Hi, and welcome back after the email, addresses usernames.
And image searches. We have reached Section
8 called. Oh Cindy it systems.
Well here, I use the acronym osint as
a verb because in the end all those tools for data
Gathering are used to interact with those it systems in
a way. And also as you maybe recall, I
have said at the beginning of this.
That this is one of my favorite sections because I'm an
essentially, an IT guy here. We will jump into
the demonstration of the different tools. You can check and
learn about your company's Expo, exposure to the internet
or a person's exposure. This is a critical
section since almost everything we do with the technical
side of Open Source. Intelligence is based on it
systems. So let's move on.
Now to make a quick overview of do videos and topics in
this section. First, we will talk about IP addresses and
the domain name system or DNS functionalities as
the foundation of almost any of ours. It
system investigation. I will first do
a quick domestication is I like to call it of the to IP
and DNS? And after that, show you a
few of the tools with, which you can potentially get answers to
your IP and DNS questions, during a
nose investigation.
Then we will proceed to the iot or Internet of
Things. Search engines to most popular ones
are shodhan and senses. Maybe you're wondering
why we didn't cover this in Section 5 where
we discuss search engines, the answer to that
is because it's pretty simple. This is
a flavor of gathering data directly from it systems
and I believe the prerequisites for this kind of also Network.
It's easier for for a cybersecurity professionals,
with an IT background.
System, engineering background will be even better. And
the last part of this section is dedicated to demonstration of
various hosts and tools for Gathering and processing. Collect
data tools are sub
Lister. The Harvester Recon NG spider
foot and multigo also through
a demonstration. I will show you some of them how they
work, but I will definitely tell you. What can you expect of each
one listed here. So let's move on
to our first topic of this section.
In this video that is dedicated to IP addresses
in DNS. I'll start by the mystifying these
two terms. Maybe you remember that? I have mentioned how
for this section a prerequisite is prior knowledge about
it. In this case for you to
be familiar with the IP addresses and domain name systems. What
is it and how it works?
I will start with the IP addresses actually, ipv4
addresses. You
are probably already aware that. An IP address
is a set of numbers with the purpose of
identifying, a device on a computer network. And in our
case will speak of the internet as a network, as
a big computer network. Since our main resources are
found on the internet for our open source investigations.
IP addresses are
all over the place. York.
Computer right now has an IP address, probably a private one
and that brings us to our second bullet. The
two major groups or types of IP addresses, private and
public. This is probably one of the main things you
should be aware of concerning the IP addresses. The
private ones that are covered in the RFC.
1918. Just Google it.
I just that private not exposed to
the internet directly rather there in your corporate
Network or simply on your home network with your home.
Router Plum. Probably your
computer right now is sitting on a private address. That
address could be could come from three blocks or
classes as they call them ABC 192.168.0.0.
Then
170, 2.16.
One point zero point zero and 10
class 10.0.0.0 for
an example. My computer IP address is 192.168.0.1
12
with a subnet of 255.255.255.0 or
the slash 24 subnet.
The public IP address on the other hand is a little bit
different. All the other, ipv4, addresses belong
to the public space and they are routed and
used in the public Realm of the internet. When you
ping google.com, you will ping the public IP
address of that server from your private and
or home network. Now, I won't
go into details and the inner workings. How I peas
are used and how all the other Technologies are
involved. Like the
Akka dress translation or Nat rather. We
will now focus, our IP addresses used in
our osint investigations.
Now, that we have demystified IP addresses at least a
little bit. I would like to show you how IP addresses
are used in the location context, which is very important
in open source. Intelligence. As
you know, IP addresses are often obtained from all
kinds of resources throughout the internet, email messages,
social network posts through scanning techniques
and so forth. There are a few great resources with
which you can learn about the location of the IP
address. And by,
That the location of your Target and I
would like to show them to you right now.
Here we are in our browser.
First is the IP location dotnet service.
This is
a free website that gives the IP address results.
This is probably something guy use all
the time and it is pretty much straightforward. When
you visit the site immediately immediately, you get
information about your IP address through the browser you
use. As you can see, all kinds of information is
here. My location host name with the
ice P name.
