WEBVTT 00:00:00.040 --> 00:00:02.140 Now there are a couple different ways that we can analyze and 00:00:02.140 --> 00:00:05.030 look at data within Recon‑ng, one of them is using the show 00:00:05.030 --> 00:00:06.380 command that we've already seen. 00:00:06.610 --> 00:00:09.940 So if we know we've got credentials and we know we've got context, 00:00:09.940 --> 00:00:11.090 we could just use the show command. 00:00:11.350 --> 00:00:16.050 So if we look a show credentials and we see a listing of credentials in here. 00:00:18.440 --> 00:00:21.380 Now, once again, this is an ASCII table so it's kind of ugly, 00:00:21.490 --> 00:00:24.350 but we can still see some of the good stuff that was found here. 00:00:25.940 --> 00:00:27.040 Notice towards the top, 00:00:27.040 --> 00:00:30.800 we absolutely have a clear text password that was disclosed as a part of 00:00:30.800 --> 00:00:34.420 the exploit.in dump for a user on pluralsight.com. 00:00:34.940 --> 00:00:37.480 This is obviously someone that needs to be told they 00:00:37.480 --> 00:00:38.730 need to change their password, 00:00:39.080 --> 00:00:42.470 but I'm hoping that this is an old password and isn't relevant anymore, 00:00:42.470 --> 00:00:44.960 but this is the type of information that we're looking for. 00:00:45.470 --> 00:00:48.140 You'll notice here that we don't always have clear text, 00:00:48.150 --> 00:00:49.830 sometimes we just have the hash. 00:00:50.110 --> 00:00:52.660 Now, in this particular case that I have highlighted on the screen, 00:00:52.790 --> 00:00:53.940 that's a bcrypt hash. 00:00:54.320 --> 00:00:55.860 We're probably not going to be cracking that one 00:00:55.860 --> 00:00:59.310 anytime soon, but this is a SHA1 hash, 00:00:59.450 --> 00:01:03.980 and this is an MD5 hash and there is a really good chance that will 00:01:03.980 --> 00:01:07.420 be able to reverse those hashes either using our own tracking rig or 00:01:07.420 --> 00:01:11.860 by using other Recon‑ng modules that seek to do that using the power 00:01:11.860 --> 00:01:13.240 of third‑party resources. 00:01:16.610 --> 00:01:17.480 But this is ugly. 00:01:17.650 --> 00:01:19.090 Let's look at some other ways to do it. 00:01:19.220 --> 00:01:22.240 We could also provide this data using a db query command, 00:01:22.290 --> 00:01:30.370 but once again, we're still just going to get the raw data sitting inside 00:01:30.370 --> 00:01:32.450 of an ASCII table that's not real friendly to view. 00:01:34.310 --> 00:01:37.970 So very similar output using the db query command. There 00:01:37.970 --> 00:01:42.440 must be something better and there is. Recon‑ng comes with 00:01:42.440 --> 00:01:44.600 another tool called Recon‑web. 00:01:44.780 --> 00:01:46.210 In order to access it, though, 00:01:46.260 --> 00:01:50.290 we must invoke Recon‑ng a different way using a different command. 00:01:50.410 --> 00:01:56.990 So I'm going to go ahead and exit out of Recon‑ng and clear up the terminal. 00:01:58.940 --> 00:02:00.930 This separate command, once again, has its own Docker 00:02:00.930 --> 00:02:03.000 command that I have created an alias for, 00:02:03.060 --> 00:02:08.780 so you'll probably want to do that too and it's simply recon‑web. 00:02:09.840 --> 00:02:10.949 So if we do Recon‑web, 00:02:10.949 --> 00:02:13.370 we'll look at the help that comes along with that particular command. 