[AUDIO LOGO]
Leaked password databases.
In this video, we're going to be exploring
the process of utilizing free publicly available leaked
password data databases online to essentially try
and find or identify whether the emails, the email addresses
we've identified in the previous video
have essentially suffered from a potential data
breach on a website that the owner of the email
had registered on.
And the objective here, as I mentioned
in the previous video, is to essentially try and find
whether the owner of the email address has, as I said,
experienced a data breach.
And if so, we'll actually obtain that password that
was leaked during the data breach,
and we can then try and utilize that password
to perform a password spray attack.
Now, we're not going to be doing that in this video
because we're still in the passive information gathering
phase of this course.
So let's get started again.
I'm just going to be using my Kali Linux VM.
So I'm just going to switch over really, really quickly.
All right, so I'm back on my Kali Linux VM,
and the site that I'm going to be utilizing
for this demonstration is a very popular site
called haveibeenppwned.com, or simply put, have I been pwned?
Now, have I been pwned is a really cool site
because it essentially aggregates whatever
data breach happens on in the world on some
of the most popular websites in the world like Facebook,
Google, really any website that has a data breach.
These guys, more specifically Troy Hunt, the individual
that set up this website, aggregates
that database and allows users, anyone in the world,
to essentially check and see whether their email address
or phone number has been leaked in a data breach, which
is very, very common.
And one of the most important things that you need to know
is most users don't really know if their accounts
or their email has been leaked or the email and password
has been leaked as part of a data breach.
Now, why am I referring you to this?
You might be saying, well, do I check my own emails?
Well, you can do that.
In fact, I do recommend that you do that because you might find
that your email and password has been leaked as part of a data
breach on a site that you had registered on,
and you may still be using that password.
And the worst part about it is that hackers have access
to this just like anyone else.
Now, in the context of a penetration tester,
in the previous video, we took a look at how to enumerate
or how to harvest email addresses
using publicly available resources or databases.
If we were targeting an organization
and we found employee email addresses,
we could essentially put them in here.
And if they were leaked within or as part of a data breach
and we were able to obtain a password,
then we could use that password and perform a password spray
attack and try and log in to Google
with that same email and password,
try and log into Facebook, Instagram, you get the idea.
It's really, really dangerous.
So again, I can just put in my own email here.
By the way, please don't send me any emails.
I probably won't respond to them on this email.
But you can see that no pwnage has
been found, which means all the sites that have registered on
with this email have not experienced a data breach.
And as a result, my passwords have not been leaked.
Now if we entered any other email address,
maybe pippa@zonetransfer.me, I doubt that has
been part of any data breach.
Let's just try and see that, zonetransfer.me.
There we are.
So you can see that works out just fine.
And again, all you need to do is put in the employee's email
address here.
And most likely if they've been using it for a long time,
they might have been part of a data breach.
And, of course, that will all tie into what sites
they registered on.
At the bottom here, you can see it has a summary of the largest
breaches.
And, of course, you can see we have
Facebook accounts, et cetera.
So you can click on that there.
And that'll give you more information regarding
that particular breach.
So in April 2021, a large data set
of over 500 million Facebook users
was made freely available for download,
encompassing approximately 20% of Facebook subscribers.
So the likelihood of an individual having their email
and password leaked as part of a data breach
is very, very common, unless your email is really new.
Like for some of my older emails,
they have been part of a breach.
And luckily for me, I do regularly check the site just
to make sure that I'm not using any of those passwords that
were part of the breach.
So I just wanted to share this resource with you.
As I said, this will tie-in to the previous video.
If you were able to identify employee emails for the target
site that you are targeting, then this
would be a great next step.
I would definitely recommend taking a look at this.
Not a lot of penetration testers do this.
But some of the experienced ones do it.
So definitely, do check this out.
Now have I been pwned the only place
you can get this information?
No.
But again, the great thing about this site
is you don't need to sign up.
They have an API.
And, of course, I would recommend donating to this site
because they really are doing the public a great service.
And as a penetration tester, they're also doing us a service
because they allow us to identify whether employees have
been laxed with their password security
or are not in compliance with the company's password security
policy.
And as we already know, it's a standard tendency
for individuals, just normal people to reuse passwords.
And that's really not a fault of their own.
Once they have a password, they tend to reuse it.
And if they have reused a password that
was part of a data breach on all of the sites that they use,
then all of those sites are in essence compromised
because all it takes is for one hacker or attacker
to target you, get your email.
They go to haveibeenpwned.com, get that password,
and then try and log into all of the sites you typically
have registered on.
So do take a look at have I been pwned?
As I said, I can't really showcase anything here
because that would be a breach of ethics
because if there was a password that was leaked here,
then that would not be a good thing.
So this was more of an informational video, where
I wanted to showcase this really, really
important resource.
With that being said, that's going
to conclude the practical demonstration
side of this video.
All right, so that concludes the passive information
gathering phase or section of this course.
In the next section, we're going to move on
to active information gathering.
So we'll take a look at how to perform a DNS zone transfer,
how to perform port scanning with Nmap.
And yeah, we're essentially just going
to take a look at how to utilize the information that we've
obtained to essentially learn more about the target or target
system.
And that, of course, will entail all techniques and tools
that actively engage or communicate
with the target system.
So I'll see you in the next video.