Hi everyone, and welcome to the last video. Our Section
8. That is devoted to open source intelligence and
it systems extreme exposure to the internet. I'm
sorry, but I have to repeat a fact again. Actually
statistic from section 2 that
states how much time goes out to the reconnaissance. Or
ocean phase of these Cyber attack. It
is very well over 70%.
Maybe that is a low number because some Security Experts talk
about statistics. Well over 80 and
90%, There
is a cool quote that goes out to mr. Zack Whitaker,
from TechCrunch, it goes. If
you leave something on the Internet long enough, someone
will hack it. Remember this
quote, when you encounter something through previously mentioned
shodhan or census tools.
Here are a few of the most popular tools for
reconnaissance in the context of posts into and it systems.
First on the list is a
tool called sub Lister with a 3. This
is a python tool designated to enumerate subdomains
of websites.
And now, I would like to show you how it looks like. Hi.
Here. We are in the terminal session of our
host machine. Maybe remember we
configured from the management perspective to access
our virtual machine from our host machine via
SSH protocol. So let's go and do
that. Here's my terminal app and I
will SSH into the Ubuntu virtual machine that is running on
my virtual Box app.
To access.
SSH space, minus P
because we have a custom Port username
and the Local Host
because the ports are forwarded
to virtualbox.
Type in password.
Okay, we are in.
It's clear the screen.
First, let's check the python version on the system. This
can be easily done by typing python.
And then pressing Tab Key.
To display the versions installed. We see we have Python
3, but if you need the exact version simply
type python,
Python 3.
Space minus capital
V and see the exact version.
Now, we will also use the git repository to
download and install sub Lister, which you
can access on github.com
slash.
Hey, Bo, you l3l a sub
Lister. Spelled sublist3 iron,
but on a cleaner bun to
install git is not present. So first, we
need to add it to our system, to install git with its
default packages type.
Sudo space apt space
install git.
Type in the password to the password.
This is actually a common error when when
you use the virtual machine, so
we're going to just clear that up and
get back here.
Okay, we kill the process that was hanging and
preventing us from installing a get now.
Let's do it again.
Sudo space. Press space.
Apt space. Install git.
Yes, we want to continue.
Okay. Now we are in ready to install sub Lister actually
clone it from the git repository. Again, I will clear
the screen.
so type get
Space clone space.
And the link.
From the GitHub page.
It's already done great.
And go to the newly-created sub list of folder. Let's see
where it is.
As you can see, it's here.
Okay, after that, we need to install all the dependencies to
run some Lister, the easiest ways to use
the pipe command as it is displayed in on
the GitHub web page web page of the
sub Lister tool, but
we need to install. Pip. First Pi p, p
p is a tool for installing python packages with
Pip. You can search download and install packages from
python package index and
other package indexes with
A pip, we will be able to install all
the prerequisites for the sub. Lister usage to
install it. Simply type
sudo.
The first stage is to update the system pseudo.
Update.
And wait for the update to finish.
Okay.
After that type sudo space apt
space install.
Python 3, hyphen
b +
enter.
Yes, we want to continue.
That's our fifth has been installed real ready to install our
dependencies. Let's clear our screen.
Now, it's stated in the official sub Lister
GitHub web page to install dependencies.
We have to type.
Pseudo.
Space 3, space, install
space -
are
Space.
Requirements.
.Txt.
Enter.
Okay, and finally we are ready to run our
sub Lister. First. We will check the help section
of the tool. Lets lets
navigate. Let's display the
folder contents. Okay, here it
is. To
get to the help section type, Python 3,
space, a blister. That
be why.
Hyphen, h.
And here are the arguments the options.
Let's have a better look.
Okay. Now we will enumerate our
Target domain. I will use my own it. No dotnet
for it. No, okay. Type.
To run the command to run the tool, actually Python
3, space sub Lister.
Dot py. Hyphen d.
Hyphen, d means that the domain name will follow
after that, and that is our Target domain. I
teen on that net.
Space.
- or hyphen 000 saves
the results to a text file and
I will call it the file.
It. No.
So to recap, the command, it's Python 3,
space sub Lister dot p. Y
space hyphen d, space
it, no dotnet space.
Hyphen o space. I Tina
And enter.
Wait for the sub Lister to do his thing.
And Wallah.
Again, let's clear our screen.
Check the contents of the folder.
As you can see, here it is. I Tina.
The log, the file with
the results.
I will simply display it on the terminal with the
cat command.
And you can see these are the subdomains that
sub lists are found.
From different sources over the internet.
A cool feature of sub Lister is that it can be used as
a module in your Python scripts. So if you know how
to code in Python, you can use this module as a cool addition additional
thing to have in your program.
