Hey there.
Welcome to the Technical Information Gathering with theHarvester.
I'm Ricardo.
I'm a cybersecurity consultant with years experience in the field.
In here you'll learn how to collect tons of valuable
information for your red team engagement.
So,
imagine that you just got assigned to red team engagement
against the globomantics.com company.
Your first step is getting information about your target.
So, did you know that you can actually gather tons of information about
your target just by doing some searches on the internet?
Yes, that's right.
Without sending a single packet to our target we can
gather tons of valuable information.
For example, we can use search engines such as Google,
Yahoo, and Bing to get information about Globomantics.
In just a few seconds we can do a few searches and find
subdomains that we could attack later.
Sometimes the main website of a company is really secure,
but their other systems may not be such as the email
server or the HR applications.
Also,
we can use the same search engines to find email
addresses related to this company.
As you may know,
Google indexes data from several websites so you can find email
addresses even if they're posted in a different website.
And more than that,
we can use those search engines to find sensitive files
that may be exposed to the public.
For example,
you may find metric diagrams or even database backups that may
be useful later in the red team engagement.
And also,
we can use sites such as LinkedIn to find more
information about the employees of a company.
In a few minutes we can quickly find the name of key people in the company,
which can be really useful for social engineering attacks.
And the best part about this is that we can search as much
as we want because it's not illegal to search data that is
exposed on the internet.
And also your target will never know that you're
searching for their information.
And if you want to get a little more invasive you can also do
some queries and scans against some of the Globomantics
servers that are internet facing.
For example,
you can do DNS queries and port scans to get more information about the servers.
As you can see,
there is a lot of user information that you can get from the internet.
All those queries and searches can be done manually; however,
it would take a lot of time to manually search for all that information.
For this reason we have theHarvester.
And with this tool we can automate all those searches
that I mentioned in the previous slide, which will save us a lot of time.
TheHarvester tool was originally published by Christian
Martorella from the Edge Security Group.
And this tool is currently maintained by a lot of people,
including Matthew Brown, Jay Townsend, Lee Baird,
and Janos Zold.
And thanks to those guys our life as a red team specialist is way easier.
By definition,
theHarvester is a tool for open source intelligence
gathering and also to help determine a company's external
threat landscape on the internet.
This tool gathers emails, names, subdomains,
IPs, URLs using multiple public data sources.
And in my opinion,
theHarvester is one of the most important tools during the
reconnaissance phase of a red team engagement.
What I love about theHarvester is that it is an open source tool,
and this means that we can download the source code from
GitHub and modify it as much as we want.
For example,
you can create your own search modules to find any
specific information you may want.
And another thing that I love about this tool is that it
comes preinstalled with Kali Linux.
So if you use this Linux distribution you are good to go.
And I like with theHarvester we can perform a lot of
non‑intrusive information gathering.
And this means that we can get tons of information
without even reaching our target server.
For example, we can get DNS names, IP addresses,
email addresses, LinkedIn profiles, and much more.
So, if you're familiar with the red team kill chain,
we can map theHarvester tool to the recon phase of this process.
In here,
we want to gather as much information as possible so we
can create a proper exploitation plan.
Also, if you're familiar with the MITRE PRE‑ATT&CK framework,
in this course we will cover two main areas.
The first one is the technical information gathering
in which you cover four techniques.
The first one is the T1250, which is determining domain and IP address space.
And we also cover the T1255,
which is discovering target logon in the email address format.
And then we cover the T1251,
which is obtaining domain and IP registration information and also the T1254,
which is conducting active scanning.
The second main theory for the MITRE PRE‑ATT&CK that we'll be covering is
the people information gathering, in which you'll be covering the
technique 1273, which is mining social media data.
And that's a lot of techniques, right? And that's the reason that I believe
that theHarvester is a really important tool because it allows us to discover a
lot of valuable information in just a few clicks.
So, before we go to the technical part of this course let's understand
what we'll be doing in our demos. We'll be using theHarvester tool to
gather information from all those data sources that we discussed in the
beginning of this module. In here we're interested in DNS records, IP
ranges, open ports, LinkedIn profiles, Twitter handles, and email
addresses. And that's pretty cool, right?
It is scary to think that just with one tool someone can get all
this information about a company. For this demo all we need is a
machine to run theHarvester. In my case,
I will be using my favorite Linux distribution,
which is the Kali Linux. In here.
I will be using the version 2020.2, but you can use any other version.
TheHarvester tool already comes preinstalled in any Kali Linux version.
Also, I do recommend you having your system up to date.
And for that you can run the commands apt‑get update and apt‑get
upgrade so then you have the latest Kali Linux version.
So enough of talking, let's go to our Kali Linux machine and see how
to gather some information about globomantics.com.