Now sometimes we'll run a module,
and the output of that module won't necessarily add new
pieces of information to a particular table,
even though it has the capability to do so.
An example of that would be this whois_miner module here,
who,
just by virtue of harvesting email addresses, actually has access to domains,
but because it doesn't know whether or not the email addresses coming back are
actually going to be associated with our target company, the developers chosen
do not add that particular piece of data to the database. But we know that
pluralsight.com is associated to the company that we're targeting, so we can
now go in and use those manual entry commands to add that data as new see data
to our database, and that's what we'll do now.
We'll use the same db insert command that we did before,
except this time we're going to add it to the Domains
table. It asks us for the domain.
We don't have any notes to provide it,
and we're good to go. If we do show domains, we now see that we have the
pluralsight.com domain added to the Domains table.
So now we've got some data to work with.
Let's go look at some more modules specifically for things that will be of
interest for us regarding the context that we've harvested.
Notice I'm using the contacts‑search in order to list only the
modules that transform contacts into something else.
There's some very interesting things here.
We can validate email addresses using something like mailtester.
We can create new email addresses based on names using
something like mangle. Or we can get names based on email
addresses using something like unmangle.
But something that really sticks out to me is this ability
to transform contacts into credentials. So I want to focus
on the scylla module here.
Let's go ahead and ask the marketplace to install scylla.
So we'll do marketplace install scylla. Notice that two
modules were installed. This is that smart‑installation,
smart‑loading feature at work here.
It noticed that there were two modules that had that text
match and installed them both for us.
So now we can use a module named scylla on both our contacts and our
domains to try to transform them into credentials. So now let's go ahead
and load this scylla module for our contacts information. Notice I tried
to do this smart‑loading again,
and it found that I have two modules installed that
have scylla in the title, and it said, Hey,
you can't do that.
Pick one of the other.
So in this particular case, I'm going to have to be a little bit more specific.
We've got Tab completion here, so that will work for us.
So we'll do modules load.
We'll start with recon,
start with contacts, and then very quickly, we get to a unique
module path, and it fills it out for us.
So let's go ahead and load this module.
Now let's look at what this module does as a whole.
What does this thing do here? It harvests credentials from scylla.sh API using
email addresses input. This looks like valuable information.
If I've pulled contacts from whois database, and I'm able to turn around
and find publicly disclosed credentials associated with that, then
there's a really good chance that I could use those two pieces of
information to gain access to some sort of system on the target network.
Some other options here by default,
this is going to pull back 100 results per page.
And, of course, the default source again is going to be the database,
which is exactly what we would expect.
So, once again, we don't have to make any configuration here.
We can just run the module as is. Well, unfortunately,
none of the credentials that we currently have have any
disclosed credentials associated with them.
This is good news for Pluralsight, but we're not done yet.
We still have the other scylla module, which will actually take
the domain and try to harvest any credentials that are associated
with any email address within it.
So let's go ahead and load that one.
So modules load.
We'll see here that it's very similar in its configuration,
so there's not much for us to do here.
Now we're on the module. And as you can see here,
it found 38 total, 33 new contacts that we hadn't already
found and associated with Pluralsight,
and it found 38 total, 38 new credentials associated with
the contacts that we have harvested for Pluralsight. This
is really good information.
We obviously want to see this stuff.
So now let's look at analyzing this data and then potentially
exporting this data for use with other tools.