[MUSIC PLAYING]
Website Footprinting with Netcraft.
In this video, we're going to be taking a look at how
to utilize Netcraft to, essentially, enumerate
as much information as possible, passively, from a website.
So this will give us, Netcraft, essentially,
correlates all information.
Like the "who is" information.
It'll give you information regarding the SSL or TLS
certificate on the site.
What web technologies are being used on the site.
The name servers, all that good stuff.
So I'm going to be doing this on my Kali Linux VM
because we are going to be accessing the internet.
So you can follow along with this.
We're going to be doing this on my website.
Again, this is all passive, so it really
doesn't make a difference to me because this information is
already publicly available.
So I'll just switch over to my Kali Linux VM.
All right, so I'm back on my Kali Linux VM.
And I'm currently on the Netcraft website, here.
So Netcraft is a fairly simple service to understand.
It is, essentially, used to gather information
about a target domain.
And when you're talking about the domain itself,
it gives you information regarding the registrar,
the emails, the operating system or the web technologies that
are running on the website, et cetera.
So it's essentially collating all
of the information we were able to obtain manually
in the previous videos, which is really, really cool,
which is, again, why I wanted to showcase this.
So to, essentially, perform a check on a website,
just click on Services and Internet Data Mining
at the bottom.
You should be able to see a box, here.
An input box that allows you to check what a site is running.
So it's going to use results from Netcrafts internet
data mining database to find out the technologies
and the infrastructure of any site.
So you can type in the address, here.
In my case, I've already run a check on hackersploit.org,
so I'm just going to close that up here.
So let's go through the results.
So it's going to sort it out into various categories.
We have background, network, SSL TLS, and then, of course,
it'll perform a few vulnerabilities,
with regards to SSL and TLS.
It'll provide you with hosting history.
Let's see, we have web trackers, the site technology,
which is very, very important.
And yeah, that's pretty much it.
So as I've said, the information That's
important from the perspective of a penetration test
is going to be the network information,
but we can take a look at the background first.
So this will give you the site title, the website rank,
the description, when this website was first seen
and the primary language, which again, makes sense.
It'll then provide you with information regarding
the actual domain IP address.
So you can see the name server is Cloudflare.
The name server organization again,
is Cloudflare, which, again, makes sense.
Now, if you had not performed the previous checks
with the WHOIS lookups and the host commands,
then this could tell you what domain registrar
was used to register this particular domain.
And then, of course, you have the IP address of the website.
Now, of course, in this case, it's
going through Cloudflare, which means that this is not really
the IP address of the web server that is
being protected by Cloudflare, which is really, really cool.
And then, of course, it gives you
the actual top level domain, which in this case,
is the org DLD.
And then it'll tell you whether the site has any DNS
security extensions enabled.
fOR the IP address, it will give you the IP delegation.
So this is the primary IP, which as we
know from the previous videos, belongs to Cloudflare,
as it, again, highlights here.
So I'll tell you the name right over here
of each of the IP blocks.
And in specific, this particular IP,
which is owned by Cloudflare and it
does that for IPv6, you then have the SSL and TLS
certificate information.
This is very important because it can, essentially,
provide you with information regarding when
an SSL certificate expires.
It'll also tell you who it was issued by.
In this case, it is Cloudflare.
And in this case, it tells us that it expires
on the tenth of June, 2022.
So 11 months, four weeks, one day.
That's really weird, because it actually-- yeah,
so this is valid from the 11th of June,
2021 to this year on June the 10th.
So there we are.
That's the SSL DLS certificate information.
One thing that's really important, as I said
is, of course, the validity period.
And, of course, who is issued it.
And, of course, the issuer country, there.
In this case, it's still valid, which makes sense.
And then, of course, the Certificate of Transparency.
In this case, you can see that it provides you
with information regarding that there.
And then if this site is vulnerable to any SSL TLS
related vulnerabilities, it'll tell you that right over here.
