Hey there.
Welcome to the course, Reconnaissance with Sn1per.
In this course,
we'll talk about one of the most complete
information gathering tools in the market,
and you'll learn how to automate your reconnaissance to save you a lot of time.
If you've worked in a red team engagement before or even in penetration testing,
you know that the first and most important step is to gather as
much information as possible about our target.
Usually in a red team engagement, you need to gather the IP addresses,
DNS data, network information, people information,
open source intelligence, and much more. And trying to do this manually,
it is virtually impossible. It would take too long.
Usually, red team specialists have few tools to do this reconnaissance.
For example,
you can use Nmap to gather open ports or theHarvester to get email addresses.
But the problem is that you have to use several different tools,
and they always output in different formats.
And that's where Sn1per can help you.
Sn1per is a tool that does pretty much all the reconnaissance for you.
It uses the most well‑known tools in the market to gather all the information
you need for your red team engagement. With just one command, Sn1per will run
several of the reconnaissance tools in the background and it will output
everything in a format that is useful for you.
Pretty cool, right? In this course, you'll see how easy it is to
harvest tons of data with just one tool. The Sn1per tool is one of
the most used open source tools for reconnaissance. This tool was
developed by the XeroSecurity team.
They actually started this tool as an open source project,
and now they have some really interesting professional tools.
Personally,
I do recommend you checking out there website so then you
can see all the cool projects they have.
The Sn1per tool is the finest tool for discovering
attack surface and prioritizing risks.
Basically,
it automates the most common reconnaissance techniques and returns to you
all the information you need in one simplified format.
The best part about this tool is that it's free for the community.
You can download the source code in GitHub and start to play with it.
As I mentioned before,
Sn1per is one of the most complete tools for reconnaissance, and
that's because it leverages several really well‑known recon scripts,
like Nmap, theHarvester, WafW00f, and etc.
And this means that with just one command line,
you execute several really advanced recon techniques using
the latest open source tools in the market.
But one thing to note is that personally I recommend this
tool only if you already have some experience in red
teaming or penetration testing.
And the reason for that is that Sn1per generates a lot of
information and it might be overwhelming if you've never
used any recon tool before.
With Sn1per,
we can perform both passive and active information gathering.
Passive information gathering is when you gather data with
minimal interaction to your target.
For example, in a passive scan,
we do not perform any type of port scan or vulnerability scans.
In a passive information gathering, we usually gather data using
third‑party sources of information, such as WHOIS records,
DNS queries, open source intelligence searches,
social media searches,
search engine recon, and much more. And again, note that we
are not directly poking our victim domain.
We're basically collecting all the data that is available on the internet.
On the other hand, we have the active information gathering,
which means that we directly interact with our victim computer.
For example, in active information gathering,
we perform Nmap port scans, vulnerability scans,
web application probing, and much more.
One thing to note is that performing active information gathering might be
illegal if you don't have the proper authorization, so make sure you have a
formal document allowing you to do active information gathering. For passive
scans, we're just getting information from what is already available on the
internet, so this is usually fine.
If you're familiar with a red team kill chain,
we can map Sn1per to the recon phase of this process. The
Sn1per tool allows us to gather tons of technical and
nontechnical information about our target.
Also, if we map this course to the MITRE ATT&CK framework,
you'll note that we cover one main phase in here,
which is reconnaissance. Inside of reconnaissance,
we cover several techniques with the Sn1per tool,
such as active scanning, gather host information,
gathering network information, search technical databases,
search open source websites, and even gather identity information.
And in my opinion, that's the cool part about Sn1per.
While most of the tools only cover one or two techniques, in here, we
cover almost everything you need during the recon phase.
Okay, so enough of theory.
Let's talk about what we will see in our demos. In here, we'll perform
reconnaissance against two domains, globomantics.com and nasa.gov. On the
Globomantics domain, we'll use both active and passive techniques with
the intention of finding open ports, vulnerabilities,
DNS records,
IP ranges, and much more. On the nasa.gov domain, we'll use only passive
scans and also some open source intelligence research.
And the idea here is finding subdomains,
employee names, email addresses, and etc.
And note here that the Globomantics domain is a domain that I have
authorization to perform active scans, so then I can run vulnerability
scans and port scans. For the NASA domain, as we don't have permissions
for doing any vulnerability scans,
we only perform passive scans to gather data that is already available on the
internet. And, we'll not be poking the NASA website itself.
Instead,
we'll use the information from search engines and social
media to get all the information for us.
Remember,
you can only perform active scans if you have written authorization for that.
If you want to follow this demo on your own environment,
all you need is just your attacker machine. In here, I'm
using a Kali Linux virtual machine,
but you can actually use any Linux distribution you want.
So, if you're ready, let's go to our demo environment.