Everybody welcome to the next video so we're going to be going over another search engine like Google.
But this one's a little bit more specific so we're gonna be going over something called showdown now.
This site does a lot of interesting things.
So when we go to active reconnaissance we're going to have a video on Banner grabbing.
Now what showdown does is it.
Actually we'll go out and grab the banners and the HDTV headers of the site for us without ever having
to make the request ourselves.
We're still makes this passive because we're not making the request.
Now do you URL is above the video.
So I want you to go there and register an account.
It's free.
It doesn't cost anything but you can't use filters until you have an account.
Now you can even generate an API key you can.
You can use code with this.
There's some tools that require an API key from showdown to do specific things.
But what I want to take away here is just a few key features because I want you guys to play around
with this a little bit on your own.
Now the search filter up here we can we can see on there our filter search our cheat sheet.
We've got org which we can do or Google which should give us all of the devices that are specific to
Google.
We can look at stuff on particular reports maybe the site or the state that they're coming from and
then the network address.
But we can also do something called host names as well.
So if we do hostname and then we do let's say Facebook dot com and we do let's say poor 443.
Right.
So we go ahead and search that.
This will show us all of the sites that are publicly available for Facebook dot com that have port forth
reopen.
Now we can see there's quite quite a list here.
Some important useful information is it comes with the headers so you can kind of get a better idea
of what's going on.
So if we do port 80 we're expecting to see a bunch of redirects which we do we see a three or two not
found in then it redirects to Facebook dot com with HD G.P.S. which is what you're going to probably
most commonly find but it's just useful information.
Now what I want to show you guys is that we can even search the spy network ranges so if we drop in
this network range which is Amazon's one of Amazon's network ranges this could be a target range that
you have set from your agreed upon goals and scope they might give you network ranges from the outside.
So doing this you can then quickly go through and get every.
For example in this case we're looking at Web requests.
So we're grabbing every web request from our Web site from this network range that we can find.
Now we can see here that top services HDP HDP s 70 P and DNS.
This is all great.
So the top products we've seen post fix Apache Tomcat and Jedi.
So it's like a tomcat.
So if we click on that we see that it says product Apache tomcat.
So now we've got all the services that have Apache Tomcat installed.
We could go through this and try to find out if they're using a default Tomcat password or so if it's
an older version.
But this is just a quick example of how you can gather a lot of information rapidly now you can even
search this based on a particular thing so if we want to do WordPress as an example this will load up
everything that they have showed and has as far to work presses so we can even go down to maybe we want
to look at let's see we want to look at Windows machines that are still say six point one that have
WordPress installed.
Maybe there's a particular exploit for Windows six point one versions of the OS that we want to deal
with.
So we're going to see here we have SMB SMB it already tells us authentication has been disabled so we
can have a little bit of information here so we can look at samba so we can quickly narrow this stuff
down without ever touching the machine so you can see here these are there might not be authentication
but we already know some of the network shares that are listed and available on this machine or shares
in General.
So we see public WordPress web.
So we're looking at for wordpress and we can find quite a bit of information here.
So what I want you guys to go through is grab a domain do a little bit of searching.
Again we're doing this passively.
We're not going out and actually touching a machine.
I don't want you to ever touch the machine don't visit the site even if it looks says authentication
is anonymous.
Chances are it's probably already been posted this point but what I want you to do is just do some searching
around a particular site see what you can find see what's available.
If you do end up finding something that looks very weird or it looks like this is obviously something
that somebody can attack.
It might be good to send an email to the owner of the domain just to say hey this is showing up for
you.
Go ahead and get it fixed but that's entirely up to you.
I don't want this to be done with any malicious intent.
Go out and just do searching passively on Showdown don't visit the sites.
Just make it passive.