WEBVTT 00:00:00.440 --> 00:00:03.560 Now that we've explored the basic capabilities with SpiderFoot, 00:00:03.940 --> 00:00:07.440 we will put those to use in a red team exercise scenario. 00:00:07.440 --> 00:00:11.050 We'll initiate a scan using basic information about a target, 00:00:11.440 --> 00:00:14.160 then we'll examine the information available from the scan. 00:00:16.140 --> 00:00:18.450 In this demo, you are a red team operator. 00:00:18.940 --> 00:00:21.520 The contract with the client has been signed and the rules 00:00:21.520 --> 00:00:23.260 of engagement have been established. 00:00:23.740 --> 00:00:27.060 You've been tasked with gathering OSINT on the target of the engagement. 00:00:28.540 --> 00:00:31.060 You have been given the following information to start. 00:00:31.440 --> 00:00:34.790 We know that SpiderFoot will start with an initial seed target 00:00:34.800 --> 00:00:36.960 and gather related information from there. 00:00:37.340 --> 00:00:39.260 We just have to choose the right starting point. 00:00:40.840 --> 00:00:43.660 Let's start with a Globomantics Domain name. 00:00:45.740 --> 00:00:48.750 At this point, we don't want to directly probe the site, 00:00:48.750 --> 00:00:51.260 so we'll select the Passive use case. 00:00:52.740 --> 00:00:56.250 This will take a while to gather everything, so let's skip ahead. 00:00:59.340 --> 00:01:03.260 Now that we have a good starting point of information to review, let's dive in. 00:01:04.739 --> 00:01:08.660 At this point, I might be interested in people associated with this organization. 00:01:09.140 --> 00:01:11.890 We have the CEO's name, but who else? 00:01:12.340 --> 00:01:14.760 SpiderFoot found some username information. 00:01:15.640 --> 00:01:16.860 Let's look there first. 00:01:17.740 --> 00:01:21.850 We have one person listed here a few times, along with an email address. 00:01:22.240 --> 00:01:23.160 That could be useful. 00:01:23.790 --> 00:01:26.560 SpiderFoot identified a physical address. 00:01:27.540 --> 00:01:31.100 So this doesn't seem to match our target physical address. 00:01:31.540 --> 00:01:32.350 Let's check. 00:01:33.740 --> 00:01:35.450 We have an address in Utah. 00:01:35.940 --> 00:01:39.750 SpiderFoot identified several Washington state addresses. 00:01:40.140 --> 00:01:43.650 Let's see what organization they used to host their website or domain. 00:01:45.140 --> 00:01:47.960 We can now see that they use Amazon Web Services. 00:01:48.340 --> 00:01:53.760 We now know that the physical addresses found refer to AWS and not our target, 00:01:54.140 --> 00:01:56.560 so let's mark those as false positives. 00:01:58.040 --> 00:02:01.460 Let's go back and look at information on infrastructure. 00:02:02.440 --> 00:02:05.050 SpiderFoot found information on IP addresses. 00:02:06.040 --> 00:02:08.350 We have three unique IP addresses here. 00:02:08.740 --> 00:02:13.660 However, we know that they use AWS, so these details may not be too helpful. 00:02:14.640 --> 00:02:18.550 So that was just a sampling of the information SpiderFoot identified 00:02:18.550 --> 00:02:21.750 with just a passive scan starting with a domain name. 00:02:22.240 --> 00:02:26.560 If you recall, there was an IP address listed in the target.txt file. 00:02:27.040 --> 00:02:29.000 This is a contrived example, 00:02:29.010 --> 00:02:32.560 and you're unlikely to get a specific IP address this way. 00:02:32.560 --> 00:02:37.460 You're more likely to get an IP address range or IP ranges to avoid. 00:02:37.840 --> 00:02:39.360 However, we have an address. 00:02:39.590 --> 00:02:41.160 Let's configure a scan for it. 00:02:43.740 --> 00:02:47.760 Here we can see many of the same data types that we saw from the first scan. 00:02:48.240 --> 00:02:50.890 We could export the data from both scans and do some 00:02:50.890 --> 00:02:54.660 comparison in a spreadsheet tool, but let's look at some of the findings here. 00:02:55.640 --> 00:02:58.090 Since this was an active approach for scanning, 00:02:58.100 --> 00:03:02.240 we can see that SpiderFoot did a simple port scan of the target IP and 00:03:02.240 --> 00:03:07.550 found two open TCP ports with SSH and a web server running. 00:03:08.540 --> 00:03:14.560 It's an Apache web server running on Ubuntu, and it has a fairly old SSH server. 00:03:15.440 --> 00:03:19.230 SpiderFoot will try to identify affiliated resources to the 00:03:19.230 --> 00:03:22.310 seed target For affiliate IP addresses, 00:03:22.310 --> 00:03:26.790 the default setting is to identify 10 IP addresses on each side 00:03:26.790 --> 00:03:28.960 of the IP address provided or identified. 00:03:29.440 --> 00:03:30.660 That's what we can see here. 00:03:31.640 --> 00:03:34.550 Don't assume that these are definitely affiliated with our target. 00:03:35.540 --> 00:03:38.450 There's a similar story with affiliated domain name. 00:03:38.940 --> 00:03:41.960 These could be domains of unrelated organizations. 00:03:42.340 --> 00:03:46.860 As you investigate more, mark this data as false positives if needed. 00:03:47.740 --> 00:03:49.080 So after this demonstration, 00:03:49.080 --> 00:03:53.050 I hope you can see the value that SpiderFoot provides for red team operations.