Instructor: As usual, the first thing that we do
before we start trying to exploit
or find any vulnerabilities,
we do information gathering,
so we try to gather as much information as possible
about the target.
Web applications are no different,
so we're going to start
by trying to get as much information as we can
about the target IP address,
the domain name info, the technologies used on the websites,
so what programming languages used,
what kind of server is installed on it,
what kind of database is being used.
We're going to gather information about the company,
the DNS records and we'll also see if we can find
any files that are not being listed
or any sub domains that are not visible to other people.
Now you can use any of the information gathering tools
that we used before.
For example, you can use Maltego
and just insert an entity, as a website.
And then start running actions to our transformers
just like we seen in the Maltego video.
I'm not gonna be explaining that
because it is exactly the same
as we did it with a normal person,
so I'm gonna be skipping through that.
You can also use Zenmap like we did before
or even Nexpose and test the infrastructure of the website
and see what information you can gather from that.
Again, I won't be going over that because we seen it.
There's no difference between a website or normal computer
as I said a website just another computer.
So what I'm gonna be focusing on
is technologies that you only see in websites
such as domain names, DNS records and stuff like that,
that you won't be able to use or we haven't seen before
in the previous videos.
So, the first thing that we're going to have a look on,
is Whois Lookup.
Whois Lookup is a protocol that's used
to find owners of internet resources.
For example, server, an IP address or domain.
So we're actually not hacking or doing anything,
we're literally just retrieving info from a database
that contains information about owners of stuff
on the internet.
So for example, when you sign up for a domain name,
if you wanted to register a domain name for yourself,
for example z.com, when I do that
I have to supply information about myself,
my address and then the name will be stored in my own name
and people can see that z owns this domain name.
So this is all we're going to do.
If you google Whois Lookup you'll see a lot of websites
providing the service,
so I'm using whois.domaintools.com,
and I'm just gonna put my target domain name,
and I'm just gonna use isecurity.org.
So as you can see very simple,
and we get a lot of information about our target website.
You'll see the email that you can use
to contact the domain name info,
usually you'll be able to see the address of the company
that has registered this domain name,
but we can see that this company is using privacy
on their domain so you can't really see the address,
but they're not using privacy,
you'll be able to see their address
and more information about the actual company.
You can see when the domain name was created,
you can see the IP address of isecurity.org,
so if you pinged this, you should get this IP address
and I'll show you.
If I do ping isecurity.org,
you'll see it's the same domain name here,
same IP address here sorry.
You can see the IP location, we can see the status
obviously it's active.
You can also access the history
but you need to register for that.
And obviously we can see the title here
and something that's very useful here,
we can see that it's using apache web server,
so this is a software that can be used as a web server,
and we can see that Isecurity uses this web server
and it's of version 2.2.31,
so again we can use this to find exploits,
we can see that it's using Unix,
the operating system of the website of the server
and it's using the following add-ons as well,
it's using mod ssl and open ssl.
Now right here, you can find more information
about the company who registered this domain,
so again Isecurity is using privacy
so you won't be able to see the address,
you can see that it's saying that the target person
is using a privacy protection.
But usually you'll be able to see phone numbers
and addresses of that company.
So as you can see very simple stuff
but it's very helpful in the long run
just to know what your target, what's their IP,
what services are they using,
we can also here actually I didn't show
you can see the name servers that are being used
and you can see that they are provided
by a company called dimnof.net.
Now if you go on dimnof,
you'll see that this is a hosting company.
So if we go on the english version,
that you'll see that this is a hosting company
and again you can even use this hosting company
and try to social engineer your way maybe
into hacking into your target, into Isecurity.