Back to our reconnaissance tool slide. Next is
a tool called the Harvester. Kind
of sounds like a vintage horror movie title, but
it's really cool. The Harvester is great,
A great tool and its name suggests
that it Harvest gathers
email, subdomains hose pgp
key servers and many more data from
different public sources. Like search engines.
I will do a quick demonstration of the trick.
Cool.
Again, in our terminal, our also machine. First,
we have to install, of course, the Harvester,
there is a great installation guide on the GitHub page, the
link to it is you can see is github.com /
Laramie, / the Harvester, / Wiki
flash installation. You
can actually Google it to be for sure. First.
We will clone the Harvester from get as
before you have to have get in your Ubuntu. So
you can use
We did it already so we have it.
Type.
Git clone.
and the link to
the tool http://uksubtitles.ru
slash.
Slash into Harvester with
the catalog, with the capital letter
h.
An actor.
After the training has been done, go to
the newly created directory.
And see the contents.
Here it is.
After that as before, we need to install all the dependencies to
run Harvester. The
also, the easiest way is to use the pipe command and
we already installed pep in the previous video
so we have it.
So now we have to install the dependencies. We have to position
ourselves in the Harvester directory, which we already did and
type python.
Three space.
Hyphen, m, space space
install.
space hyphen are
space requirements.
Slash base Dot txt.
Let's clear our screen after its.
After Harvey surfing done his thing with the
requirements.
Okay.
As always my first suggestion is to go to the help section. So
you can learn to how to even use the
tool.
So, type python.
Three space, the Harvester, dot
b. Why?
Space hyphen h.
Here's the list of arguments.
Now, let's do a basic harvesting and
as before I will use my
domain as the target.
Type Python 3 space. The
Harvester Dot py.
Space - D for
the main aim. I Tina
dotnet.
Space.
Hyphen, L, which
stands? That's the limit of
the number?
- sell limits the number of search results. The
default is 500. We will put put up
300 space - be
As you can see, B is the source, the
sources from which the data will be
gathered. We will use all - be space,
all space
- F.
Which means save it to a file name?
Be aware that the outputs can be generated both in HTML and
it XML and
that is very useful. When you need to incorporate the Harvester, results in
euros, and report. So, minus f
space.
Let's call it test 1.
Okay, to recap, the command Python
3 space. The Harvester dot
p. Y, space hyphen d.
Space it. No dotnet space
- L spaced,
300 space -
be space. All space hyphen
f space test-1 as
the file name.
And press enter.
Disregard the missing a API keys.
And I will show you in a moment. Where are they stored? And where
you can type them in? If you have them by using the API Keys,
you can utilize other modules like shodhan and
get certain results inside your Harvester tool
results.
As you can see, the results are immediately displayed on
the screen on the terminal.
Okay, it's done.
I promised you to show the the file with
the API keys.
The file name is API. Hyphen
keys. That why am L
going to show you the cat
command?
as you can see here, you can input type in
the
API keys.
One of my main apis that I use with any
of the tools, like this is the shodhan API key.
The beauty of the Harvester is that it has
passive and active modules. That means
just that a passive gathers information from the
internet sources without touching the target, like
the search engines Google by do shodhan, Yahoo.
And so forth. While the active modules like
DNS Brute Force, they interact
a lot with the Target and leaves a
good digital footprint. So be careful with it, and
of course, be aware.
Of it.
Now, back to our reconnaissance tool slide again. Now, I'm
just going to tell you about some additional tools. Actually.
These tools are probably the most popular ones that
there are in the ocean Gathering context. Some
of them are free and some of them cost of pretty
penny. The first is Recon Angie.
This is a web reconnaissance framework.
Also, written in Python. It is consisted of
independent modules database interactions in.
It has an interactive help.
Different built-in functions and commands. This is
a really powerful environment in which all science research can
be conducted quickly. And thoroughly. I
really encourage you to check it out. After that. I have to mention
spider foot. Spider fruit is
also a great python tool and a reconnaissance tool.
It automatically queries over 100
public data of a source is to gather intelligence on
IP addresses and domain names, email, addresses names,
and many more.
Is a web-based tool that visualizes your results.
Do not forget that, although
some of the tools do the same
things. The results can be very different.
So always cross-reference and double-check things.
And lastly. I have to mention multi ago from
retirement multigo is a very
cool data mining tool that mine's a variety
of Open Source data resources and uses that
data to create graphs for Annalise.
Using connections. What basically happens in
multi ago is the platform itself does not only
extract data, but also displays visualizes
that data in a format, which is easy to
understand as well as to analyze it, you
could easily spend hours actually days and weeks on
each of the tools mentioned multigo has its
own training sessions, and that is something
to consider. If you really have the need for it.
Okay. Now we went through some of the popular tools where I
even showed you how to install into a basic ocean search with
them and now we are prepared to move on to almost our
last section of this course. And that's action is
called data breaches and leaks. So see you in the next video.