --> 00:00:26.150 First, I'll use the ‑d flag to specify which domain I want to search, 00:00:26.610 --> 00:00:28.810 which in my case is globomantics.com. 00:00:30.140 --> 00:00:35.550 Then I'll use the flag ‑l to limit the amount of searches up to 500 results. 00:00:36.710 --> 00:00:40.300 And then I'll use the flag ‑b to tell theHarvester 00:00:40.310 --> 00:00:42.450 which sources of data I want to search. 00:00:43.140 --> 00:00:48.250 In my case, I want to search on Google, Bing, Yahoo, and DuckDuckGo. 00:00:49.740 --> 00:00:50.230 Awesome. 00:00:50.380 --> 00:00:51.550 Now let's run this. 00:00:52.410 --> 00:00:54.590 And just a heads up, this may take a few minutes, 00:00:54.630 --> 00:00:56.850 but to save you some time I'll speed up this video. 00:01:00.040 --> 00:01:00.440 Awesome. 00:01:00.440 --> 00:01:01.030 Here we go. 00:01:01.200 --> 00:01:02.630 It found 18 hosts. 00:01:02.760 --> 00:01:03.430 And take a look, 00:01:03.440 --> 00:01:05.500 there's some interesting domains in there such as 00:01:05.510 --> 00:01:10.310 intranet.globomantics.com and also pull.globomantics.com. 00:01:11.000 --> 00:01:13.160 Those could be really interesting since they're not the 00:01:13.160 --> 00:01:15.450 main website and may be easier to exploit. 00:01:16.640 --> 00:01:19.390 Just so you have an idea of how powerful this tool is 00:01:19.550 --> 00:01:21.130 I will run the exact same search, 00:01:21.180 --> 00:01:24.760 but instead of globomantics.com I will put nasa.gov. 00:01:24.760 --> 00:01:29.730 And again, as we are not directly reaching any NASA servers this is not illegal. 00:01:29.730 --> 00:01:30.810 So we are fine. 00:01:31.840 --> 00:01:33.190 Alright, let's search for this. 00:01:33.640 --> 00:01:36.650 And again, this may take a while so I will speed up this video. 00:01:40.610 --> 00:01:40.940 Awesome. 00:01:40.940 --> 00:01:41.410 Take a look. 00:01:41.520 --> 00:01:42.750 There's so many domains. 00:01:43.240 --> 00:01:45.150 They're hundreds of hosts available on the internet. 00:01:45.610 --> 00:01:48.690 And if you take a look we can find some interesting stuff. Like 00:01:48.690 --> 00:01:51.850 take a look at this one employeeorientation.nasa. 00:01:52.440 --> 00:01:54.840 That's really interesting because we never imagined that 00:01:54.840 --> 00:01:56.200 this would be available on the internet. 00:01:57.140 --> 00:01:58.180 But just as a heads up, 00:01:58.290 --> 00:02:01.300 if you do too many searchers with theHarvester your IP address 00:02:01.300 --> 00:02:04.280 may be blocked by Google. And this means that you would not be 00:02:04.280 --> 00:02:05.550 able to search anything else. 00:02:06.340 --> 00:02:10.720 So, if you plan to do several searches a good idea is having a VPN service. 00:02:10.979 --> 00:02:14.350 In this way you can easily change your IP address whenever you get blocked. 00:02:15.510 --> 00:02:18.750 But okay, enough of NASA. Let's go back to globomantics.com. 00:02:19.440 --> 00:02:22.850 So far, I've shown you only passive reconnaissance searches. 00:02:23.340 --> 00:02:26.560 This means that so far we haven't sent a single packet to our 00:02:26.560 --> 00:02:28.850 target servers. So we're still stealthy. 00:02:29.440 --> 00:02:32.520 But if you don't mind about being a little bit noisy we can do some brute 00:02:32.520 --> 00:02:35.250 force attacks against the globomantics.com domains. 00:02:35.990 --> 00:02:40.770 For that I'll use the same theHarvester command with the domain flag and now 00:02:40.780 --> 00:02:46.710 only with a ‑c flag. And this ‑c flag tells theHarvester to try to brute force 00:02:46.710 --> 00:02:51.610 DNS names. And this means that the tool will literally try to ping hundreds of 00:02:51.610 --> 00:02:53.950 common DNS names to see what shows up. 00:02:54.690 --> 00:02:59.650 For example, you'll try things like mail.globomantics.com or 00:02:59.660 --> 00:03:04.120 ftp.globomantics.com and so on. And again, 00:03:04.200 --> 00:03:07.330 it's not that stealthy since we are directly pinging some of the servers, 00:03:07.460 --> 00:03:09.050 but it's still a valid search. 00:03:09.930 --> 00:03:12.000 So, let's run this command and wait. 00:03:13.000 --> 00:03:13.420 Then, 00:03:13.430 --> 00:03:16.700 as you can see, using only this technique we found only the 00:03:16.700 --> 00:03:21.860 www.globomantics.com, and this shows that this technique is interesting to 00:03:21.860 --> 00:03:24.750 complement our previous searches but doesn't replace them. 00:03:26.000 --> 00:03:29.120 Another interesting search to do with theHarvester is the DNS 00:03:29.120 --> 00:03:32.790 lookup search. For that I'll run the same command I was running 00:03:32.790 --> 00:03:36.350 before, theHarvester, and then the domain, 00:03:36.820 --> 00:03:40.420 then the limit of 500 searches, then the data sources I 00:03:40.420 --> 00:03:44.190 want to search, and then the option ‑n, 00:03:44.440 --> 00:03:49.170 which tells theHarvester to perform a DNS lookup. And once we have 00:03:49.170 --> 00:03:52.200 run this it will take a little while, but basically theHarvester 00:03:52.210 --> 00:03:56.390 will try to do a DNS lookup in all IPs that are in the same network 00:03:56.580 --> 00:03:57.750 than the host that we found. 00:03:58.740 --> 00:04:03.490 So, let me speed up this video so you don't have to wait. Then, 00:04:03.600 --> 00:04:05.550 as you can see, we found a lot of servers. 00:04:05.940 --> 00:04:10.750 And from what I can see, the globomantics.com website is hosted on Amazon AWS, 00:04:11.190 --> 00:04:13.830 meaning that all those other servers you see here are from 00:04:13.840 --> 00:04:18.050 other companies and they are in the same AWS network. And this 00:04:18.050 --> 00:04:19.339 is something to be really careful. 00:04:19.450 --> 00:04:21.640 You don't want to attack a server that is not a part 00:04:21.640 --> 00:04:22.950 of the company that hired you. 00:04:23.540 --> 00:04:26.530 If you attack another server by mistake you'll be committing a crime. 00:04:26.890 --> 00:04:29.650 So, double‑check the servers before doing any attack. 00:04:30.640 --> 00:04:33.650 Once we have gathered a good amount of domains and IPs then 00:04:33.650 --> 00:04:35.350 you can proceed for your reconnaissance. 00:04:35.940 --> 00:04:36.560 For example, 00:04:36.570 --> 00:04:39.590 you can use Nmap to find open ports in the target servers 00:04:39.590 --> 00:04:41.680 that you found. And that's pretty cool, 00:04:41.680 --> 00:04:44.620 right? In less than 10 minutes we are able to find tons 00:04:44.620 --> 00:04:46.450 of information about globomantics.com.