Hi, and welcome back to a deep dive into
Network. Assessments by easy console. This is
section tree. Hands-On with network
Assessments in this section. You will learn
about working with open source, intelligence tools, and
you'll also discover on how to gather
information about a Target. So that's
so you're probably wondering what exactly
is a scent of Open Source. Intelligence is simply
this is a technique of possibly Gathering publicly
available information about a
Target. So probably wondering what do we mean
by possibly got her in the first season Patriots
on testing, ethical hacking or even talking
generally. It's information-gathering or
reconnaissance, this two types of
information gathering or reconnaissance, and this is active.
And the other one is called passive passive. Simply
uses an indirect approach to
God, information about
All the target without a receipt directly engaging.
The target publicly accessible
information to help profile
and understand what phone royalties
exists within our targeted. Self it
saying as many organizations usually leak,
and they were supposed to much information about
themselves on various platforms such as
forums blogs on even
social media a transaxle, what, it's a
penetration tester or a real hacker can simply
collect all of this information. Analyze information
and even use information against actual
Target to put simply to
get started with performing open source
intelligence. We can use is falling for in SAS guidelines. By
checking search
engines such as Yahoo. Been Google
on any other search engines are there
about or Target?
So you put simply we can just go on Google and search
for a target of an isolation and
see what is search results revealed us.
We can even perform Google hacking techniques or
what somebody since my call Google Duo
King, which is pretty much using advanced Google searches
to look for specific information about it.
I guess, we can even check social media
platforms, such as Facebook LinkedIn, Instagram,
even Twitter for anyone
who may post, pictures, such as
let's say, I employ of the wise Asian, and sometimes
employers will take pictures of your desk and
only a desk may have. Let's see the employee's
ID, badge, or even sensitive information. Written on
a positive note. We can also look at footprinting
a company's website. We
can even look up profiling email for
printing techniques using who is information to
daughter to my registry when performing
DNS foot printing.
So let's take a deep dive into understanding, how
to use each of these techniques to
actually calling to Mission about your target. Hear. I'm
on Google and I could somebody search for
who is this will list in
number of who is databases, usually contains
the registration information about
it. Do mean so we can
check if you have these we can even the 2 on icon
who is look up, we could check who is that doing?
So to speak unless click on any of these. So we
can start with this one here.
And we can simply enter a do
mean. So let's say for example, we answer microsoft.com I
hit search. This is going
to of course is going to ask me if I'm
a robot to not let it go.
I know we actually got who is information for Microsoft so
we can see the domain registration
information such as when they do mean was
registered. When it's going to expire, when it
was last updated. We can even get the nameservers,
we can even get any sort
of technical contact information. Also there
at our system numbers such as the ISP, dear
public inside address on any
other meaningful information. Down here,
Will Reveal any sort of confidential information.
Do you have some organizations who
wrote to say to me in and does not pay for privacy? If they
do not pay for privacy, then we'll see all the registration
information publicly available in this portion of
the Wiz record.
However, keep in mind that most organizations, if not
already FIFA privacy, so that
their personal or the private information is not
leak outside so that she has one technique of where
we can actually get information
about a domain or the
Uno to do me another place. We can check his job
websites. So, that's how do I change a light switch
or something? Let's search for network administrator
and let's see what pops up.
So, it's, it's sewage and guys, by
no means, I'm targeting any particular
organization. We are just taking a look at publicly available
information. I'm trying to understand how it's
your doctor. Could leverage this information to Target a
political organization.
So, let's click on this one next
week and systems administrator.
On what you're looking for is, whether the organization list,
any specific Technologies and look
at his experience in the following, but it's
not required. So yeah, I'll
some Dell EMC systems are some, my
telephone systems. There's a
backup exec solution case. Even
this case on VMware, get some
Windows Server, some Unix systems, and
apparently this company is using some Dell
networking Technologies. So how's the traffic to
even do? I'm seeing this as what's a job, vacancy. What
I'm also say, he is the type of
technology is this company is using. So for example,
the voice over IP systems Night, Owl.
So, this means Our Fate rather than simply look for
vulnerabilities on even exploit for my Toby
systems, in terms of networking. We can
see that they're using Dell networking Solutions. Now,
I'm not too sure what it switches.
Photos of some other solution as well. However, what
a identify is a child when they're here.
So, just by looking at this specific information,
we can determine the type of Technology IIT or
network infrastructure within
the international side of his
organization. So, as you can see, this is a pretty good
example of how you can use publicly
available information, which may be leaked a little too
much over there and try that this could simply leverages
to their advantage. However, 101
ization, standpoint. They are looking for someone who has
the skills or experience Within These Technologies. Sometimes revealing
certain Technologies may be a bad thing
and also a good thing. So that's remind shalabh or at
another place. We can check for organization. Information
is a cycle hunter that
I you
So Hunter. Are you is going to
provide a lot of publicly available information about employees
who belong to certain organization?
