- [Instructor] Now, there are thousands of tools
for pen testing and hundreds of tools
for Passive Reconnaissance.
And as you know, you know, Passive Reconnaissance
involves attempting to gather information
about a victim using open source intelligence
and using public information on records
but not sending any packets to the actual victim, right?
We went over, you know, several tools before
but I'm gonna actually highlight a few
that you can actually take advantage of,
you know, from tools that are already
in Linux systems and windows systems
like NS lookup, the host command dig, right?
So you can actually use those DNS-based tools
to of course perform some type of
you know, a Passive Reconnaissance.
You can use Whois as well
and Whois actually now because of GDPR,
is been restricted in some environments, right?
But you know, again, you can probably
use with some limitations you know,
of course a tool as well.
You can also use a tools that are specialized,
like FOCA, FOCA stands for
Fingerprint Organizations with Collected Archives.
And is basically a tool that is designed
to find Meta data and hiding information in documents.
You can actually download these two
from the website that I'm actually,
or the github repository
that I'm highlighting in this screen.
There's another tool that is also very popular
for extracting exchangeable image file formats
or exif and the actual tool is called ExifTool, right?
And is actually a standard
or rather Exif is a standard that defines
the format of images, sound files
and all their other tags that are used
by digital equipment like cameras,
mobile phones and tablets.
Another tool that can be used to enumerate
DNS information about a given, you know,
victim is called theHarvester,
and actually provides a different
a query sources like Baidu, Google, LinkedIn
and PGP servers, Twitter and many others.
The harvester, it comes by default in Kali
and many other Penetration testing Linux distribution.
In this case actually I'm just using
theHarvester to show information about
the hacker.org domain using
all the different sources that are available.
Now another very popular tool
that I already covered
and it's actually I guess a tool and a service, right?
Is Shodan, and basically Shodan,
is an organization that continuously
scan the internet and basically saves the results
of those scans in a database.
And then you can actually query that database
or I mean search that database
on the UI as shown in here in the screen
that showed on dot IO.
But they also have an API,
an enterprise, you know, different axes
that you can actually perform, you know,
more sophisticated queries
and of course even automate some of these queries.
So again, you're not scanning a victim in this case,
Shodan is, and then what you do
is you actually searching the scan results
and you know, you can search for things like,
insecure protocols, like Telnet,
the smart install protocol that I mentioned to you before.
Also they have, you know, ways that they can
show insecure IOT devices, webcams,
and many other systems out there on the internet. Right?
So this is, you know, think about this,
is actually like taking
a selfie from the internet in, right?
And see what is actually exposed
out there without the need of you actually
running these scans yourself.
Now, another tool that I actually really like
is called Maltego.
It's actually one of the most popular tools
for Passive Reconnaissance.
They're actually a two versions of Maltego,
a community edition, which is the one
that I'm sharing in the screen.
And then the other one is a commercial version, right?
So there's a paid version for that.
Maltego organizes all the queries
within the tool and then in a thing called
the entity pallet.
Basically these entities or the type of test
or the type of elements you can actually use
to test like a person you can actually
test against him, you know, website
and organization and so on.
You can also integrate with many different
third party sources of information tools.
Things like Threat Grid,
Have I Been Pawned, Shodan,
that's I mentioned to you before
you can actually integrate it with Maltego
and actually run all those tests
and query those as sources as well, right?
And by the way actually the actual search options
and the test are actually called transforms.
Another tool that can be used
to automate the information gathering
of you know, in Passive Reconnaissance
or gathering OSINT
or Open Source Intelligence Information
is called Recon-ng.
And basically this is a tool,
It comes with many different
Penetration testing distributions.
Is very popular there and also can be integrated
with other sources like Shodan
and Twitter, Google, LinkedIn,
many other you know, social media sites as well.
Another tool that can be used
for Passive Reconnaissance to find information
about devices and networks on the internet
Is called Censys, and Censys can actually
be accessed as Censys.io
as I'm actually showing the screen.
And they also provide a free web and API access plan
that basically, I mean of course they limit
the number of queries and you can actually pay for,
you know, allowing you to do other
more sophisticated queries
and of course getting more results.
Now let's go over some tools for Active Reconnaissance.
And as you know, Active Reconnaissance
involve actively gathering information about a victim.
You search using tools that can be used
for numeration to see what protocols,
what ports, what vulnerabilities actually are in the system.
So in this case actually you are actively
sending some packets and interacting
with the victim system
or their organization or the network.
Now we already went over many of these tools, right?
The one that you actually
have to really know for the exam
and as my fact is actually just a pretty versatile,
a port scanner is Nmap, right?
And we actually discuss Nmap in detail before.
So this is kind of a refresher
and also I want to actually highlight to you
a lot of the other resources
that I actually have in the gitub repository
related to, you know, all the different options
for Nmap and different exercises
you can actually complete using Nmap
and you know, using that for port enumeration
and system, you know, scanning
as well as actually taking advantage
of the Nmap scripting engine.
Now, another tool that you already learned about
is called enum4linux,
and it's actually a great tool
for enumerating SMB shares
and also vulnerable Samba implementations
and corresponding users.