00:02:13.370 --> 00:02:16.200 You'll see that you can invoke it a couple different ways or there is a 00:02:16.200 --> 00:02:18.980 couple different arguments that you can provide, one being the host and 00:02:18.980 --> 00:02:20.180 another one being the port. 00:02:20.440 --> 00:02:25.440 Now our Docker command is going to tell it to bind to Port 5000 and 00:02:25.440 --> 00:02:29.240 that's already done, so we're good there. But as far as the host goes 00:02:29.240 --> 00:02:33.180 because we're running in Docker and it, by default, binds the localhost, 00:02:33.180 --> 00:02:37.340 we need to give it direction to bind to all IPs on the local system so 00:02:37.340 --> 00:02:38.670 that our browser can find it. 00:02:38.970 --> 00:02:49.760 So we'll do recon‑web ‑‑host 0.0.0.0 and then we'll access the web 00:02:49.760 --> 00:02:53.140 application by going to the localhost on Port 5000, and we should now be 00:02:53.140 --> 00:03:03.270 able to access the Recon‑web interface. Localhost: 5000 and here we are 00:03:03.270 --> 00:03:05.100 looking at the Recon‑web interface. 00:03:06.510 --> 00:03:07.920 So there is not much to see here right now. 00:03:07.920 --> 00:03:10.870 In fact, it says bunch of zeros, but we know that's not true. 00:03:10.970 --> 00:03:14.310 Well, that's because the default workspace that it uses is default. 00:03:14.480 --> 00:03:17.630 So we need to click the workspace here and select our Pluralsight workspace, 00:03:17.630 --> 00:03:20.350 and now we can see that we have a lot more information. 00:03:20.350 --> 00:03:23.850 There is our contacts, there is our credentials, net blocks, so on and so forth. 00:03:24.440 --> 00:03:27.190 So the next step here is we can begin to whittle down to 00:03:27.190 --> 00:03:28.430 the information we're looking for. 00:03:28.430 --> 00:03:30.370 So let's say we want to look at credentials. 00:03:32.010 --> 00:03:35.190 Once we click on the credentials table, the interface populates, 00:03:35.190 --> 00:03:36.970 and we see now fields available there, 00:03:36.970 --> 00:03:39.190 ways to export it, and the actual data itself. 00:03:39.360 --> 00:03:39.620 Well, 00:03:39.620 --> 00:03:42.570 let's say we only want to see the username, and the password, and the 00:03:42.570 --> 00:03:44.950 hash, and we're not interested in the rest of this stuff. 00:03:45.540 --> 00:03:47.390 We can unselect those and filter, 00:03:47.730 --> 00:03:50.270 and then the data that we want is presented to us. 00:03:51.390 --> 00:03:54.330 Then we can choose to export it and there is multiple ways that you can 00:03:54.330 --> 00:03:58.760 export it. We can export it to a CSV file, we can export it to a JSON file, 00:04:00.240 --> 00:04:06.920 we can export it to a straight up list, we can export it to an XML file, or 00:04:06.920 --> 00:04:09.730 we can export it to Excel spreadsheet, 00:04:11.220 --> 00:04:15.690 which is really handy for many playing data outside of Recon‑web itself. 00:04:16.839 --> 00:04:18.890 So there are a lot of options for exporting that data. 00:04:18.920 --> 00:04:20.899 Well, what if you just want everything. Well, it would be 00:04:20.899 --> 00:04:22.580 kind of cumbersome to select the table, 00:04:22.700 --> 00:04:25.080 filter out what you want, and export it individually. 00:04:25.190 --> 00:04:26.140 Don't need to do that. 00:04:26.420 --> 00:04:32.230 There is an option at the top to export the entire database to an XLSX file 00:04:32.240 --> 00:04:34.150 and you could do that by simply clicking that button. 00:04:35.040 --> 00:04:38.420 And then you'll have your entire database for that particular workspace 00:04:38.430 --> 00:04:41.440 exported to an Excel spreadsheet that you could then manipulate and 00:04:41.440 --> 00:04:44.550 share outside of the Recon‑ng environment. 00:04:45.740 --> 00:04:46.710 So as you can see, 00:04:46.840 --> 00:04:51.000 Recon‑web is super helpful for both analyzing data and for exporting it 00:04:51.000 --> 00:04:53.650 for further analysis and consumption by other tools.