It's recommended to create an account on hunter that I owe before
a performance, which has caused. Your searches will be
limited. However, if you want to get additional features on
hunter that I owe, you need a pita count,
so just give me one second. I'm just going
to log in and then we'll perform a simple switch. All right.
So now I'm back logged in on the face, looks
a little different, but on a means, which is so I can
begin my type in an organization example, Microsoft.
And while I'm typing
Microsoft is giving me Susan potential.
Do means philosopher example, I'm
looking for microsoft.com., We can see slowed up microsoft.com.,
I can simply click it and then Uber City
photos and results.
Simply by clicking this. I can get two
sons who perhaps has a shin
before is currently working working within
this organization and it actually
shows the most common form of
48 emails. So if it is, this
organization is using their, let's see, the username
portion of your email address to
log into your network. Then hunter that
I use are showing me their email format structure
possible, username structures. Well,
structures. And therefore, Matt now look
at some of these weekends Sleepless in sneem, we
can see the email addresses, we can see
even the sources of where this information was
captured from. So if a person had an
LED lights for your email address, their contact information and
Lexie, somewhat link to the
organization in some public or external probably
to the party for them, it's going to pop up here.
About the cool thing is that we can see some
of their job titles. So let's say for example it try
to talk to his actually Targets in a high-profile employees
such as it's a board of directors, perhaps
a see you perhaps even let
see IT director while it makes
it easy talk to identify the high-profile employees of
analyzation if you should perform. Let's see. Some type
of spear phishing attack or even a willing attack.
Korean food, I hear. We can see that. The result is
limited and definitely will need a peed account
to see more results. However, the
cool thing is we can click on. This always says
sources. I could see the actual sources
of where intimations captured from the more
we can use a People Finder. So you
could switch for a person on Android ization to verify, whether
the person actually work with sin. Institution
organization, is also
any sort of additional information that may
lead to verify to listen to. We Can. Company
Another great place we can check is called Shoot on.
Shoot on is pretty much a search engine
for devices with your own internet. So
other words, it's a search engine for iot devices.
As a really, really powerful. Actually, we can
find a lot of devices up tops belongs to various
companies. You can look for vulnerabilities. We can
even see things that we thing.
No one else sees when connected device to
a network to leverage a parachute and you will definitely
need our account. So just give me one second.
I'm going to log into my account here. Okay.
So now I have been logged into my
account. But I'm going to Isleta fight song
by switch for Windows server and
hit enter search on. This
is going to show me all the Windows Server around the
world. Now. This is not every window silver, but all
the windows servers that it has attracted around
the world to be directly connected to the internet.
Sakura, you can see that there are above two million
devices. Retained as a result.
For Windows Server. We can see the amount in various
countries. We can see where you're supposed to call and
we can seat up organization. You can even see
products and we could even sort out based on certain versions
of Windows server. For example, right now
my stuff is using Windows Server, 2019. And I
think ideas on your vacation is going to release sometime soon
if it's not already released, but there's
a lot of organizations and even users
around the world. Who's you see? How much more older version of
Windows server? For example, there's Windows Server 2008
2012 as well. So that's
it. For example, I click this year.
What is due now? It will filter the results for me
and show me.
A very specific result for
Windows Server, 2008 R2 in the
price is for
Maltese be. So
I thought it up routing system. And sometimes, if you
are attacking a system from across into that, you'll need
to look for some call. Delois. Hi, Aunt. Ruth's the lowest high
and fruits are pretty much the sounds of a very easy
to break into because the vulnerabilities are very Wiley.
Nude on pops. Organization did not pass shoes on
her abilities. The cool thing is if we click
on one of these will get much more specific information about the
actual silver. No, keep in
mind that we are not talking and you on right now, we are not tired targeting
any political organization when users around the
world. What should Anna showing us has publicly available
information at anyone around, will come see.
So for example, that I click on this
was organization here, simply by clicking the IP,
you can get more
Spell information. I could see all open ports, these
Porter, service ports. And as you know, is Super
Sport. Simply is opened to accept
incoming message or to send a
message on EC Porters
open on Lexi Savoie. It simply means
that this was running specific services or applications
would require this also upon
the cool thing about Sudan, as it
will show you a little description about each of
these ports. As you go down food and shows us the bombing finish
as well. Sometimes, when
you click on Lexi public IP, or without
a result inside. Oh, shoot on. It will show you
known for abilities as well. Some of the most scariest
things, as if you click on images, it will
show us. Let's see, for example,
if you click on images, this should
take a few seconds to load up, but
it would simply what is going to show us.
It's all the logins or like a
login screen off a Windows Server machine. So, as
we can see, these are the actual
screenshot of what he can buy show done. Again.
