Hey everybody and welcome to the next video.
So we're going to be talking about job postings.
Now job postings at first glance might not seem like a good thing to look at.
However it can provide you a lot of useful information such as what what a company uses internally it
can provide you with some basic understanding of what type of architecture they went with based on the
services that they're saying are required for the job the the OS is that they're working with.
So what I want to do is take a quick look at some job descriptions.
Now I'm using two sites here which is Monster dot com and linked income.
Now LinkedIn is going to be your your quick his way because that's where most people are going to your
most enterprises are gonna publish right away.
However monster dot com is a good follow up right after that's good to check multiple sources.
You can even do indeed dot com and it doesn't matter any of any of them will work you'll tend to find
a varying variety of positions.
So what I want to do is take a quick look at what some of these job postings provide.
So right now I looked up systems administrator in San Jose California.
Now I'm using systems administrator because maybe it's a corporate engagement and I want to find out
what information or what services that they might be running right.
So let's look at Corso so make sure you're logged into LinkedIn.
So in this case I wasn't logged in so we'll let you view the site or the positions.
However once you're logged in and go ahead I recommend you making a LinkedIn account.
We're going to go over why this is important.
In the last module of the Red Team blueprint however feel free to make it now and start filling it out.
It's very very useful.
It's a good way to get opportunities to come to you instead of you having to go out and searching for
them.
So let's take a look here.
So let's see let's see Google has a systems administrator in their cloud operations right.
So let's see here we can see that they work with Linux or Unix and they tend to use Perl Python and
c they want developer.
So cloud native site reliability experience more specifically with Python and then Driver Driver coding
and see.
OK so it gives us a better idea so we could see here that they're gonna be managing G suite develop
and drive software automation.
We know they is a lot of automation there but a lot of this is self-explanatory.
Right.
Let's try to see if we get another one.
So let's look at senior at Apple so let's see they use Rel as their as their OS tells me that they're
using our PM and yum probably an internal repo that they're that they're using.
They work with 5 load balancer so that's good.
We know they used the N-word puppet so that gives us a better idea.
So they use Kickstart.
So I'm getting a better idea of what environment they're using there.
There's monitoring not CEOs.
So that gives me ideas on what gaps they might be using.
We know they're using Apache in my sequels so that brings me to kind of think about different lateral
movements I could do with with that Kickstarter is also pretty interesting as it allows you to build
machines on the fly.
That's always a good thing to take a look at.
So let's see here.
So they're using the lamp stack so.
Oh and Tomcat and mem cached.
So this gives us a better idea of what what they're providing and what they're using in their environment.
Now we can look at Monster dot com for example and look up.
You know I think it's credit unions so we can see here that they're using.
We know that they have firewalls IP US heads and virus and malware protection so we can keep an eye
on that.
So they do do mobile device management which is important because some companies do this some don't.
But now we know that they have something in place.
We know that they use Active Directory as villains and peons.
They use VM where exchange they have a secret cluster which is which is which is interesting.
So they have a Cisco USC and then we can kind of see some basic protocols that they might be using as
we know they're not going to be using FCP normally on the fly they're using SFP.
So you can see how this kind of builds up.
And also they've got PSTN VoIP gateways so you can take a lot of this and when you when you're looking
at a specific organization.
So in this case I'm just picking different ones based on what I'm looking for to show you an example.
But let's say we wanted to come into the company and we'll say let's look at Google specifically right
so if we looked at Google we can see let's forget the systems administrator.
We'll just search for everything from Google.
Right.
So they have a lot of jobs they've got 12 hundred plus jobs available but for other companies you might
not see this but you can kind of get an idea of where this particular company needs employees.
So we can see that there's a few security engineer jobs a lot of software a few Unix administrators
cite or liabilities some hardware.
So if you take a look at a good chunk of the jobs and in your engagement is focused on a certain aspect
or a certain area you can then look for job postings based on that and see if like let's say for an
example it's a 300 person company or a 200 person company and they've got five positions open for their
corporate security team.
Right.
So that tells me that they don't have a corporate security team right now they're hiring a lot of people
or they're trying to expand the few amount of people that they might have.
Now we don't know this for sure but we can make an assumption and that gives us a better idea that they're
probably lacking on some on corporate security more than they would be on the production side of things
or on the development side of things.
So bringing all this together with all the information that we found before gives us a much much bigger
look at the target and it gives us a better idea of what we can do when we start getting into active
reconnaissance which we will be in the next few videos we're going to be able to take all this information
and then make certain assumptions based on what how stealthy do we have to be.
Do we have to be stealthy at all.
So is that even in the scope is to.
Are you trying to be stealthy.
Doesn't matter.
So a lot of this stuff has has to take into play but it's important to understand what jobs are available
and what the technologies are.
So if you see for example they want on this case for software engineering they want a Java C++ in Python.
Chances are they use all of those languages internally.
So it's pretty you might find it pretty common to find a python interpreter on a machine or a go compiler
on there or GCSE for 4 C and C++.
You're going to find you're going to find that you you find a little bit more information when you're
looking at jobs versus just searching the site.
And we're going to be going over browsing the site when it gets to the active side which you may end
up seeing for example the job postings there which is which is great.
That gives sometimes they have better search features than some some other third parties but it's good
to keep in mind the job postings just so that when you have an idea of what they're kind of doing and
what they're using inside the environment.