Last on our list of things to talk about are Google
engine hacks and some automation.
We'll begin with a couple of basic Google dorks and a quick
visit to the Google exploit database.
Then, we'll take a look at MetaGooFil, theHarvester,
and wrap things up with OWASP Amass.
Let's begin with Google dorks.
Google dorks are really nothing more than advanced searches
that you can create to find all sorts of documents and
information about your target.
The URL for the Exploit DB is https://exploit‑db.com/google‑hacking‑database.
This database is frequently updated and often includes searches that
help identify default installations of products,
which may use known credentials.
For example, here's an entry for WampServer,
which is a LAMP‑stack environment that it's meant
to run on desktops and laptops.
Finding this in the wild on an actual server means we may have found
an easy entry point into someone's environment,
as the credentials and security used by WampServer is documented and well known.
You can use the Exploit DB as a starting point, but then improve on the dork.
For example,
we previously identified that Pluralsight might have a
publicly‑facing remote desktop server that we may be able to
attack later on in the engagement.
Let's look for others.
First,
we can search Google dorks that somehow relate to the remote desktop protocol.
Once we find what we're looking for, we can look at the actual dork itself.
And if we run this dork as is,
it will return all of the instances of publicly available,
or I should say exploitable remote desktop instances.
We can tweak this query as well to tell Google to only
search within the Pluralsight domain, like this.
(Working) Okay, we're not getting any results other than ads,
so that's a good sign.
This means Pluralsight doesn't have any exposed RDP servers other
than what we previously identified using Shodan.
Using advanced search,
we can search for all types of files within the Pluralsight domain as well.
Here we're searching for Excel files, and when we hit the search,
there is one, an Author Invoice.
We would, of course, repeat this for all of the different types,
including PDF, Word, Excel, and other everyday formats.
Here's an alternate way to search for files.
The program is called Metagoofill,
and it's a great way to search for different types of documents.
We just spent a few minutes looking for Excel files using Google,
can automate that.
Simply specify the domain name, the limit on the number of documents to return,
the document types, and where we want to store them,
and Metagoofill will do the rest of the work.
The last parameter here creates a 10‑second pause between calls,
otherwise,
Google can block you if it sees too many requests coming from your IP address.
(Working) Some of the documents returned an HTTP 403 status code,
which means we're forbidden from accessing them,
but what Metagoofill was able to download is now in the plfiles folder.
Here we have an education‑grant PDF file and the
Author‑Invoice we previously found with Google.
TheHarvester is another interesting automation tool
that used to be more feature rich.
Recently, however, Google blocked some of its features,
and it's no longer able to search Google,
LinkedIn, and several other resources that utilized the Google API.
It's still useful, however, and it's easy to work with.
It is accessible from the terminal window,
and here we have a command that's telling theHarvester to use the
DuckDuckGo search engine and return a maximum of 100 results.
The context in which it performs the search is Pluralsight.com.
We can now collect these results and store them as part of our notes.
Let's perform another search, this time targeting DNSdumpster.
DNSdumpster is great at returning DNS information,
which provides us with a large landscape of
potential endpoints that we can target.
Another popular search to use is crt.sh,
which returns certificate information for the given domain name.
All useful information that we can potentially
leverage in future steps of the test.
A list of currently supported passive recon search engines is
available here on theHarvester GitHub page.
Note that theHarvester can also be used in active mode as well,
in which case it can be used to find DNS and subdomain information.
Similarly to theHarvester,
we can use the OWASP Amass to perform and gather additional intelligence.
The tool actually has a number of great features
that I encourage you to explore.
Today, I'll demonstrate just one of them.
Here we're telling Amass to passively enumerate DNS entries
for Pluralsight.com and cite the source,
which is where it found that particular DNS entry.
Amass, of course,
is quite powerful and can be used to further continue
enumeration in a more active approach, but I'll stop here.
As you can see,
it found a great deal of domains and subdomains
that use the word Pluralsight.com.
We would, of course,
capture all this information and store it within our notes for later review
to see what we can actually use here as an attack vector.
Overall,
this is just a handful of tools that provide value in
the passive reconnaissance space.
There are many tools and many ways of achieving the goal of identifying
and learning as much as possible about your target.
As a foundational step,
using this knowledge provides the attack surface for active reconnaissance,
which is your next phase, and, of course,
for exploitation, which is the phase after that.