Now that we've explored the basic capabilities with SpiderFoot,
we will put those to use in a red team exercise scenario.
We'll initiate a scan using basic information about a target,
then we'll examine the information available from the scan.
In this demo, you are a red team operator.
The contract with the client has been signed and the rules
of engagement have been established.
You've been tasked with gathering OSINT on the target of the engagement.
You have been given the following information to start.
We know that SpiderFoot will start with an initial seed target
and gather related information from there.
We just have to choose the right starting point.
Let's start with a Globomantics Domain name.
At this point, we don't want to directly probe the site,
so we'll select the Passive use case.
This will take a while to gather everything, so let's skip ahead.
Now that we have a good starting point of information to review, let's dive in.
At this point, I might be interested in people associated with this organization.
We have the CEO's name, but who else?
SpiderFoot found some username information.
Let's look there first.
We have one person listed here a few times, along with an email address.
That could be useful.
SpiderFoot identified a physical address.
So this doesn't seem to match our target physical address.
Let's check.
We have an address in Utah.
SpiderFoot identified several Washington state addresses.
Let's see what organization they used to host their website or domain.
We can now see that they use Amazon Web Services.
We now know that the physical addresses found refer to AWS and not our target,
so let's mark those as false positives.
Let's go back and look at information on infrastructure.
SpiderFoot found information on IP addresses.
We have three unique IP addresses here.
However, we know that they use AWS, so these details may not be too helpful.
So that was just a sampling of the information SpiderFoot identified
with just a passive scan starting with a domain name.
If you recall, there was an IP address listed in the target.txt file.
This is a contrived example,
and you're unlikely to get a specific IP address this way.
You're more likely to get an IP address range or IP ranges to avoid.
However, we have an address.
Let's configure a scan for it.
Here we can see many of the same data types that we saw from the first scan.
We could export the data from both scans and do some
comparison in a spreadsheet tool, but let's look at some of the findings here.
Since this was an active approach for scanning,
we can see that SpiderFoot did a simple port scan of the target IP and
found two open TCP ports with SSH and a web server running.
It's an Apache web server running on Ubuntu, and it has a fairly old SSH server.
SpiderFoot will try to identify affiliated resources to the
seed target For affiliate IP addresses,
the default setting is to identify 10 IP addresses on each side
of the IP address provided or identified.
That's what we can see here.
Don't assume that these are definitely affiliated with our target.
There's a similar story with affiliated domain name.
These could be domains of unrelated organizations.
As you investigate more, mark this data as false positives if needed.
So after this demonstration,
I hope you can see the value that SpiderFoot provides for red team operations.