WEBVTT

00:00:01.940 --> 00:00:04.150
Welcome back to our Kali Linux virtual machine.

00:00:04.540 --> 00:00:06.460
Now, let's continue our red team job.

00:00:06.660 --> 00:00:08.600
Let's take a look at how we can find more information

00:00:08.600 --> 00:00:10.410
about the people that work in our company.

00:00:11.240 --> 00:00:14.070
So I'll open a new project. In your case,

00:00:14.130 --> 00:00:15.400
you can create a new project,

00:00:15.410 --> 00:00:18.150
or you can even continue the one that we created in a previous demo.

00:00:19.240 --> 00:00:23.550
In here, I'll start by creating a domain entity and adding our target domain,

00:00:23.670 --> 00:00:29.080
which is nasa.gov. Now, let's try to find interesting

00:00:29.080 --> 00:00:30.560
email addresses for this domain.

00:00:31.240 --> 00:00:35.950
So first I'll run this transform called To Email address [From whois info].

00:00:36.740 --> 00:00:37.330
Basically,

00:00:37.430 --> 00:00:39.940
this will connect to the whois information and get the

00:00:39.950 --> 00:00:41.550
email addresses registered in there.

00:00:42.640 --> 00:00:46.120
As you can see, we found two email addresses which are really interesting.

00:00:46.580 --> 00:00:51.830
Especially this one, soc@nasa.org. But I'm not satisfied yet.

00:00:52.100 --> 00:00:53.850
Let's try to find more email addresses.

00:00:54.840 --> 00:00:57.780
So back to the transform list, I will select now the

00:00:57.780 --> 00:01:01.250
transform called To Email addresses from PGP.

00:01:04.340 --> 00:01:04.860
Awesome!

00:01:04.970 --> 00:01:05.700
That's much better.

00:01:05.750 --> 00:01:08.220
We found 12 email entities. And, again,

00:01:08.460 --> 00:01:12.820
12 is the limit of the free version of Maltego, so probably there are several

00:01:12.820 --> 00:01:16.710
other email addresses out there. I could have simply used those email

00:01:16.710 --> 00:01:19.650
addresses for some phishing or spear phishing emails.

00:01:20.340 --> 00:01:22.320
Also, just to make sure I got everything,

00:01:22.490 --> 00:01:27.550
let me run this last transform called To Email address from search engines.

00:01:29.990 --> 00:01:30.720
And I'll take a look.

00:01:30.980 --> 00:01:35.470
There's an error here on the transform output. Here it says that this kind of

00:01:35.470 --> 00:01:40.650
transform is only available on the paid versions of Maltego. But that's fine,

00:01:40.650 --> 00:01:42.450
we already have plenty of information here.

00:01:43.730 --> 00:01:46.850
Let's say that I've done some extra investigation and I found some other

00:01:46.850 --> 00:01:51.070
email addresses that are not in here. For that, I can create a new email

00:01:51.080 --> 00:01:57.280
addresses entity by dragging it and dropping it to my workspace. In here, I

00:01:57.280 --> 00:02:00.760
will double‑click on this and enter the email address that I found, which is

00:02:01.020 --> 00:02:05.150
john.smith@nasa.org. Awesome.

00:02:05.380 --> 00:02:05.740
Now,

00:02:05.750 --> 00:02:08.440
one thing I like to do in a red team engagement is to find

00:02:08.440 --> 00:02:11.190
out if the people in the company had their password breached

00:02:11.190 --> 00:02:13.380
in other places. For example,

00:02:13.420 --> 00:02:17.880
let's say they use their email account to log in to adobe.com, and then

00:02:18.030 --> 00:02:21.150
Adobe gets hacked and the data gets leaked on the Internet.

00:02:21.940 --> 00:02:25.680
So then we can try to find on the dark web the passwords for that

00:02:25.680 --> 00:02:29.060
account, and if the person reused their password,

00:02:29.120 --> 00:02:32.450
we can get access to some of their accounts using the leaked passwords.