So it's not vulnerable to SSL version 3 poodle,
or the poodle exploit.
And it's not vulnerable to the actual Heartbleed exploit.
So the site did not offer the Heartbleed TLS extension prior
to the Heartbleed disclosure.
And so was not exploitable.
You can learn more about these vulnerabilities
by clicking on these hyperlinked links here.
You can also click on the SSL certificate chain, which will,
essentially, give you information regarding
the-- as it says here--
the actual certificate chain.
Hosting history, this is very useful in getting
an idea as to what hosting providers
we use to Host this website.
Now as I said, in my case, this is a site
that goes through Cloudflare, which means that information
will be redacted.
And then, of course, you have the sender policy framework
here.
And then, of course, we have web trackers.
This is very important because it tells you
what analytics systems or what trackers are currently
active on the site.
In this case, you can see that we
have Google Analytics and WordPress
analytics enabled here.
And we then have the site technology profiler,
which tells you what--
in this case-- the proxy server that's being used,
which is Cloudflare.
On the service side, what web technologies are running?
We can see we have PHP, XML, SSL,
and we know that PHP is enabled on the client-side.
Of course, we have JavaScript and yeah,
that's pretty much it.
We then have the client-side scripting frameworks,
which is jQuery and Google hosted libraries for fonts.
In this case, it's the Google API
used to retrieve JavaScript libraries.
And then the advertising networks, in this case,
it's AdSense.
And the blog, which tells us that it's running WordPress,
which is really, really cool.
And then, of course, under PHP application,
it will tell you what application is running.
So you can see that is running WordPress and WordPress is
a PHP application that runs on a LAMP stack, which, again, tells
us as a fact that this website also utilizes a database.
Now whether this database is being run or being hosted
on another server is a different question,
but we know it's either going to be MySQL or MariaDB.
We can see that RSS is also enabled,
which is also very interesting.
And then, of course, let's see the other important information
here, that we are HTML5.
So you can see that, in this case,
HTML5 is indeed being used for mobile optimization.
So the reason I wanted to cover Netcraft
is because it sort of collates all of the information
that we've been able to identify previously
or in previous videos.
And it gives you in a very simple, easy to consume,
easy to understand format.
So do take a look at Netcraft.
As I said, you can perform a lookup on another site.
So I can perform another lookup on maybe a site that I own,
like hackertube.net, and let's see how this is different.
So I'm just going to run the lookup here.
And you'll actually see the differences between the two.
They both go through a web application firewall.
In the case of hackertube.net, it
goes through an actual web application firewall.
So we'll give this a couple of seconds
and you'll see the differences.
So in this case, you can see that the actual hosting
company is GoDaddy, or the actual registrar is GoDaddy.
It goes through the actual security firewall.
So that's identifiable via the actual name server.
The domain registrar is namecheap,
so we now know that this domain was registered with namecheap.
And then, of course, the reverse DNS lookup points
towards the following cloud proxy security domain there.
As for the IP delegation, you can
see all of the IP addresses owned by SUCURI, which makes
sense, apologies for that.
And of course, you also have the SSL certificate information,
which tells you when it's going to expire.
And of course, who it was issued by.
In this case, it's issued by Starfield Technologies.
And I'm looking for the actual--
let's see-- let's take a look at the actual technologies running
on the actual site.
So HTTP accelerator, we can see we have the SUCURI cloud proxy.
SUCURI is essentially a combined web application firewall
and a content delivery network provider.
We can see on the client-side is JavaScript.
Nothing regarding the actual server-side.
So we haven't been able to identify that, but yeah.
That is going to conclude the practical demonstration
side of this video.
All right, so that is how to perform website reconnaissance,
or website footprinting with Netcraft.
In the next video, we're going to be taking a look at how
to perform DNS reconnaissance, more specifically, passive
DNS reconnaissance.
So we're really just trying to identify the various DNS
records pertinent to a particular domain.
So I'll be seeing you in the next video.