Let's begin by trying to get a handle on the infrastructure
details used by our target by first looking over the job
postings found on LinkedIn and Indeed,
and then visiting shodan.io to see if we can better match the technical
stack we identify to the target's infrastructure.
Let's begin by examining the types of jobs that Pluralsight posts to LinkedIn.
This may provide us with a wealth of detail around the technical stack
that they use. Right off the bat we can see we have a Software
Architect role. Looking through this description,
we can see that they use JavaScript,
Python, and C#. They also use cloud and DevOps functionality.
Kafka is mentioned,
which is an open source messaging bus optimized for high volumes of
data, and they use RFCs, or remote function calls, which may be tied to
services and applications provided by SAP.
Now,
this doesn't exactly tell us which cloud service they use. Is it Azure or AWS?
Let's keep looking.
(Scrolling) So looking through the job postings here,
I don't really see anything else that gets me any more technical details,
so I'm going to switch over to Indeed. Here on Indeed,
we should technically find the same set of jobs and
probably no more new details,
but let's have a look anyway. Different platforms present things
differently, and so it helps to gather intel from multiple sources. Here we
have a Senior Training Architect, and AWS is listed. Now,
that could be because the role is going to be responsible for
helping create training content for AWS,
but it could also mean that they use AWS. We'll note this and validate
it later when we perform active recon. Looking through the rest of
Indeed doesn't give us anything else worthwhile,
but here's what we do know so far.
First,
Pluralsight hosts some or all of its infrastructure in a cloud
environment. That's probably not a stretch,
as many companies do that today,
but then we also know that they use JavaScript, Python, and C# as well.
We can assume that SQL Server is probably present because of C#, and we
can assume that products like business objects or the SAP CRM system
are being used with remote function calls.
Lastly,
we know that they're using Kafka, so we'll definitely check to see if
we can find where that's hosted and see if there are any
vulnerabilities that we can exploit there, assuming that Kafka is
even in scope for the test. We have a clue that AWS is used, and even
if that's for teaching purposes,
access to the AWS environment may let us pivot and access
something outside of that environment, so this is
definitely worth exploring further.
Okay, so where do we go from here?
Well,
the next step is Shodan. Shodan is a search engine for various types of
servers and is a very handy tool to identify platforms,
ports, and types of servers being used.
So searching for Pluralsight pulls up nine results.
We have several IP addresses, and it looks like much of what we find
here is protected by Cloudflare, so we know they use that. Now if
social engineering is in play, we may want to see if we can find
someone who has access to the Pluralsight Cloudflare account and see if
we can get their credentials.
Not an easy task,
but something we may want to consider when we get more
detail and start to look for attack vectors.
Some interesting finds here in the PORTS section,
for example,
port 3389 is the port for remote desktop, so that is definitely something
we want to check out further during the active phase.
Some of these other ports are also worth exploring.
Remember, though, right now we're only gathering intelligence in a
passive way. We're not interacting directly with any Pluralsight
property, so we are not going to visit these sites today. As far
as operating systems go,
we're probably running some flavor of Linux based on the fact that Apache is
showing up. We have Docker containers and an API here as well,
which is interesting.
We also have Microsoft Internet Information Server as well
and, of course, the Remote Desktop Protocol.
Okay,
so just in a few minutes of work we're able to identify quite a bit
about the Pluralsight environment and technical stack. While I would
spend several hours to a day on this alone,
even a short amount of time can easily yield valuable
information that may come in handy later on.