- Another really important part of a penetration test
is looking for names and passwords
belonging to an organization.
You may ask, "How can I actually find names
"and passwords for an organization
"without actually targeting the organization?"
There's a lot of public information available
that can help you in your search.
Public breaches are the number one way
you can actually find this information.
There's been some pretty high-profile breaches
over the recent years, from Adobe to LinkedIn, Dropbox,
they were all breached in recent years,
and the attackers took all those usernames and passwords
and published them out on the internet,
so many people have access to these public breaches now,
and although people have used it for malicious reasons,
as an ethical hacker, one thing that you can use
is look at these breaches and find out
if there are any usernames and passwords
belonging to the organization that you're working with.
If so, you can see if those usernames
and passwords are still active
and try to log in to their webmail portals
or their VPN portals using those passwords,
and even if the passwords are not still used,
we all know that people are notoriously bad
at picking passwords, so, often times,
people will reuse their password,
or they'll just put a new number
on the end of their password.
Maybe the end of their password has a date
like 2016 on it, and you might wanna change it to 2017,
and that might actually work.
So these previous breaches are an important tool
that you can use to actually find usernames
and passwords belonging to an organization.
Often times, you can find this information
and end up being able to log into an organization remotely
without sending in a single attack towards the organization.
There's also many paste sites out there.
Pastebin is probably the most famous one
where people can just anonymously copy and paste information
to this website, and you'll also find a lot
of breached information on there as well,
so it's really important to search these types of sites
for the organization that you're performing
the penetration test on as well
to make sure that there aren't any public usernames
and passwords on there.
As we can see, using public internet searches
is immensely useful for performing
your penetration testing engagement.
There has been a lot of research done
on how you can actually perform searches
for sensitive information for these companies,
so you don't have to figure it all out yourself.
There's a great tool on the Exploit Database.
Google Hacking Database is what they call it,
where they have all these example searches
that you can perform to assist you in your search
for finding sensitive information for the organization.
So, one example is you can search for "your password is"
and also put a file type for PDF.
Unfortunately, many organizations issue passwords
to their employees, and they put it in documents,
and sometimes that information can get indexed
on the internet if not secured properly.
So, this site lists many different ways
that you can actually perform your searches,
and they'll give you recommendations on
if you're looking for password files,
you can use these searches.
If you're looking for database files,
you can use these searches,
and they have a lot and lot of information
on the website for you you can perform these searches.
Let's take a look at this website.
So, let's get some help on searching
for sensitive information for this organization.
We'll look at the Exploit Database, and specifically,
we're gonna look at the Google Hacking Database section
of the Exploit Database.
This site has many exploits for public systems,
but as a side project to that,
they have the Google Hacking Database.
And here, we can look at different types of categories
for files and sensitive information
for the organization that we're targeting.
We can see that there is,
we're highlighting Files Containing Usernames,
so if you use the searches within this category,
they help you search for usernames within the organization
just by doing Google searches.
There is Vulnerable Files, Vulnerable Servers,
so if you're looking for vulnerable servers,
they might look for certain search strings
that you can use to actually find outdated systems.
Maybe they'll be Windows 2000 systems,
or Windows XP systems, systems that are outdated.
Files Containing Juicy Information,
so these are sensitive information files.
Maybe they'll have names and social security numbers,
different types of PHI or PII.
There's also Files Containing Passwords.
We'll look at that one specifically,
and you can see, up pops a list of many different types
of Google searches that you can perform
to search for password files
for a particular organization.
So you can see, this one, as highlighted now,
this is a FileZilla search,
so if an organization is using FileZilla,
the software can store passwords
for an organization in its configuration files,
and if a system is publicly connected to the internet
and gets indexed by Google,
you could perform this search
to look for FileZilla files containing passwords.
We can see Microsoft FrontPage passwords.
If they're using FrontPage, these are different types
of searches that you can do to search for that as well.