WEBVTT 00:00:00.040 --> 00:00:01.730 Now sometimes we'll run a module, 00:00:01.990 --> 00:00:05.120 and the output of that module won't necessarily add new 00:00:05.120 --> 00:00:06.860 pieces of information to a particular table, 00:00:06.870 --> 00:00:09.070 even though it has the capability to do so. 00:00:09.290 --> 00:00:12.160 An example of that would be this whois_miner module here, 00:00:12.170 --> 00:00:12.850 who, 00:00:12.970 --> 00:00:18.880 just by virtue of harvesting email addresses, actually has access to domains, 00:00:19.190 --> 00:00:22.430 but because it doesn't know whether or not the email addresses coming back are 00:00:22.440 --> 00:00:26.510 actually going to be associated with our target company, the developers chosen 00:00:26.510 --> 00:00:31.320 do not add that particular piece of data to the database. But we know that 00:00:31.320 --> 00:00:35.470 pluralsight.com is associated to the company that we're targeting, so we can 00:00:35.470 --> 00:00:41.010 now go in and use those manual entry commands to add that data as new see data 00:00:41.170 --> 00:00:43.580 to our database, and that's what we'll do now. 00:00:44.610 --> 00:00:47.180 We'll use the same db insert command that we did before, 00:00:49.000 --> 00:00:50.650 except this time we're going to add it to the Domains 00:00:50.650 --> 00:00:53.090 table. It asks us for the domain. 00:00:56.240 --> 00:00:57.580 We don't have any notes to provide it, 00:00:58.380 --> 00:01:02.700 and we're good to go. If we do show domains, we now see that we have the 00:01:02.700 --> 00:01:06.060 pluralsight.com domain added to the Domains table. 00:01:08.130 --> 00:01:09.880 So now we've got some data to work with. 00:01:10.170 --> 00:01:14.450 Let's go look at some more modules specifically for things that will be of 00:01:14.460 --> 00:01:17.720 interest for us regarding the context that we've harvested. 00:01:23.410 --> 00:01:27.940 Notice I'm using the contacts‑search in order to list only the 00:01:27.940 --> 00:01:31.150 modules that transform contacts into something else. 00:01:31.940 --> 00:01:33.590 There's some very interesting things here. 00:01:33.760 --> 00:01:36.630 We can validate email addresses using something like mailtester. 00:01:37.180 --> 00:01:39.810 We can create new email addresses based on names using 00:01:39.870 --> 00:01:42.620 something like mangle. Or we can get names based on email 00:01:42.620 --> 00:01:44.450 addresses using something like unmangle. 00:01:45.070 --> 00:01:47.810 But something that really sticks out to me is this ability 00:01:47.810 --> 00:01:52.070 to transform contacts into credentials. So I want to focus 00:01:52.070 --> 00:01:53.400 on the scylla module here. 00:01:55.210 --> 00:01:58.370 Let's go ahead and ask the marketplace to install scylla. 00:01:58.830 --> 00:02:08.830 So we'll do marketplace install scylla. Notice that two 00:02:08.830 --> 00:02:11.760 modules were installed. This is that smart‑installation, 00:02:11.760 --> 00:02:14.410 smart‑loading feature at work here. 00:02:14.680 --> 00:02:17.430 It noticed that there were two modules that had that text 00:02:17.430 --> 00:02:19.450 match and installed them both for us. 00:02:19.630 --> 00:02:24.380 So now we can use a module named scylla on both our contacts and our 00:02:24.380 --> 00:02:28.680 domains to try to transform them into credentials. So now let's go ahead 00:02:28.680 --> 00:02:39.170 and load this scylla module for our contacts information. Notice I tried 00:02:39.170 --> 00:02:40.290 to do this smart‑loading again, 00:02:40.290 --> 00:02:43.450 and it found that I have two modules installed that 00:02:43.450 --> 00:02:45.530 have scylla in the title, and it said, Hey, 00:02:45.540 --> 00:02:46.370 you can't do that. 00:02:46.380 --> 00:02:47.280 Pick one of the other. 00:02:47.440 --> 00:02:50.390 So in this particular case, I'm going to have to be a little bit more specific. 00:02:50.940 --> 00:02:54.210 We've got Tab completion here, so that will work for us. 00:02:54.460 --> 00:02:55.750 So we'll do modules load. 00:02:56.740 --> 00:02:57.800 We'll start with recon, 00:02:58.160 --> 00:03:01.780 start with contacts, and then very quickly, we get to a unique 00:03:01.790 --> 00:03:04.340 module path, and it fills it out for us. 00:03:04.560 --> 00:03:05.790 So let's go ahead and load this module. 00:03:07.840 --> 00:03:09.950 Now let's look at what this module does as a whole. 00:03:11.630 --> 00:03:16.380 What does this thing do here? It harvests credentials from scylla.sh API using 00:03:16.380 --> 00:03:19.570 email addresses input. This looks like valuable information. 00:03:19.920 --> 00:03:24.580 If I've pulled contacts from whois database, and I'm able to turn around 00:03:24.590 --> 00:03:28.120 and find publicly disclosed credentials associated with that, then 00:03:28.120 --> 00:03:30.440 there's a really good chance that I could use those two pieces of 00:03:30.440 --> 00:03:35.110 information to gain access to some sort of system on the target network. 00:03:35.110 --> 00:03:38.250 Some other options here by default, 00:03:38.250 --> 00:03:40.740 this is going to pull back 100 results per page. 00:03:41.240 --> 00:03:44.680 And, of course, the default source again is going to be the database, 00:03:44.680 --> 00:03:46.130 which is exactly what we would expect. 00:03:46.130 --> 00:03:48.960 So, once again, we don't have to make any configuration here. 00:03:49.140 --> 00:03:57.920 We can just run the module as is. Well, unfortunately, 00:03:58.220 --> 00:04:00.360 none of the credentials that we currently have have any 00:04:00.360 --> 00:04:02.140 disclosed credentials associated with them. 00:04:02.340 --> 00:04:05.510 This is good news for Pluralsight, but we're not done yet. 00:04:05.930 --> 00:04:08.600 We still have the other scylla module, which will actually take 00:04:08.600 --> 00:04:11.390 the domain and try to harvest any credentials that are associated 00:04:11.390 --> 00:04:13.260 with any email address within it. 00:04:13.410 --> 00:04:15.370 So let's go ahead and load that one. 00:04:15.740 --> 00:04:17.390 So modules load. 00:04:23.840 --> 00:04:26.470 We'll see here that it's very similar in its configuration, 00:04:26.470 --> 00:04:28.000 so there's not much for us to do here. 00:04:30.020 --> 00:04:35.170 Now we're on the module. And as you can see here, 00:04:35.310 --> 00:04:39.520 it found 38 total, 33 new contacts that we hadn't already 00:04:39.520 --> 00:04:41.160 found and associated with Pluralsight, 00:04:41.840 --> 00:04:46.770 and it found 38 total, 38 new credentials associated with 00:04:46.770 --> 00:04:50.340 the contacts that we have harvested for Pluralsight. This 00:04:50.340 --> 00:04:51.630 is really good information. 00:04:51.690 --> 00:04:53.530 We obviously want to see this stuff. 00:04:53.540 --> 00:04:56.770 So now let's look at analyzing this data and then potentially 00:04:56.780 --> 00:04:59.230 exporting this data for use with other tools.