- So what types of information can you find out
about a system or a network or a company
without actually attacking it, turns out a whole lot.
If you do any type of search engine searches,
you can find out information on other systems
that are available, or example if you do a Google search,
for a company, let's say they're called example.com.
If you use the site colon example.com search,
it'll show up anything for that website's domain.
Now most of the time you'll see something like,
www.example.com other times you'll find
maybe mail.example.com or vpn.example.com.
The way to filter out some of that is to write,
minus site colon and then the site
that you're actually trying to get rid of.
So, if you initially search for site.example.com
and you do minus the www.example.com,
it will filter out any searches that exclude the www,
which is really great because you'll start
finding host that are not as popular for that domain.
So, often times you'll find test systems
or developer systems, and that's one
really neat way to actually filter it through.
And, you're doing pure web searches,
which means that only looking at Google results,
or Bing results and you're not
actually attacking their systems.
In my practice, we have found many hidden systems,
doing just this very trick.
Certificate transparency, is another tool that
security testers like to use to find out
other sites that are available for the particular company.
Basically, what the tool does is it looks for
any type of issued certificates, so any certificates
that the company purchased, to encrypt their websites.
You can find the issued ones, and using that tool
you can actually find out other systems
that they purchased certificates for.
So let's say a company purchased the certificate for
vpn.example.com, you know that's probably a system that
their employees use to connect to the company from home,
and if you find out that the certificate is issued to it,
then you have another target on your list.
Sometimes the best way to find out systems,
is just to guess what systems are out there.
If you use nslookup, you just type in
nslookup.www.example.com you'll find out
the IP address for the www site.
Maybe you'll type in nslookup test.example.com
and see if IP address gets returned for that.
If you get an IP address back then
that means that that host exists.
So, what attackers will do, is they'll create scrips
of thousands and thousands of potential host names,
and they will keep guessing them until they find
IP addresses that get returned.
And, that's one really great way to actually find out
other hosts that are available on this network,
without actually targeting the network directly.
The regional internet registries are also a really great
way to find out information about an organization.
If you know some IP addresses that belong
to that organization you can go to one of these
regional internet registries, go to their website,
type in the IP address and it will return
other networks that belong to the company,
and also talk about potential technical contacts
for this company, and other information that
the organization might think are actually hidden,
but they're publicly available.
So, you'll also find out email addresses,
for some of their technical contacts, phone numbers,
as well, which make really good phishing targets.
These are the internet registries, there is AFRINIC,
there's APNIC, ARIN, LACNIC and RIPE,
all for the different regions of the globe.
Netcraft searches, that's a great site for finding out
what types of websites are available for the organization.
It'll let you know if the website's running WordPress
or Joomla or what other type of programming they've done
on the back end, it's a really great resource.
There's also Shodan and Censys.io, these tools
are immensely useful, basically what they do,
is they go and do the scanning of all systems
on the internet and they list what systems
are actually connected to the internet.
So you can find out if, once you type in that address,
for the organization you're looking at,
it'll tell you all the services that are available,
any ports they're listening in on,
and potentially any vulnerabilities
that are on these organizations.
So, you're finding out open ports
without even doing any types of port scanning.
Let's take a look at how we perform some
Google searches on an organization.
So we'll use the site colon, for example.com,
that's the example we were using,
and you can see there's one site that appears.
If we want to filter out sites we can do minus site
www.example.com, and that will filter that out
from the results and only show other
sites that are not www.example.com.
Let's take a look at the certificate transparency.
So the certificate transparency looks at any types
of issued certificates for that domain,
so you can find out different host names for that domain.
So the Google transparency report is the site we're using.
You type in the example.com that we're using.
Of course, you'd use your real domain,
and you an see different issued certificates,
so we can see there's a .org, .com, and other sites,
but when you actually use this on a real organization,
you'll find many, many more sites,
especially the larger the organization,
they might have mail.example.com, vpn.example.com,
they'll be a host of others for larger organizations.
