Okay, let's talk a bit more about passive reconnaissance.
So what kind of details are we looking for when we talk about passive recon?
First, we are after as much company information as we can stand.
Some of it is just because we should understand as much as possible about
the offering of our clients and how they do business,
but ultimately, having this information may yield in some attack vectors for us.
Next, it's helpful for us to know who the employees are.
Sometimes that's because we're going to target them
in a social engineering attack,
but other reasons would include the fact that people tend to reuse passwords,
and if we get enough email addresses,
we may be able to find some of those passwords in other breaches.
We're also after infrastructure details,
and we want to learn as much about their stack as possible.
Things like servers and databases and applications that the company uses,
there may be vulnerabilities in their stack that are
unpatched and provide us a way in.
Domain and subdomain details are also important.
They can provide us with many servers to attack or look at during the
active recon phase and during the vulnerability assessment.
Lastly, what does Google know?
While I was never that lucky myself,
I've heard a story of how a CEO kept an Excel file of passwords,
bank accounts,
and other very sensitive details in an Excel file that he
stored as part of a WordPress site.
Thing that no one would find it,
he used the file much like you would a password manager,
but relied on the fact that no one would guess the path
and file name of where it's kept.
Of course, Google indexed the file,
and when the appropriate Google dork was used,
it coughed up enough detail about the organization,
its people,
and the CEO that the pen testers had everything they needed to breach
and assume full control over the infrastructure,
public website, and even remote servers.
Google can be quite powerful.
Okay, so where do we start?
There are so many tools out there that can help you
with open‑source intelligence.
The easiest way to get started is with Google and the exploit database.
Advanced searches in Google provide a vast amount of information,
and using the exploit database, we can customize what we search for.
LinkedIn and Indeed can be a great source of technical
stack details through company job postings,
and of course,
LinkedIn can also be helpful in gathering details
about the company and employees.
Hunter.io is great for gathering email information.
MxToolbox is great at identifying email servers, among other things.
DNSdumpster and crt.sh can be used to get a list of domain names,
subdomain names, and certificates issued to the company.
And shodan.io is great for helping pinpoint some
details about the infrastructure.
Next,
dehashed.com and haveibeenpwned.com are great resources to
take some of the gathered intelligence on users and look at
possible breached credentials.
Even if the breach credentials don't pan out and open a door for us,
we want to let the client know that certain passwords have
been compromised and should be changed.
Then there's the automation applications.
A lot of what I've been talking about so far require some manual work.
We are gathering data from various sources and putting it all together.
Some applications, such as the OSINT framework,
Maltego, theHarvester,
and Metagoofil are able to do the work for us and
return a unified set of results.
Additional tools in this category include SpiderFoot and OWASP Amass.
You should not discount simple search engine as a means
for gathering passive intelligence.
Google image search and the search engine called PimEyes
are a great way to help identify people,
buildings, and locations.
Yandex, a Russian search engine, can have a different view on the same data,
so always get their take on it.
JupyterPen is a free open‑source project that uses Jupyter
Notebooks to automate penetration testing.
Then there's Facebook, Instagram, and other social media.
Look over as much as possible.
It may not make perfect sense when you get the info,
but after you organize it and put it all into context,
it may reveal things that can help you on a pen test.
Lastly, I wanted to mention attack.mitre.org,
a massive knowledge base of various attack tactics
and techniques used by hackers.
Our goal as pen testers is to do what a real attacker would do,
so having this type of knowledge is very helpful.
There you'll find sections on reconnaissance,
which may give you more ways that you can passively and
actively gather information on your clients.
I also would like to mention the fact that Pluralsight
has an entire Red Team Tools path,
which includes details on using many of the tools that I just
briefly covered today and many of the ones that I barely even
mentioned, so check them out.