In previous lecture, we learned about the basics of hunting subdomains.
Actually, in this lecture, we will dive in a little deeper and look at other tools that are available
for gathering intel on our target.
So we will start by using the infamous tools of Kali Linux, gathering information in a circular stage
or performing a penetration test as every step we take after what is an outcome of all the information
we gather during this stage.
I'm actually for this reason, it's very important that we gather as much information as possible before
jumping into the exploitation stage.
Actually, in this lecture, or this is the first lecture of our section of our ultimate course, we
will cover um, and there are sites like we will get a list of subdomains.
We will use showdown for fun and profit.
Uh, we will um, use shot on honey score.
We will use shodam, plug in census.
We will use a map to find open ports.
Um, we will bypass firewalls with any map.
We will search for open, direct directories.
Uh, using co-pastor.
We will hunt for SSL fluffs.
We will automate, uh, brute force using brute spray will digging with the harvester.
Uh, so we will dig deep with the harvester.
Uh, we will find, uh, technology behind, um, web applications made actually using, uh, with what
the web and weald with, uh, websites and tools.
We will scan, uh, IPS with, uh, must scan and on any map we will find origin servers with Claude
Bundy.
We will sniff around with the shipment and testing Caruthers, uh, y uh, firewall actually.
Firstly, let's start by get a list of subdomains, so they're performing a black box test.
The client may not give us all of the subdomains of the organisation.
So in this recibe, we'll cover one of the five techniques that can be used to get lists of the subdomains
of an organisation.
So how to do it?
So first of all, we have a website that, uh, will help us all doing this.
And this is the actual this website is scans Eeyore, uh, actual and it's open ish.
Scott's scans you.
So.
We have this did the DNA stamps, and we will use the scarce era, uh, it relies on scarcity of words
to resolve, so it's pretty simple to use.
So actually.
Actually, can you see my screen?
Yes.
And then this stumper, that Chrome.
It's really been a stumper.
You're showing, Dean, it's actually it's Dean stumps, all right, in this dumpster at the corner.
Actually.
Yes.
So.
Um, actually, let's find, um, the um, some, uh, domains subdomains with these tools.
Uh, so I will give our websites, take things like them websites to find DNS subdomains.
And it's searching.
So you can see here this information to what this information is.
We can see here that our web site hosting is named cheap hosting and DNS as is named cheap DNS, and
we have the mail subdomain here, mail that take beans that come in.
So you can see here this email that I think things that will redirect us to the main page of our website
because I hadn't set setting up this mail yet.
And as you can see here, our DNS is is name cheap DNS.
So here we can see the name, chip hosting IP address and the address here.
Um, and you can see here we have get as much in the information by just one site.
So.
Actually, we have, um, some additional information here as well.
Um.
You can see here we have, uh, takes the records we'll show here and we can do that.
And all and Excel is six fires, and we do grep for it.
Um.
So we are done with that, we get the information from just one domain.
So it will actually it gives us additional subdomains because we own websites hasn't subdomains yet
and we don't need it.
So for example, in some website, if you can these subdomains for, for example, this is this domain
of website and this is the subdomain here.
So if we search, call it that.
Work here in.
Uh, Dennis Dumpster.
We will get information, so there was an error or request.
Why?
Because I have put slash on it.
Actually, as you can see here.
You know, we can see information, see it.
We have to see records here.
And actually, we have males and we're running in California pulling whom you call your kids the economy
old love.
He, like, um, male -- will come in and.
And he can't.
We have so much subdomains here, as you can see here, and we can see these IP addresses.
So which host address and of which these subdomains, which host address and which servers using this,
as you can see here, they're pretty similar, actually.
And this means they are going to in one hosting.
So these UM domains going to just in one hosting slot, different hosting, you can redirect these um,
and that's well, different hosting Lucasville.
As you can see, there's the uh for Russia currently looks kind of actually.
So this means, uh, actually in talks, but in the Russian language, uh, we have forums, tools and.
We have different weird and get subdomains here, so let's close this, actually, I want to show you
something very helpful for hackers and penetration testers web site, which is spot on.
So Shomon is the world's first search engine that was used to search for devices that are connected
on the internet.
So in the next lecture, actually, we I will teach you the how to use shotgun and how to use showdown
for fun and profit.
So I'm waiting in the next lecture.