Hey everybody welcome to the next video.
In this we're going to be talking about net craft so similar to showdown in Google.
Net craft provides a unique aspect to searching now that craft tends to keep track of sites what you
are or what the IP was at any given time.
If if it's changed what the web server was running such as if it was running Apache or especially if
it's a specialized engine that's known about it will go ahead and use that if it's an Apache traffic
server.
It'll tell you it'll say 80 Yes.
So we're gonna go over how to how to look at this.
Now what I want you to understand is if we do Red Team nation dot com and we look at this there isn't
going to be a result.
Now what's important here is that you understand that new sites may not have made it into net craft
yet.
However once they start being indexed into Google they start end up ending and net craft.
So again you've got a net craft dot com which the links above the video you'll see what's this site
running at the far right.
Don't use the search on the top right.
Very very top right in the middle right.
Use what's this site running.
So let's do one that we we know has been around a while so we'll do a Google dot com.
So what this is going to do at first is it's going to show you all of the domains so whether it's w
w w dot or dry feed proxy maps.
And again these pages go on and on and on.
Right so let's say we want to look at the main one.
Right.
So this was first seen November 1998 in the net block is Google Inc.
So if you look at the net block this might give us more information on what ranges we have.
So if we look here so in this net block owned by Google we've got quite a few in here we can see in
there their IP space that they own.
So it says for example YouTube's front end proxy which is the web server so we can see here this is
telling us the web server.
So Google's web service the Google front and YouTube front and if it's unknown it's unknown.
So it gives you an idea of what you can quickly look at.
But let's look at the site report for the original Google dot com which is still the one being used
now.
So we can see here that our hosting history we've seen that it was Google's web service the OS is unknown
at this point in time.
Or at that point in time then we have the IP addresses that it resolved to over the years.
So we can see this is the last last seen.
So you can reverse this and get the the oldest one if we wanted to.
But these are just showing it that it's changing its IP over time.
Now let's provide some who is information like we've seen before such as the name server the hosting
company the organization that owns it the IP 6 address the IP address itself.
So we can go to virus total and see if there's been any malware found on the site specifically.
This isn't relevant for Google but in some other smaller sites it might have been that might be an issue.
So if we scroll down here we could see a little bit more information tells us whether some headers are
set.
So it's just some good information overall.
But if we look here we get a general idea that there's that net Kraft is assuming this is a Linux machine.
And in most cases it's going to be at least for enterprise a larger enterprise.
But let's look at Facebook dot com right so if we go and see here we see Facebook.
So it says it found a Linux one once and it's not unknown the rest.
So edge network service FTD is the net block that we're looking at and let's see here we've got again
the registrars different.
We can see here web traffic traffickers companies in the CDM and tracker for CDM and so gives us some
information that might be useful for us in the future now.
A lot of this is going to be just a recap of information.
But knowing what IP addresses are being set to the main site or for any target over the course of time
might give you an idea.
So maybe this IP address isn't being used right now because it's being taken around for maintenance
or whether it may be.
They're hosting something else on it at the point in time.
You never know what IP is going to be doing at a certain time when it's not the main site.
Now it very well may just redirect to the main site and it looks like based on this that every now and
then they start flipping the IP based on the IP they're probably in different zones so they're switching
it from one main data center to another which is pretty common.
However you might see some one random IP that they set it to which might have been a you know an off
site where it has some older software so maybe there's been some vulnerabilities reported that work
fixed there on the off site that they are fixed on the main site and they only had that IP is the off
site temporarily for some let's say issue that exposed that IP.
So now when you go over there you might get the same Facebook.
In this case but you're going to be running older code now it's not going to be as common to find something
like that but that just gives you an idea of how far you can really stretch certain things when you
start doing passive recon you can kind of start putting things together what may have happened what
might not have.
And when you go into the active side where you find all this information such as a random stray IP you
can go to it with approval obviously.
This is assuming we have scope and everything.
But for me personally for Facebook I don't have any scope or any authority to start doing active recon
on this host.
So in this case I'm going to leave it alone.
But if you have if you're working for your organization and you saw them bounce it to a different machine
on a different network or a different data center and you have the authority it's inside of scope there's
no reason to not go for it just to see what it is.
Port scan it whatever the case might be.
So what I'm doing here for passive because I want to show you guys that there's a lot of different tools
out there that you can use and this course is not going to show you every possible tool.
But I want you get an idea of some tool show specific information while others show more others show
less so for example who is just showed us basically this information here.
However we now have IP addresses over a history maybe there is some D Mark settings that were set.
There's performance graphs for the Web site so there's a lot of things that can be shown from one site
to another and showdown has different things such as ports and banners that you don't have to go grab
yourself.
So it's a good to use a combination of all these things to try to paint yourself a bigger picture and
a more detailed picture of the target before you actually going into active recon.