WEBVTT 00:00:00.240 --> 00:00:00.990 Hi, folks. 00:00:01.170 --> 00:00:01.810 I'm Tim Tomes, 00:00:01.810 --> 00:00:04.840 and thank you for joining me on Pluralsight to learn more about the technical 00:00:04.840 --> 00:00:08.160 information‑gathering tool for red teams called Recon‑ng. 00:00:08.160 --> 00:00:13.330 Recon‑ng is created and maintained by yours truly, 00:00:13.330 --> 00:00:18.280 Tim Tomes, also known Ianmaster53 and, as stated on the tool's website, 00:00:18.490 --> 00:00:21.750 is a feature‑rich reconnaissance framework designed with the goal of 00:00:21.750 --> 00:00:25.050 providing a powerful environment to quickly and thoroughly conduct 00:00:25.060 --> 00:00:27.190 open source web‑based reconnaissance. 00:00:27.190 --> 00:00:31.200 Now I would be remiss if I didn't draw attention to the design of the logo. 00:00:32.140 --> 00:00:35.330 Recon‑ng is a framework made up of many pieces, 00:00:35.430 --> 00:00:37.550 and those many pieces are called modules, 00:00:37.740 --> 00:00:39.840 and each of these blocks here in the logo represents 00:00:39.840 --> 00:00:42.550 the modular nature of Recon‑ng. 00:00:42.720 --> 00:00:45.440 Those modules are designed by the community. 00:00:45.510 --> 00:00:48.090 And so while Tim Tomes is the creator and 00:00:48.090 --> 00:00:50.250 maintainer of the framework core itself, 00:00:50.500 --> 00:00:54.020 the tool's true life blood and functionality is through 00:00:54.020 --> 00:00:57.870 the modules that employ that framework, and those are created by the community. 00:00:58.210 --> 00:01:01.200 So I'd like to take this opportunity to thank each and everyone 00:01:01.330 --> 00:01:05.860 that has or will be contributing to the project as it just simply 00:01:05.860 --> 00:01:07.800 would not be what it is without them. 00:01:07.900 --> 00:01:08.450 Thank you. 00:01:10.340 --> 00:01:12.840 So to elaborate further on what Recon‑ng is. 00:01:13.110 --> 00:01:15.660 Recon‑ng is an open source framework, 00:01:15.930 --> 00:01:19.720 which means that the source code is open and available to use in 00:01:19.720 --> 00:01:22.280 both personal and commercial environments, 00:01:22.740 --> 00:01:25.760 and it provides a powerful environment to automate 00:01:25.770 --> 00:01:27.630 open source web‑based reconnaissance. 00:01:27.640 --> 00:01:30.750 I want to draw your attention here to the term automate 00:01:31.240 --> 00:01:33.980 because reconnaissance historically has been seen as that 00:01:33.980 --> 00:01:37.170 step in the methodology that, when we we're restricted for time, 00:01:37.390 --> 00:01:40.240 has the least perceived value and often gets dropped. 00:01:40.470 --> 00:01:45.190 And so the goal, the design goal behind Recon‑ng was to automate so much of that, 00:01:45.290 --> 00:01:48.360 so that rather than just skipping over that step of the methodology, 00:01:48.380 --> 00:01:51.020 we can do it faster, and we can do it better, 00:01:51.020 --> 00:01:55.260 and we can collect that information that we may possibly need quicker, 00:01:55.260 --> 00:01:58.050 and therefore we aren't tempted to skip that particular step. 00:01:58.050 --> 00:02:01.610 And so that's kind of the design goal behind Recon‑ng. 00:02:02.120 --> 00:02:04.660 Now you can find the tool at recon‑ng.com, 00:02:04.820 --> 00:02:07.260 and there you can either download it as a package, 00:02:07.270 --> 00:02:10.180 or you can clone the repository and use it that way. 00:02:10.350 --> 00:02:14.150 There's also a wiki that goes through how to install and configure, 00:02:14.160 --> 00:02:16.820 use, and also develop modules for Recon‑ng. 00:02:17.300 --> 00:02:19.320 So if you're interested in that stuff, it's a really, 00:02:19.320 --> 00:02:23.250 really good resource to go and learn how to use the tool and then if 00:02:23.250 --> 00:02:26.730 you want to develop how to build modules that didn't take advantage 00:02:26.730 --> 00:02:28.750 of third party resources of information. 00:02:29.240 --> 00:02:31.470 It is cross platform for the most part. 00:02:31.470 --> 00:02:32.880 It runs on Python 3. 00:02:33.030 --> 00:02:37.230 And so if you can install Python 3, then you'll be able to run Recon‑ng. 00:02:37.230 --> 00:02:39.540 The one exception is probably Windows. 