Email harvesting with theHarvester.
In this video, we're going to be exploring
the process of enumerating emails belonging
to a specific domain, which is, of course, your target
through the use of an opensource tool called theHarvester.
And, of course, theHarvester works quite similarly
to sublister, where it utilizes search engines and publicly
available databases to identify emails
that might have been leaked or that are available online.
So, again, we're not performing active information gathering.
This is all passive.
And all of this information is publicly accessible.
So, again, we're going to be doing this from Kali Linux.
And, in my case, I'll be doing it from my Kali Linux VM.
And, of course, you can follow along if you want to.
So I'm just going to switch over to my Kali Linux VM really
quickly.
All right, so I'm back on my Kali Linus VM.
And I'm currently on theHarvester GitHub repository.
As I said, it's opensource.
And it's freely available.
It really, really is a very cool, very powerful tool.
As it says right over here in the About section,
theHarvester is a very simple to use, yet,
powerful, and effective tool designed
to be used in the early stages of a penetration test
or red team engagement, i.e., information
gathering or reconnaissance.
You can use it for opensource intelligence, also known
as OSINT, gathering to help determine a company's
external threat landscape on the internet.
The tool gathers emails, names, subdomains, IPs, and URLs
using multiple public data sources
that include the following.
So it uses the Anubis database, Baidu--
Baidu is a Chinese search engine--
Bing, Bing API, Censys.
You do require an API key to use Censys.
Although, that's really not required.
It also utilizes crtsh, which is the Komodo certificate search,
DNS dumpster.
And, in the case of email addresses,
it'll search on-- it'll essentially
search for exposed email addresses on sites
like LinkedIn, so your typical social media
or social networking sites.
So LinkedIn is one that is very important.
Why is that important?
Well, if we are searching for employee email addresses that
belong to a particular domain, that information
is really only linked in one area, typically.
And that is LinkedIn because individuals usually
post or specify what company they
are working for on LinkedIn.
And, of course, there's a couple of other search engines
and databases that it uses.
It also utilizes sublister for subdomain enumeration, which
we've already explored, Twitter, VirusTotal, Yahoo,
and, of course, Google, and a plethora of other search
engines and public databases that
contain data that could be potentially
useful in this case.
So theHarvester comes prepackaged with Kali Linux.
Although, you can install it, if you want to,
or install the latest version.
As I said, one thing that I wanted to point out
is the functionality that theHarvester offers
is broken down into passive info gathering and, of course,
active.
We are primarily focused on passive.
So to use the tool, it's fairly simple.
I'm just going to open up a terminal.
And we can type in theHarvester.
There we are.
And using it is fairly simple.
We can specify the domain name and then the source.
The source allows us to specify the search engine.
So let's perform a few checks.
So I'm going to say theHarvester and the domain
hackersploit.org.
And let's see I'm looking for email addresses.
So I can say limit this to Google.
And we can say LinkedIn.
So I'll hit Enter.
It's going to search on Google and on LinkedIn.
And it's going to bring back names, email addresses,
and subdomains, if it does find them.
As you can see, it's utilizing the sublist of functionality
here because it's incorporated into this particular script.
So we'll give this a couple of seconds.
I have switched, or I am using a VPN server or a VPN,
if you will, primarily because I've been running
a lot of Google searches today.
And Google is going to get really suspicious if I continue
performing quite a few Google searches as we
did in the previous video.
It's now going to search LinkedIn.
And let's see whether it brings anything interesting up.
Now, remember I'm searching.
My target is a domain name.
I can also specify a company name, which
I'll show you in a second.
So I'm just going to wait for this to complete.
All right, so you can see the harvest is done.
And it tells us that no users were found on LinkedIn,
no IPs found, no emails found, no hosts found.
Now, that could be down to the fact
that we're specifying our target as a domain
and also because we limited it to two search engines
or, really, a search engine and a social network.
So what I can do is I can just get rid of the domain option.
And we can specify the company name as the target.
And, in this case, I believe we actually can specify it.
Can we specify that?
I believe we still need to specify this as the domain.
Let's see if that works out.
There we are.
So the target is hackersploit.
It's now going to search on Google
and then, of course, on LinkedIn.
And I'll also get rid of the search engine
option or the specification, so that we can run it on all.
And, of course, in the case of hackersploit,
it looks like I've done a good job
with sort of obfuscating subdomains, names,
and, of course, emails.
But that's something that we will actually
see at the end of this.
So LinkedIn should be done.
And we should be able to see.
there we are.
