And this video will see how we can get comprehensive DNA information about the target's website.
So just to give you a quick refresh on what the NSA is, so when you type in Facebook dot com at the
NSA server, we convert that name to an IP address.
Now, the process is a bit more complicated.
So the DNS server contains actually a number of records, each pointing to a different domain or TV
out or to a different IP, sometimes to the same IP.
So but in general, you request a domain name.
It gets converted to an IP address.
And depending on that, these information need to be stored somewhere.
So we're going to query this DNS server and see what information we can get through it.
Now we're going to use a website called Raptorex dot com, and I'm just going to put the target website
that I want to get information about.
So I'm going to type a security dot org and I'm going to hit enter to get a report.
Now, as you can see, we will get a big report, so there is a lot of information in here, but you
can actually use the buttons in here to navigate to any of the sections below.
So if you want to directly go to the records or to go to the CEO, all you have to do is just click
in here and you'll go directly to that section.
What we're going to do right now, though, will go over all the sections one by one and see what kind
of information we got.
Now, keep in mind, the order of this information might be different, but you should have the same
sections.
So in the analysis, you can see we have general information about the target, so you can see that
it's telling us that security has three name servers, five mail servers and one IP address.
We can see the name servers used by Security and Digital Ocean is the hosting company that security
is using at the time of recording this lecture.
So this is very, very useful because you can go to Digital Ocean right now.
You'll see the hosting company and then you can pretend to be them and communicate with a security,
telling them that you're signing them up for a better hosting.
You're giving them something because they are a VIP customer and ask them to log in.
Obviously, they'll be logging in to a fake login page and that way you'll steal their information.
You can tell them that there is a policy change that they have to accept and again, ask them to log
in and steal the information.
That way.
Obviously, you'll do this through a fake login page.
And this is mostly social engineering.
So it's nothing to do with website hacking.
And I cover all of this in my social engineering course.
But it's very useful because if you couldn't hack into the website through the applications installed,
then the only way to get in is using social engineering.
Now, below this, we can see that the target is using Google Mail servers, so they're not handling
their own emails.
They're using Google to handle their emails.
Again, you can communicate with the target, pretending to be Google and get them to do something or
to log into a fake page and steal information that way.
You can also see the IP address of this website, which can be used to discover other websites installed
on the same server.
And this is very, very useful because if you couldn't hack into your target's website through the applications
installed on that website, then you can try to hack into any website installed on the same server.
And if you manage to do that, then you can actually navigate to your target website because they're
all essentially installed on the same computer.
And we'll talk more about that in the next lecture.
And below, right here, we have a number of similar domains to our target.
Now, these might be completely irrelevant, but you can have a look and see what you have.
Navigating to the quick info again, you can see the domain name.
You can see the Tildy, we have the IP address, the name servers.
Again, like I said, they're useful because they usually give us information about the domain hosting
company or the hosting company hosting the website itself.
And we also have the email servers like we've seen before.
It's Google Mail so that all can be really, really useful.
The reverse section will perform reverse DNS lookup, so as I said at the start of the lecture, DNS
is used to translate domain names into IP addresses in a reverse lookup.
We use the IP address to see which domains linked to this IP address.
And like I said previously, this can be very, very useful because we will be able to discover other
websites hosted on the same server and we can hack into any of these websites and from there gain access
to our target.
But with the reverse lookup, you won't always get all the websites installed on the same server.
Therefore, in the next lecture, I will show you a better way of doing that.
But if you really want to see the results of the reverse lookup, you'll have to log in.
So I'm actually going to open a new tab.
I'm going to go to optics again.
And I'm going to click on Log in right here and the only way to log in to uptakes right now is through
Google.
So I'm going to click on Google.
I'm going to click my email.
And that's it, we are logged in, so I'm going to close this and we're going to refresh in here.
And if we scroll down again to the reverse right here, we have the results of the reverse look up and
you can either download this as ESV or view it as the HTML.
So I'm going to choose to view it as HTML and a new tab.
And right here, as you can see, we only have that security on its own because that security is hosted
on its own server, so there are no other websites installed on the same server.
But like I said, if there are other websites hosted on the same server, then you'll be able to see
them in here in the reverse lookup.
Now going down, we can see a more detailed breakdown of the DNS records, so you can see here we have
information about the record and this is the record that's used to translate the domain name into an
IP address.
So you can see that a security dot org links to this IP address, which is the IP address of the server
hosting or containing the files of the website.
Scrolling down, we have more CEO information, search engine optimization info.
We have the word trust, the reputation of this website.
We have the Aleksa ranking.
In the short time we have the IP of the Target website, again, like I said, we can use this to get
websites installed on the same server.
We have a graphic representation of all the information we gathered.
We also have a history section.
This is actually very, very useful because you can use this to track all the changes to the DNS info
of the Target website.
So you can see when they started using Google, you can see when they started using digital ocean as
their hosting provider.
So if you scroll down.
We might actually be able to see that they were using a different provider and here you go, we can
see that they were using a different hosting company.
This one right here, the more thing I hope I'm pronouncing that right.
But right now, as we can see, they changed and they switched to a different hosting company, Digital
Ocean.
So, again, you can even contact them pretending to be this company and tell them that you're going
to sign them up for a better offer or pretend that they violated one of your terms and conditions and
ask them to log in to do something.
Once they log in, you can serve them a fake, file a backdoor, or again, use the login information,
get them to log in through a fake Web page and steal the username and password.
So information is always very, very useful when it comes to hacking, especially if you want to perform
a social engineering attack, which might be your last resort if you could not hack into the website
using the applications installed on it.
Scrolling down, we can see we have the whose information we had a full lecture on how to get this and
how this can be useful.
And finally, we have the DNS block information, which basically is a list of websites known to send
spam.
So usually emails sent from these websites would be blocked or considered spam.
So, as you can see, a very useful Web site that can be used to get information about the server used
to host the Target website and its relationship with other websites, other servers which hosting companies
are being used.
And like I said, all of this can be very, very useful, whether you want to target the website itself,
whether you want to target other websites so you can hack into your target website.
And even if you want to social engineer one of the admins to gain access to your target website.