Hello everyone.
This is either from a degree and in this lecture we will talk about passive information gathering now
when it comes to passive it means that you are not going to interact directly with the target.
For example our target in this case is a degree dot or D.
So we will not go and interact with the target.
We will not use some scanner or we will not go ahead and try to attack the website directly.
We will just see the publicly available data.
That is like the open source data.
The first thing you always want to go ahead and do is just go ahead and see the website here.
So you just go on the Web site and you tried to see what kind of information do you get.
So for example now this is the Web site.
Currently it looks like this and there are so many courses here.
But if I just try to see teach online but teach it also seems like they're using teachable to host their
courses the platform here is teachable.
So this information I just got by viewing the Web site not even interacting it not even attacking it.
I just get a very important piece of information like what is the software being used here and then
the second thing is that you want to check the IP address of the Web site which you can obviously go
ahead and bing.
So simply just go in and say API and G degree dot or G and here we just have the IP address of the Web
site.
Right now you can use this IP address to find more information which is publicly available.
Right.
There is one more thing you should always go ahead and do is build it be you I LTE w I.T. etch build
with that is a technology lookup Web site I will tell you which technology the Web site is using.
So when you go on the build with you enter the Web site it's set up degree dot or achieve you presenter
it'll show you each and everything.
Web site is using.
There is a detailed profile mental profile relationship profile reader profile and a basic kind of technology
profile which is like a short summary of this one so you can see they are using Google Analytics.
They are using Facebook signals fake like they're using the tracking available with Facebook Facebook
pixel tracking some of the metal tags from Google they're using the API firm filed code I'll turbo links
Google recap job for security they use photos awesome for icons they use Google Tag Manager they also
use angular for mobile the use some of the some of the kids from Apple development they use cloud front
to host their website and provide their provide their content which is from Amazon they use CloudFlare
to manage their CDM they use bootstrap seeding it probably means they are also using Bootstrap they
use Vista to provide web hosting they use teachable for content management and some other things like
Gee query exec tracks.
So just by searching one Web site on built with we got so much information and we haven't even interacted
with the target.
One more Web site which is into DNS into DNS and then slash and you see Web site.
So degree dot org you presenter it'll give you the whole list of DNS.
You don't even need to think the machine actually.
And it's shows that the DNS records are firm CloudFlare this and this IP address they have a problem
of recursive queries here which is marked with the which is marked with the exclamation sign.
These are information these are correct things and these are problems like they can be false positives
as well.
They have all these things up and running as a records for the website which are again from CloudFlare
and then you will go down and you will see they don't have a W W W record.
So that's one of the things I just got to know about the Web site.
Let me just prove this thing here.
You can go on w w w dot of degree dot org and because they don't have this record it will not work.
Let me try to press enter and it will not work.
I press enter and say seven on pound because they'd have not made it w w w record.
So that is how you gather a lot of information.
There is one more who is so who is look up is one of the important ones.
You just say Who is it is provided by a lot of people like the company called GoDaddy provides it who
is dot com domain tools dot com.
So you can choose any of these.
I'll just go with the WHO is dot com and I will go ahead and enter a degree here.
All right in this press enter and now it will show me the domain name registrar.
So the company will help them to register the domain name the owner maybe their phone number or something.
I can this click on who is and show me it was registered with name cheap and corporations which is a
very big company.
The domain expires on this date the domain transfer is prohibited then that name servers again and they
are using who is the guard which is a special kind of protection that is like hide your data so you
will not get information about this website for who.
However there are so many websites that do not to use this kind of service.
Who is guard or private registrations.
They do not use this kind of service and you can easily get information about those companies you can
get their phone numbers you can get their emails personal e-mails and a lot of information from voice.
So this was one more thing I just added in passive information gathering.
One last thing I want to add is the google docs.
So Google is very very good tool.
If you know how to use it for example instead of using up degree.
Let me just show you.
Google Doric for Microsoft.
I will say in text OK in text and column.
Now this is a Google Earth.
You can go on Google and you can just search Google Docs list and I'll give you a whole list of Google
Docs.
There's a special keyword indexed and whatever I enter now it will be in the text of that website.
I'll see passwords OK.
And I'll see inside and here I give it the insight.
Microsoft dot com.
All right.
PRESENTER And now it does going to show you all the pages from Microsoft dot com that contains the word
password.
So word password is there on these pages.
Another one which I want to show you like we can see
you can just go ahead and sit in title
in title and I would say help.
Now if the title of a certain page that has Microsoft dot com and there is a title.
This is the title that has help in it.
For example in this whole world there is only one page of Microsoft that contains hope board in Title
I believe as it shows me.
So then we'll come up with the results here.
There are so many Google Docs.
Let me just show you
Eskil injection is a very great one the community you can just go ahead and search and Google Google
docs were Eskil injection and it will show you the Google dork list.
So for example here is a list.
For example I copied this thing I search this thing on Google and let me just go ahead and see this
thing on Google now all these websites which you see here they are potentially vulnerable to a injection
attack that that seems crazy.
Yes.
You just found forty six billion websites that are vulnerable to Eskil injection attacks.
So potentially 46 billion you can just see inside.
Right.
And you can just give any site here like a degree dot org you can presenter and yeah google just comes
up with the recapture because it thinks I'm a robot.
I'm just making these kind of queries.
That's fine.
And now because I believe we didn't got any result so insight of degree dot org.
We have these kind of results.
That doesn't makes any sense.
Yeah.
We just forgot to press a space there.
That's why basically in this one because this is a Google as Gainesville.
We're combining two dorks.
That's why we're not getting the proper result.
Now there is no Web site.
Coming from a degree dot or otherwise that should be top result.
This just means that the degree dot org is not one do they will do a Haskell injection of this Google
Group which I just have right now this one view items BHP.
So this are you can use google docs you can use who is you can use built with you can use into DNS to
find out a lot of information about your target.
Is you do pass it information gathering in next lecture I will talk about how to do active information
gathering to then have a great day.