So if you want to perform nslookup,
remember nslookup will find out the IP address,
that's associated with the domain.
So we're going to do a nplookup on www.example.com.
Just so we can use the IP address,
to query the organization for more information.
So we can see, we found IP address for that organization.
Remember you can do this nslookup from the command line
of any Windows machine, or any Linux machine,
we're going to copy the IP address,
we're going to look at, who is for that IP address, as well.
So, we'll type in who is space and then the IP address,
and we're going to find out the who is record
that's actually associated with that IP address.
So we type that in and we can instantly see
the who is record, the regional internet registry
that this belongs to, is RIPE.
This IP address is in Europe somewhere.
And, we can see a lot of interesting information.
We found out a technical contact for that organization.
We can also see a phone number,
for this individual, as well.
And, what's really interesting about that is,
for many organizations, once you find out
the technical contact, that's going
to be a trusted individual in the company.
The individual probably will have higher level access
than other individuals, and that would be
a really good phishing target, or this individual might
be somebody that you pretend your phishing email
is coming from, since they're probably
a trusted individual in that organization.
This is all part of the data collection,
that you just try to find out as much information
about the organizations, so you can find out
exactly how to target it.
Let's put that IP address into the RIPE.net website,
to see actually from the source, how that actually looks.
So we find out some of the same information,
what's interesting here is that,
after typing in the IP address,
it also shows the network block
that belongs to that organization, as well,
so often times you'll have one IP address,
you'll find out the whole network block,
and now we have a whole range of addresses
that are associated with this organization,
so now you have a whole nother target to look at.
So you can see if this entire network was in
the rules of engagement of the company, if it's not,
then this is probably something to ask
the organization and bring it to them.
Say, do you actually own this other subnet?
And if they do, that they haven't paid much attention
to it then most likely you'll find
more vulnerable targets on this network range.
We can see again, here's out technical contact,
with their address and phone number associated with it.
So, as you can see we're finding more
and more information about this organization.
Of course I'm using example here,
when you're using the real organization,
you'll find a lot more details.
We can see other networks and other admin contacts,
associated with the domain,
just from looking up the public information.
Let's take a look at Netcraft, so if you go to netcraft.com,
you can actually search for information
on a particular domain, like we discussed.
So we're just going to look for www.example.com,
not using any real companies in this example,
and you can find out information about the
organization and find out where it's actually located.
You can also find out what types of systems they're using.
You can see that there's Linux systems
that the web servers are running on.
Depending on the website, you can find out
a host of information, just by looking up
the organization on netcraft.com.
Remember, just building a profile
slowly about this organization.
Censys.io is another great resource that we discussed.
All you have to do is put the IP address
of the system that you're looking at,
you can also put in the whole network range as well,
and it will return results for
what types of services are listening.
So we can see exactly where that system is located.
We can also see that it's listening
in on HTTP, so port 80 is open.
We can also see port 443, so HTTPS is open,
as well on that system.
And, luckily the system is only listening in on
those two IP addresses, but other public systems
will be listening in on a whole bunch more services,
if they do not lock it down.
What's interesting about this is,
we just put the IP address in the site,
and found out all the services that
are listening in on this system.
We did this without even performing any port scans,
on this system, without triggering any types of alarms.
We just use public information
and we can see exactly what services
are listening in on this IP address.
It's still a good idea when we move
into active reconnaissance, to do the port scan,
and then you can confirm your results
and possibly find more ports that are open,
but you can see we can find a wealth of information,
just using public information.
We're going to look at Shodan, and we're going
to perform the same exact search,
so we're putting in the IP address, and it's saying,
ports 80 and 443 are open, it's showing
the location of this system, as well.
One neat thing about Shodan is that you an also
put in the company name, in the search,
and you can search systems belonging to that domain as well.
So, I highly recommend that you get to know Shodan,
Censys.io and see exactly how these
searches work and you can perform in depth searches
about the organization that you're working with
and find out a lot of information,
without even targeting the system directly.