Welcome back to our lab environment.
Now,
let me show you how we can run stealthy scans and how we can
gather open source intelligence from our target.
The idea of a stealthy scan is only using passive information gathering,
meaning that we are not doing any kind of probing against our target.
We're not doing aggressive scans, neither vulnerability
scans. Basically, we're just gathering information that is
publicly available on the internet.
And because this is known invasive information gathering,
we can use some more interesting targets in this demo.
For example, let's say I want to get more information about the nasa.gov domain.
I can type sniper ‑t, and then our target domain. Now, to make
sure that this is a stealthy scan, I must use the flag ‑m and
then the option stealth, and this means that we are just doing
passive information gathering.
Also, since I want to perform some open source information gathering,
I use the flag ‑o to enable the whole scan and ‑re to enable the
recon mode. And once I run this, Sn1per will execute all the passive
scans in its library. And more than that,
they also try to get information from open source databases.
For example, information from LinkedIn,
Twitter, and other social medias. As you can see, this scan is still running
and you've already found a lot of interesting information.
For example, here we have a list of a lot of NASA employees. And again,
all of this is public information and Sn1per is just collecting that
information for us. As this might take a few minutes,
I'll speed up this video so we don't have to wait.
Then, the scan is now completed.
Now, let's go to the report folder and see what we have in there.
Remember, this reports folder can be accessed in this path here, user, share,
sniper, loot, workspace, and then nasa.gov. In here, there are two reports, and
that's because I ran a scan earlier today as a test.
So, let's open the latest report and take a look what is inside.
Perfect.
Take a look. There's a lot of information. And again,
we're not going to have time to go through every single detail.
But now, the interesting part here is that we have some old information.
For example,
we have here a list of all the employees that work for NASA, and
this information probably came from LinkedIn.
Also, we have a list of several NASA subdomains, and this
probably came from google searches.
Pretty cool, right? And again,
all this information is also stored in attacks format
instead of the workspace folder.
So if you want,
you can create custom scripts to automate even more your writing process.