00:02:33.240 --> 00:02:36.380
So let's say I want to know if John Smith had his account

00:02:36.390 --> 00:02:39.550
previously compromised. As you can see on the list of

00:02:39.550 --> 00:02:41.550
transforms, there's nothing here like that,

00:02:42.140 --> 00:02:45.610
but we can install a plug‑in that will allow us to get that information.

00:02:46.480 --> 00:02:52.670
So let's go back to the home page, and then scroll until we find

00:02:52.670 --> 00:02:57.030
this plug‑in called Have I been Pwned. This plug‑in basically

00:02:57.030 --> 00:02:59.170
connects to the Have I been Pwned database,

00:02:59.250 --> 00:03:02.500
and let us know if this email was seen in any data breaches?

00:03:03.380 --> 00:03:06.430
To install this plug‑in, all I have to do is hover my mouse

00:03:06.430 --> 00:03:08.570
over it, and then click on the button Install.

00:03:09.630 --> 00:03:11.200
And after confirming the installation,

00:03:11.340 --> 00:03:13.640
Maltego will install several new transforms related to

00:03:13.640 --> 00:03:19.380
it, and then, when this is completed, we can just click on Finish. Perfect.

00:03:19.390 --> 00:03:21.550
Now, we can go back to our Nasa graph,

00:03:22.440 --> 00:03:26.150
and here let's right‑click on the same email address. And now,

00:03:26.160 --> 00:03:26.960
as you can see,

00:03:27.090 --> 00:03:30.950
there's a transform here called Get all breaches of an email address.

00:03:31.680 --> 00:03:32.730
Once I click on this,

00:03:32.840 --> 00:03:35.590
it will research across several data breaches to see if

00:03:35.600 --> 00:03:37.950
this email address was in any of those.

00:03:40.010 --> 00:03:40.480
Awesome.

00:03:40.490 --> 00:03:43.880
Now, take a look, this email address was in five different data

00:03:43.880 --> 00:03:46.480
breaches, and this is getting really interesting.

00:03:46.990 --> 00:03:49.700
If you want to get more information about a specific data breach,

00:03:49.780 --> 00:03:53.290
I can just right‑click on it and select Enrich breached domain.

00:03:55.840 --> 00:03:56.360
Perfect.

00:03:56.460 --> 00:03:56.990
Take a look.

00:03:57.030 --> 00:03:58.750
We have a description of the breach here.

00:03:59.320 --> 00:03:59.900
Apparently,

00:04:00.110 --> 00:04:03.350
there were more than 100 million records that were breached in this case,

00:04:03.790 --> 00:04:04.550
and that's a lot.

00:04:05.240 --> 00:04:06.570
And if we scroll down a little,

00:04:06.610 --> 00:04:09.630
we can see what kind of data was breached. And take a

00:04:09.630 --> 00:04:12.450
look, it seems that passwords were found on this breach,

00:04:13.040 --> 00:04:14.350
and that's really interesting.

00:04:14.880 --> 00:04:18.839
This means that if you find on the dark web the data related to this breach,

00:04:19.100 --> 00:04:22.680
I can then find the password for this account, and if the

00:04:22.680 --> 00:04:25.890
person reused this password in other places, it will be really

00:04:25.890 --> 00:04:27.250
easy to get access to their account.

00:04:28.240 --> 00:04:29.200
That's pretty cool, right?

00:04:29.690 --> 00:04:30.170
But again,

00:04:30.370 --> 00:04:32.450
don't do this against an account that you don't have

00:04:32.450 --> 00:04:35.750
authorization. Entering someone's account is illegal,

00:04:35.900 --> 00:04:37.390
so don't do that.

00:04:37.640 --> 00:04:38.550
Don't be a criminal.

00:04:39.440 --> 00:04:40.560
But the cool part is,

00:04:40.640 --> 00:04:43.860
is that in less than 5 minutes we were able to find tons of information

00:04:43.860 --> 00:04:47.520
about the people that work for this company, and even found that some of

00:04:47.520 --> 00:04:50.010
those accounts were compromised in previous breaches.

00:04:50.700 --> 00:04:53.660
And from here, you could send phishing emails to those people, or

00:04:53.660 --> 00:04:55.950
even try to find their credentials in the dark web.