- One of the most important things
you can do from an external standpoint
when you're doing security testing is search
for files belonging to these organizations
that you're targeting.
You can use web searches to find files.
Just by doing simple Google searches,
you can get a lot of documents
that belong to the organization.
And there's a lot of useful information
within those documents.
So if you do site:example.com pdf,
you type that in Google and you'll find out
PDF documents that are on the example.com domain.
So obviously you'll change example.com
to whatever organization that you're targeting.
And you'll find out that information.
You can change a PDF
to XLSX and find out
Excel documents belonging to that organization.
Sometimes you'll find more results
if you use the file type switch.
So filetype:xlsx.
Or sometimes you find out more just
with typing in the extension by itself.
Either way, Google will return results
for that organization for those file types.
Password files for better or worse.
There are password files that are available
on the internet belong to organizations.
This often happens when servers are misconfigured.
Google goes through and indexes those systems
and unfortunately puts password files
directly on the internet.
This has happened for many organizations,
and it's quite easy to find this information as well.
There's one thing that's important to do
when you're actually performing penetration tests
to see if sensitive information is
actually available online.
We'll proceed into a demo where we will show you how
to grab files from an organization
and actually pull sensitive information as well.
There's a lot of research that has been done
on what type of internet searches you can do
to actually find out sensitive information
belonging to an organization.
Also remember the file contents is
not only the most important thing.
Metadata within these documents also
contains really important information.
Within the metadata in these documents,
you could find out usernames and software.
So if you ever open up a Word document,
and Microsoft Word pops up and says enter your username
or the author, people usually fill out that information.
Well all that information gets stored within the file,
so anybody that has access to those Word documents later
can see who exactly was the author of that information.
And you can discover usernames,
and it also shows the version of
software you're running as well.
The version of software that's running is really important.
Especially if you're going to perform any type
of targeted attack on the victim machines
or any type of phishing attack
because you'll wanna know exactly what software
that they're running to see if maybe they're running
a vulnerable version of software
that you can use to target and exploit for.
Or you can craft a special phishing attack saying
we realize you're using this type of software,
and you can create your phishing campaign
using that as well.
So we discuss the importance of metadata
and the types of information that you can pull
from files belonging to an organization.
Let's see how that actually looks.
So we perform a Google search for example.com
And we try to look for, let's say, Excel documents.
In this case, we're not finding anything.
It's just an example domain.
But let's pretend that you actually do find
a document belonging to this organization.
We created a test docx file which is a Word document,
and we want to see exactly what types
of information you can pull from it.
One really neat tool to use for this
is the ExifTool by Phil Harvey.
This tool can be used to pull all sorts
of metadata from files and so let's see
what types of information I can pull
from this test Word document that we created.
So if you run the tool on the employee handbook
which is a pretty common name
that you'll find on organizations, we can quickly see that.
You see the title, the full filename,
employee-handbook.docx.
So it's a Word document.
You can see when it was last modified.
See the docx extension.
Now you see a creator.
We have a username, jsmith@example.com
Sometimes you'll just see J Smith in there,
or sometimes you'll see a different type
of username if the organization is using
a different type of naming convention.
You can see that they put a description in here that says,
"Send to hr@example.com for approval."
So this means that you also know another email address,
hr@example.com,
in addition to the jsmith@example.com.
And you know that there's some approval process
that the HR team looks at for these type of documents.
And you can see the person's full name,
so the person is John Smith,
so that's where they get J Smith from.
So now you know that if you get a whole list
of employees belonging to this organization,
you know that they're using the first letter
of their first name and then the last name @example.com
as their naming convention.
So all you need moving forward is a whole list
of employee names, and you can actually get
the usernames from that.
We keep looking down.
We actually see a manager field which is really interesting,
so there's a manager called Martin Smith.
So we know John Smith's manager is Martin Smith,
and that is really useful for any type of phishing campaign,
or as we're trying to build an attack scenario,
we really want to know what type
of reporting structure they have in the organization.
We can also see the company's name as well.
We also know that they use Macintosh Word,
so we know that they have Macs in the organization.
You'll often see Macs being used for the web developers
or anyone posting information to the web,
but maybe this organization uses Macs
throughout their entire environment,
so you wouldn't want to use a
Windows-specific attack for this organization.
You would want to use a Mac-specific attack
for at least some of the individuals
that are posting this information to the web.
So right off the bat, we just pulled a Word document
from the organization, and we found out three usernames.
We found J Smith, we found HR, we found M Smith
which is gonna be Martin Smith,
and so we have three individuals.
We know three email addresses,
and we're starting to get an idea
for the reporting structure in this organization.
We also know that at least some individuals
in the company use Microsoft Macintosh Word.
So they have Macs in their environment as well.