I use a VPN and don't forget to use that to when you do
your investigations, then the
platform browser details image screen
size. And now when we have an IP address that
we want to look at, we will type
in the IP location finder box. I
will use 8.8.8.8, which
is a public IP address of the Google DNS server and
just as a side note in network network.
Being pinging, the 8.8.8.8 address
is one of the methods to confirm. Do you
have IP connectivity to the internet?
So and press IP lookup.
Here, we don't get that comprehensive report like on
our IP address previously. But
a great feature is that we get the geolocation data from
other services like IP info that I owe.
That is a good cross reference to double or triple check
immediately. But I like to double-check the IPS info
going to the other servers separately.
Next on our location tools list is the IP fingerprints
that cam. So let's go there.
I like this service because of its good use of
a map. Besides your approximate location. When
you when you type in the IP address, you
also get the map based results. I
will use the same Google IP address.
Presents cover. As you can see, the
map.
And the last on the list is the IP info that
I owe.
Which is my personal favorite. It is
not completely free. But it, but it gave me
best results when I have done my investigations. Actually.
I use their API and currently through
the usage of their API. You can make about
actually crew. Actually,
I use their API and currently through the
usage of their API. You can make 50,000 requests
per month, which is usually more than
enough for at least my knee.
I encourage you to check the developer's guide on the side.
Now, the DNS or the domain name system, part
of the osint investigation just to do a quick do
mystification of the DNS DNS, or the domain name
system is as the devika pedia states are
hierarchical and decentralized naming system
for computers services or other resources connected
to the internet or a private Network. It
Associates various information with domain names, assigned
to each of the participating entities. Basically,
it is a phone book of the
It when you access a website with your web
browser, you type in the name of the site, like google.com, but
what it really means to the computer. Oh google.com.
You say that's 17 2.2.
17-point 16 .17
for on Port located
on Port, 443. And you should look there for
it. You can also try and put the IP address
in the address bar of your web browser and see what
happens. You will also visit.
Calm by entering the correct IP address in your address bar,
but it is a lot easier to remember the
domain google.com rather than a bunch of
numbers. Just like a phone book when you access your
phone book. Usually don't look for a number rather a person's
name, which is assigned to a number.
Okay, now that we demystified enso little bit.
I want to show you useful online tool
for DNS investigations. In the ocean context. The
tool is called view DNS and it is located on The View
DNS that info address. This is
this tool is useful. Once you have identified an IP address of
your target. Once again, let's go to our
secure browser and type in the address view,
DNS that info.
And as you can see, actually, there are a lot of tools integrate
in this framework. And now, I want to show you
some of them as I have mentioned, you have your IP
of interest and you can start checking its DNS
information. Our first stop would be to
use the reverse IP. Lookup, this
tool will display all the sites that are hosted on
a given server. If, for some reason you are looking at
a website that potentially resides on a shared hosting
here is my example.
Bolt the it know that net the main type
it. No dotnet in
the domain / IP Box and press go.
As you can see, there are over 330,
domains hosted on This
Server. So this is most definitely a shared hosting type
of server.
We can also check the Whois data and that kind
of research can reveal all kinds
of information, because sometimes who is includes
phone numbers in direct email addresses.
Also Apple.
God. Also, location is very interesting. Just
like we did it before in the previous section with
the IP addresses, just type in the targets IP
and press go, I
will type.
66 26, 25
26.
To check. Where it, where is it?
It's in the states. Florida actually.
now, the another
Now, another cool feature is to check. Are
there any open ports actually
for the common ports that may be open? Let's
do it again with the same IP.
As you can see from a brief demonstration, a
lot of information can be revealed and
extracted from a tool like this. You
DNS also has an API and it's API plans.
It are intended to be used in
a more intensive research. Check it
out. If it fits your needs and
now in the next video, we will cover in an interesting search
engine approach, almost Google like, but
dedicated to devices and computer.
Works. Next video is called iot search engines.
So see you there.