This is publicly available information. So, please
don't use this information for anything malicious or any
sort of thing up, me, carry you to any sort of legal
problems. Another site with mentioned School
census, census required to have a user
account. Actually, leverage of power. All sensors
sensors are sort of like Shootin. It
gives you an additional information about
Ibiza, human insert into senses
another cool side. We can check the,
let's see. The web application of a tiger web
server is called Netcraft simply identify
the running applications services
and Technologies or photography of
silver website, which
is not kraft.com on what you're looking for. Is
a very special box that
says, what's that side running errands? I
do mean such as what c h, e d p, s colon slash
slash www.pandora.com.
Al.com. And we
can simply had this look like on here to begin our search. And
this is going to be 2 in the results for
all the Technologies at this web service actually running. So
right now, it's currently well. It
has no finish analyze website and you can see here.
The first dated was seeing the primary
language. We can see the site
where the site is located way to
serve public, ipv4. And IPv6. Do
you mean information registration to
missions? Well, we can see IP address
of the descriptions. I could even get a
geographic location as well. Be Sony
IP addresses that were used on the silver.
We can get the SSL TLS
information, for its data, encryption. Dr.
Rice between the web browser, web server the
city, petite information. We can even see
the net profit trying to eat to and what are the web
application. What it's possible to the pool or
talk with his phone, number to the heartbeat attack. We can
see the whole thing information as well, so we can see where this
will settle for a. Of time. The systems
are two, who's staying there, while
I web application, in this case, you can see some rock
stars who sings optician a, but we
are not able to see the actual web application platform itself.
We have to send the policy
daddy Mark additional technology started being
used within the web application of the web server
as well. Such information will be very useful
to a tractor because Detroit African. Now
look for any sort of vulnerabilities Within These well applications and
try to attempt to exploit it.
Additionally, we can even try to perform DNS enumeration.
I want to talk.
So we can begin by Alexia playing all command
prompt in windows. Are you can use a n s look up to
so you can see me type and ass. Look up on Breast Center Loop.
Sorry. I spelled it wrong. So and as look up
an answer, I was going to
return your DNS server that you are using. So I'm currently
using call swear. I'll probably go. So I
could change it to Alexa for a sample. Google
public, DNS, which is 8888. It
answer. Now on this is going
to query while it was sent all these queries now to Google
DNS server. So for example, if I
use, let's say set tight.
Equally, honestly, I switch with
www.microsoft.com. This is
going to be two in the DNS record for me
of this web server. Should I would say
going to give me the ipv4 address of this web server?
Additionally, I can do set type.
Equal Amex, Amex specifies,
the Miller Shayne Silver's only, which
is microsoft.com his answer,
right here. We actually
get the email server for the
microsoft.com do mean.
Freedom, or we can specify to all.
So we could see a subtype equal
all on this. Should give me all the records were
able to go to do mean. So let's switch back
for microsoft.com. His answer on. This
should take Hoops. I actually finish already
so that screw up on
here. You can see all the internet addresses, the game
servers be considered public name
server. The primary nameservers. We can see
any sort of additional DS record. Team have
entered on the Indiana. Sue has publicly available
to anyone on the internet.
Additionally, we can
use for your suit in Kali Linux, help us perform DNS
enumeration. So to do
this, let's click on the Cali icon here. Click
on information gathering
and we can see Daddy has DNS
analysis. Let's click on that
and it's like the DNS in them too.
So that's why
I open the application. We can see a lot of options are
available. So they get started. Let me
clear screen so we can see this a bit more and to
actually perform it dies in numeration on
as a Target. We can use a common DNS, you know.
Like so use Dash D to specify do
mean and then to specify do my name, which is
Microsoft and Jessica answer. Apparently I
missing something.
So, let's see what I'm missing. So do
you ask, you know, I need to specify the options
to actually use
on. Let me do just stopped.
I need to specify Google DNS server, space
on the URL, look up
the results of a command block in.
So simply by using DNA Sanam,
you specify the DNS server come
out together with a DNS server. If you want
to use as a query and then I'll do mean on within
a few seconds. It was able to actually perform the
query to Google DNS. Able to retrieve all of
these records for us. They are records or premature
whose addresses are simply the public IP addresses.
Assigned to the. Do means we can
see the name suicide are also associated with
a do mean, we can also see the mule Silver's
on currently detected too, and we
can see, even do the whose name's look really similar,
but it's actually two different IP addresses for the
motor to will attempt to perform Xoom transfer,
which is a vulnerable to talk to,
to retrieve various Zone,
records from a Target DNS server and
Diesel records may contain. Let's see
confidential private in
Nissan does regarding two assets networks,
even whose only to Northside of
analyzation at work.
In this way. Do you take a look at understanding the
fundamentals of osint, which is open source intelligence. I
have gained experience and Performing
open source intelligence using popular tubes.
In the next video will take a look up performing Network
on Port scanning for your husband, a
formative for you and I will see you in the next one.