00:02:39.760 --> 00:02:43.340 There are some underlying file system interactions between Python and 00:02:43.340 --> 00:02:46.880 the operating system that don't always work so well when you try to do 00:02:46.880 --> 00:02:48.990 them both in Linux and Windows environments. 00:02:49.240 --> 00:02:54.190 And so while Windows doesn't have 100% support, macOS and Linux does. 00:02:54.190 --> 00:02:57.610 And it just tries to be that one‑stop shop that removes the need to 00:02:57.610 --> 00:03:00.300 maintain a collection of information‑gathering scripts because there 00:03:00.300 --> 00:03:04.930 are a ton of scripts that you can pull down and use to do some of the 00:03:04.930 --> 00:03:06.810 same things that Recon‑ng does. 00:03:06.810 --> 00:03:09.120 But the problem is you have all of these tools maintained 00:03:09.120 --> 00:03:11.320 by a large group of different people. 00:03:11.320 --> 00:03:13.120 They're at various stages of functionality. 00:03:13.120 --> 00:03:15.410 You end up spending a lot of time figuring out how to 00:03:15.410 --> 00:03:16.980 get that information into one place, 00:03:16.980 --> 00:03:19.310 how to get the scripts working if they're broken, 00:03:19.360 --> 00:03:20.610 so on and so forth. 00:03:20.610 --> 00:03:23.120 So what Recon‑ng tries to do is say hey, 00:03:23.120 --> 00:03:25.650 this is one place you can come to do it all. 00:03:25.650 --> 00:03:28.660 The information is collected together, gathered together, 00:03:28.660 --> 00:03:30.920 stored together, and you can analyze it, 00:03:30.930 --> 00:03:34.390 export it, do whatever you need to do with it in one place. 00:03:34.630 --> 00:03:38.150 And so that was another one of the major design goals behind Recon‑ng. 00:03:40.070 --> 00:03:42.390 So where does Recon‑ng fall in the cyber kill chain? 00:03:42.390 --> 00:03:44.080 Well, obviously it's a reconnaissance tool, 00:03:44.080 --> 00:03:47.840 so it's going to fall right here at the reconnaissance step of the kill chain. 00:03:47.840 --> 00:03:51.050 Now the interesting thing about reconnaissance is it's the first thing that we 00:03:51.050 --> 00:03:55.470 do. It's the first pieces of information that we collect. And what we do with 00:03:55.470 --> 00:03:59.700 that information is it allows us to begin making assumptions about all these 00:03:59.700 --> 00:04:04.180 later steps of the kill chain. And so reconnaissance actually sticks with us 00:04:04.180 --> 00:04:05.420 the whole way. 00:04:05.680 --> 00:04:08.040 The information that we gain with reconnaissance will then 00:04:08.040 --> 00:04:10.410 move into these later steps and begin to validate that 00:04:10.410 --> 00:04:12.270 information, validate it as being true, 00:04:12.650 --> 00:04:15.930 validate it as being false, and we'll begin to build on that. 00:04:15.930 --> 00:04:19.880 And at every step, we have a clearer picture of our target environment, 00:04:19.940 --> 00:04:23.030 and it all starts with the information that we collect during the 00:04:23.030 --> 00:04:27.720 reconnaissance phase. So the MITRE ATT&CK coverage for any 00:04:27.720 --> 00:04:29.940 information‑gathering tool is going to be pretty broad. 00:04:30.300 --> 00:04:34.470 And as Recon‑ng can support many of these tactics that you see listed here, 00:04:34.620 --> 00:04:37.800 it really shines in its ability to quickly and effectively gather 00:04:37.800 --> 00:04:41.950 information about technical assets and people. 00:04:42.740 --> 00:04:45.250 Recon‑ng excels at harvesting host information, 00:04:45.250 --> 00:04:48.750 and it does this for both things like scope validation and target selection. 00:04:49.270 --> 00:04:51.810 And it can use those assets than to determine various 00:04:51.810 --> 00:04:54.250 technologies that might be employed by the target. 