So nothing with regards to hackersploit as a company name.
So I can say hackersploit.org.
And, when I don't specify a search engine,
you can see that that's what it--
if I don't specify a source, that's what it tells me.
So we can say Google, LinkedIn, Yahoo.
We can also specify DNS dumpster.
Another good site that we can-- another good source, rather,
that we can use is probably one that I
know works really well is, of course, DuckDuckGo and CRTSH.
CRTSH.
Let's try hacker target.
That's not really required at this point in time.
We can also try project discovery.
I think that also requires an API key.
We can try rapid DNS.
Remember, the objective of this particular video
is to enumerate emails.
But let's just run this.
And let's see what this brings up.
So I brought up rapid DNS.
There we are.
OK, so let's see whether we get any results here.
OK, now we're talking.
So it looks like, in this case, we
were not able to find any IPs.
But we did.
But no emails found.
But we found hosts.
So we found subdomains.
So this time around, it looked like it
worked for hackersploit.org.
So we have apps.community, cloud.hackersploit.org,
community.hackersploit.org, demo, forum, et cetera.
So, again, that's really not what we're interested in.
So we're going to now switch this over to another domain.
And, in this case, let's try zonetransfer.me.
All right?
And let's actually see what this looks like.
So let's see whether we're able to find any emails associated
with the domain zonetransfer.met.
All right, so it looks like we have much better luck
with zonetransfer.me.
No IPs found.
But we did find an email, so pippa@zonetransfer.me.
Now, as I said, the zonetransfer.me website
was essentially set up to teach students
how to essentially interact with the DNS server
and perform zone transfers, which we will be exploring.
But we do get an email.
Now, why is this information important?
Well, if you remember and go back to the introductory video
to this course, I mentioned in a simple scenario
that, when we find emails pertinent
to a particular target, the target could be a company.
It could be a domain.
Then an attacker could use that to send a phishing email.
Or they could use it to send an email
with a malicious attachment that, when opened and executed
on a target system, could provide us with initial access.
So this is very, very important information.
Under the host, you can see we found a couple of subdomains.
So you can see we have contact, DC office,
and, of course, INT NS1.
So very good success there.
The final site I'm going to try it on is, of course, INE.com.
I expect a lot of success with this one.
But we can actually see what comes up.
And, by the way, all of this information
that we're gathering will tie into the next video.
The next video will be taking a look at leaked password
databases and how we can potentially find passwords
for specific emails or passwords linked to specific emails
that can then be used to perform a password spray attack.
A password spray attack--
while this is actually performing the actual search--
a password spray attack is when you
identify a password for a particular email for one site.
So let's say I have found a password
for a particular email, let's say, for Facebook.com.
Well, many users tend to reuse passwords for different sites.
So I can put-- that's essentially what
a password spray attack is.
It's where I use the password I got from one site,
and I try and authenticate with other services
like maybe Gmail or maybe QuickBooks,
for example, as I have done before
with previous engagements.
And it has actually worked quite well.
So this, all of the emails we find here
or that you typically find when performing email harvesting
will tie in to the next video, which is, again,
going to be really interesting.
We'll actually see what we're able to find.
Now, you might be thinking to yourself, well, Alexis,
you're showing us all of this stuff.
Isn't any of this illegal?
Well, as I said, all of this is available on the internet.
Now, it's what we do with this information that might become
or might get into the territory of being illegal,
which is why I have separated the activity that you typically
perform in passive information gathering
from the actual active information gathering, which
does require authorization.
So, again, as a penetration tester,
ensure that you abide by a code of ethics
when it comes down to public--
to sites that are available on the internet.
So you can see these are all the subdomains for INE.
No emails were found, which is very, very interesting.
But I guess we can add a couple of more sources.
But you get the idea. theHarvester
is extremely comprehensive because it
not only performs email harvesting
but also subdomain enumeration.
And you can probably fine tune your searches
and limit them to particular sources.
One really cool one that I would recommend checking out
is the Spyse integration.
This requires an API key.
The Spyse search engine is a search engine
built for penetration testers for essentially performing
passive reconnaissance of a target like a website or an IP
address.
But it does require a subscription, which
is why I'm not covering it.
But if you are getting into penetration testing,
do check out Spyse, as it really is very, very useful.
Yeah, OK, so I think that's going
to conclude the practical demonstration
side of this video.
In the next video, we're going to be
taking a look at leaked password databases that
are freely available online that can
be used to identify whether a specific email
or a specific user's password has been leaked previously
during a data breach.
So I'll be seeing you in the next video.