WEBVTT

00:00:01.590 --> 00:00:04.560
Now that we know how to use the harvester to collect technical information,

00:00:04.560 --> 00:00:07.680
let me show you how to use this tool to find information

00:00:07.750 --> 00:00:09.610
about the people that work in this company.

00:00:10.640 --> 00:00:13.170
As you may have noted, when you're running the technical searches,

00:00:13.460 --> 00:00:16.810
the harvester already found some email addresses for us.

00:00:16.810 --> 00:00:18.850
So let's run the same search again.

00:00:19.240 --> 00:00:22.150
I'll use the harvester with the globomantics.com domain,

00:00:22.640 --> 00:00:26.600
I'll limit to 500 search results, and the same data serves up as before,

00:00:26.610 --> 00:00:30.000
which is Google, Yahoo, Bing, and DuckDuckGo.

00:00:33.500 --> 00:00:33.820
Oh, no.

00:00:33.820 --> 00:00:34.310
Take a look.

00:00:34.510 --> 00:00:38.140
Because I've been doing too many searches, my IP got blocked by Google.

00:00:38.140 --> 00:00:40.760
And this is something very normal when using their harvester,

00:00:40.760 --> 00:00:43.200
so that's why I recommended using a VPN.

00:00:44.180 --> 00:00:46.750
In here, I'm already tunneling my trafficked through Thailand.

00:00:47.140 --> 00:00:47.640
Take a look.

00:00:47.680 --> 00:00:51.350
If I check what my IP address is, it shows me that I'm located in Bangkok.

00:00:51.940 --> 00:00:55.870
So let me pause this here and quickly change my VPN location.

00:00:55.870 --> 00:00:57.100
Done.

00:00:57.180 --> 00:00:58.420
If I refresh this page,

00:00:58.540 --> 00:01:02.560
you can see that now my IP address is in the city of Riga in Latvia,

00:01:02.920 --> 00:01:05.250
and hopefully Google has not blocked this IP yet.

00:01:05.920 --> 00:01:09.190
So let me go back to the terminal, and then here,

00:01:09.270 --> 00:01:10.650
let's run the exact same command.

00:01:12.940 --> 00:01:13.240
Awesome.

00:01:13.250 --> 00:01:13.760
Take a look.

00:01:13.850 --> 00:01:14.540
Now it works.

00:01:14.670 --> 00:01:18.150
With the new IP address from Latvia, I can now use the harvester again,

00:01:18.600 --> 00:01:21.420
and that's why I recommend only searching for what you need.

00:01:21.760 --> 00:01:24.150
Don't do massive searches otherwise your IP get blocked.

00:01:25.100 --> 00:01:28.450
And as you can see, the harvester found some email addresses in here,

00:01:28.890 --> 00:01:30.650
like alice@globomantics.com.

00:01:30.650 --> 00:01:35.390
And those email addresses can be interesting for social engineering attacks,

00:01:35.390 --> 00:01:37.810
so it is important taking note of them.

00:01:37.810 --> 00:01:41.560
Another thing you can do is search for LinkedIn profiles,

00:01:41.750 --> 00:01:43.750
but as Globomantics is a fake company,

00:01:43.820 --> 00:01:47.450
I will search for people that works at Pluralsight using the harvester tool.

00:01:48.380 --> 00:01:53.150
For that, I used this comment, python3, theHarvester.py,

00:01:53.610 --> 00:01:55.250
and then the Pluralsight domain.

00:01:56.240 --> 00:01:58.650
And after that, I'll use the flag ‑b,

00:01:59.210 --> 00:02:01.450
and it specified the linkedin as data source.

00:02:02.840 --> 00:02:04.410
When I this, theHarvester,

00:02:04.410 --> 00:02:07.310
we only search on LinkedIn for people that worked at Pluralsight.

00:02:07.860 --> 00:02:10.750
And again, this may take a little while, so let's speed up the video.

00:02:12.640 --> 00:02:13.040
Done.

00:02:13.050 --> 00:02:15.970
As we can see, we found tons of people that are working the company.

00:02:16.640 --> 00:02:17.270
Pretty cool, right?

00:02:17.270 --> 00:02:18.040
Again,

00:02:18.100 --> 00:02:20.530
it is not illegal to strike this information since it's

00:02:20.530 --> 00:02:21.950
publicly available on the LinkedIn.

00:02:22.440 --> 00:02:25.550
The only difference is that we are automating the search using the harvester.

00:02:26.730 --> 00:02:30.250
And I could even run the same command, but changing linkedin to twitter.

00:02:32.190 --> 00:02:35.550
But as we can see, we couldn't find any Twitter accounts related to this domain.

00:02:36.300 --> 00:02:37.520
Anyways, that's pretty cool, right?

00:02:37.640 --> 00:02:40.430
We're able to find email addresses and LinkedIn profiles,

00:02:40.470 --> 00:02:43.550
which could help us a lot to perform a social engineering attack.

00:02:44.240 --> 00:02:46.650
And trust me, this is really useful when you're ______ engagement.

00:02:47.990 --> 00:02:50.340
And the last thing I want to show you is the amount of

00:02:50.340 --> 00:02:52.150
information we can get with the harvester.

00:02:52.840 --> 00:02:54.790
If you run the harvester against the domain,

00:02:54.790 --> 00:02:57.600
but not with the flag ‑b and the word all,

00:02:57.600 --> 00:03:00.310
the harvester was searching all the data sources

00:03:00.320 --> 00:03:02.170
for information about the domain.

00:03:02.170 --> 00:03:06.510
And here, I'm using the nasa.org again since this is not an invasive search,

00:03:06.510 --> 00:03:09.150
and we are only searching for publicly available information.

00:03:10.340 --> 00:03:13.300
When we run this, it will take it up to half a hour to complete.

00:03:13.940 --> 00:03:16.410
And although this kind of search brings a lot of information,

00:03:16.580 --> 00:03:19.600
I personally don't like to run the full searches like this for two reasons.

00:03:20.140 --> 00:03:24.650
First, as you can see here, our IP address gets quickly banned by Google.

00:03:25.140 --> 00:03:27.110
And now, because we're in the middle of a search,

00:03:27.120 --> 00:03:28.820
we cannot change our VPN servers,

00:03:28.820 --> 00:03:32.350
so our results may not be that complete as we were doing single searches.

00:03:33.500 --> 00:03:33.860
Also,

00:03:34.040 --> 00:03:36.750
the second reason that I personally don't like to run this kind of full

00:03:36.750 --> 00:03:39.450
search is that we see a lot of for useless information.

00:03:39.990 --> 00:03:43.130
So, personally, I like to search for useful information first.

00:03:43.470 --> 00:03:45.730
And then if we don't find anything interesting for me,

00:03:45.850 --> 00:03:47.790
then I go for broader searches, like this one.

00:03:48.710 --> 00:03:50.640
So, as usual, let me speed up this video,

00:03:50.930 --> 00:03:54.450
and keep in mind that this search took about 23 minutes to complete.

00:03:55.740 --> 00:03:56.090
Done.

00:03:56.170 --> 00:03:58.350
As you can see, we have a lot of information.

00:03:58.840 --> 00:04:02.500
But again, most of that information is useless and may slow down your process.

00:04:03.040 --> 00:04:03.590
So again,

00:04:03.600 --> 00:04:07.280
my recommendation is to first do specific searches like we've done our demos.

00:04:07.570 --> 00:04:09.450
And then if we don't find anything interesting,

00:04:09.520 --> 00:04:11.150
you can do a broad search like this one.