Now there are a couple different ways that we can analyze and
look at data within Recon‑ng, one of them is using the show
command that we've already seen.
So if we know we've got credentials and we know we've got context,
we could just use the show command.
So if we look a show credentials and we see a listing of credentials in here.
Now, once again, this is an ASCII table so it's kind of ugly,
but we can still see some of the good stuff that was found here.
Notice towards the top,
we absolutely have a clear text password that was disclosed as a part of
the exploit.in dump for a user on pluralsight.com.
This is obviously someone that needs to be told they
need to change their password,
but I'm hoping that this is an old password and isn't relevant anymore,
but this is the type of information that we're looking for.
You'll notice here that we don't always have clear text,
sometimes we just have the hash.
Now, in this particular case that I have highlighted on the screen,
that's a bcrypt hash.
We're probably not going to be cracking that one
anytime soon, but this is a SHA1 hash,
and this is an MD5 hash and there is a really good chance that will
be able to reverse those hashes either using our own tracking rig or
by using other Recon‑ng modules that seek to do that using the power
of third‑party resources.
But this is ugly.
Let's look at some other ways to do it.
We could also provide this data using a db query command,
but once again, we're still just going to get the raw data sitting inside
of an ASCII table that's not real friendly to view.
So very similar output using the db query command. There
must be something better and there is. Recon‑ng comes with
another tool called Recon‑web.
In order to access it, though,
we must invoke Recon‑ng a different way using a different command.
So I'm going to go ahead and exit out of Recon‑ng and clear up the terminal.
This separate command, once again, has its own Docker
command that I have created an alias for,
so you'll probably want to do that too and it's simply recon‑web.
So if we do Recon‑web,
we'll look at the help that comes along with that particular command.
You'll see that you can invoke it a couple different ways or there is a
couple different arguments that you can provide, one being the host and
another one being the port.
Now our Docker command is going to tell it to bind to Port 5000 and
that's already done, so we're good there. But as far as the host goes
because we're running in Docker and it, by default, binds the localhost,
we need to give it direction to bind to all IPs on the local system so
that our browser can find it.
So we'll do recon‑web ‑‑host 0.0.0.0 and then we'll access the web
application by going to the localhost on Port 5000, and we should now be
able to access the Recon‑web interface. Localhost: 5000 and here we are
looking at the Recon‑web interface.
So there is not much to see here right now.
In fact, it says bunch of zeros, but we know that's not true.
Well, that's because the default workspace that it uses is default.
So we need to click the workspace here and select our Pluralsight workspace,
and now we can see that we have a lot more information.
There is our contacts, there is our credentials, net blocks, so on and so forth.
So the next step here is we can begin to whittle down to
the information we're looking for.
So let's say we want to look at credentials.
Once we click on the credentials table, the interface populates,
and we see now fields available there,
ways to export it, and the actual data itself.
Well,
let's say we only want to see the username, and the password, and the
hash, and we're not interested in the rest of this stuff.
We can unselect those and filter,
and then the data that we want is presented to us.
Then we can choose to export it and there is multiple ways that you can
export it. We can export it to a CSV file, we can export it to a JSON file,
we can export it to a straight up list, we can export it to an XML file, or
we can export it to Excel spreadsheet,
which is really handy for many playing data outside of Recon‑web itself.
So there are a lot of options for exporting that data.
Well, what if you just want everything. Well, it would be
kind of cumbersome to select the table,
filter out what you want, and export it individually.
Don't need to do that.
There is an option at the top to export the entire database to an XLSX file
and you could do that by simply clicking that button.
And then you'll have your entire database for that particular workspace
exported to an Excel spreadsheet that you could then manipulate and
share outside of the Recon‑ng environment.
So as you can see,
Recon‑web is super helpful for both analyzing data and for exporting it
for further analysis and consumption by other tools.