00:04:55.780 --> 00:05:00.090 It also does a really good job of identifying personnel and specifically 00:05:00.090 --> 00:05:03.400 the personnel that have authority and privilege because those were going 00:05:03.400 --> 00:05:10.260 to be important high‑value targets for our particular engagement. Before 00:05:10.260 --> 00:05:13.510 we jump headfirst into reconnaissance, there are two forms of recon that I 00:05:13.510 --> 00:05:17.280 want to discuss as they affect when red teams can employ certain tools and 00:05:17.280 --> 00:05:22.010 techniques, and those two forms are passive versus active reconnaissance. 00:05:23.410 --> 00:05:26.690 So what is passive reconnaissance? Well passive reconnaissance is when some 00:05:26.690 --> 00:05:31.890 third party resource makes direct contact with the target or its assets or 00:05:31.890 --> 00:05:34.280 its people to collect information about it. 00:05:34.560 --> 00:05:37.760 They then store that information and make it available to third parties. 00:05:37.760 --> 00:05:41.160 And we, as the third party, will query the resource for that 00:05:41.160 --> 00:05:45.700 information and learn about our target through that resource. 00:05:46.020 --> 00:05:49.290 This is passive because we're not making any direct contact 00:05:49.300 --> 00:05:51.550 with the target or the target environment. 00:05:51.940 --> 00:05:56.230 An example of this would be pulling information from a domain registrar. 00:05:56.430 --> 00:05:59.540 So when the target registers a domain with a registrar, it has to 00:05:59.540 --> 00:06:02.860 provide contact information for different types of contacts that 00:06:02.860 --> 00:06:04.680 go along with that particular domain. 00:06:05.070 --> 00:06:09.180 Well what we can do is is as a third party, we can query those registrars or 00:06:09.180 --> 00:06:13.380 we can query other resources that have the information from those registrars 00:06:13.630 --> 00:06:16.270 to gain access to information like full names, 00:06:16.280 --> 00:06:19.350 email addresses, roles, etc. 00:06:20.140 --> 00:06:23.250 And that's passive because we're not making any direct contact with the 00:06:23.250 --> 00:06:28.030 target. On the other hand, active reconnaissance would be something where 00:06:28.030 --> 00:06:30.460 we do make direct contact with the target. 00:06:30.710 --> 00:06:32.490 Now that contact is not malicious. 00:06:32.490 --> 00:06:36.090 That contact will probably something along the lines of normal internet 00:06:36.090 --> 00:06:40.380 behavior, but it is contact that is attributable to us. 00:06:40.520 --> 00:06:44.950 So an example of this would be if we were trying to harvest hosts through the 00:06:44.950 --> 00:06:49.150 DNS protocol. If that authoritative DNS server sitting on the target's 00:06:49.150 --> 00:06:53.500 environment, every time we make a request for a host that's not cached in a 00:06:53.500 --> 00:06:57.460 DNS server that somewhere along the pathway, then our request is going to go 00:06:57.470 --> 00:07:00.930 all the way to that authoritative DNS server, hit the target environment 00:07:00.930 --> 00:07:02.260 before we get an answer back. 00:07:02.500 --> 00:07:06.950 Now that may not be seen as malicious, but the reality is we are making contact. 00:07:07.110 --> 00:07:10.400 At that point in time, it is attributable. And so that 00:07:10.400 --> 00:07:12.940 would be considered active reconnaissance. 00:07:13.160 --> 00:07:16.150 Now the reason why it's important to make this distinction is 00:07:16.150 --> 00:07:18.780 because passive reconnaissance can occur at any time. 00:07:19.270 --> 00:07:21.360 We can do this during scoping. 00:07:21.360 --> 00:07:22.720 We can do this during planning. 00:07:22.720 --> 00:07:25.200 We can do this just in general. 00:07:25.200 --> 00:07:26.750 We can do it at any point in time. 00:07:27.020 --> 00:07:29.970 But active reconnaissance should be reserved for when we actually 00:07:29.970 --> 00:07:34.160 have authority to conduct activities against that particular 00:07:34.160 --> 00:07:37.810 target simply because even though we don't intend for our traffic 00:07:37.810 --> 00:07:41.220 to be malicious in nature, it can be perceived as such. 00:07:41.300 --> 00:07:44.610 And so we definitely want to take this active versus passive 00:07:44.610 --> 00:07:46.850 reconnaissance thing into consideration. 00:07:47.670 --> 00:07:52.150 So with all that being said, let's dive in and begin exploring Recon‑ng.