- So we discussed manually how to perform searches in order
to find information on an organization.
That's an essential piece of your reconnaissance phase.
But why not use some tools to actually speed up the process?
It is still important to understand how
to do all this work manually.
A lot of these tools are just doing all your manual work
faster and sometimes the tools fail.
And sometime you need to actually do more work
than the tools can actually do.
So it's still really important for you to
understand how to do all of the manual work
that we did in the previous lesson.
But let's take a look at some tools that can
actually help speed up your time
and make you more efficient
during your reconnaissance process.
Spiderfoot, that is the first tool we're going to look at
and basically it's an
Open Source Intelligence Automation tool.
This is a github website and
basically this tool can be used to automate a lot of the
searches that we performed.
theHarvester, this is a really neat tool
for actually finding email addresses belonging
to an organization.
All you have to do is
put in the domain name and it'll pop up a
whole bunch of email addresses through
public searches that it performs.
Discover, this takes several tools,
puts them all together
and performs an automated attack,
which basically searches for email addresses
and usernames and other websites that could
belong to this organization
and it puts it all into a nice report for you.
Recon-ng, this is my favorite tool that
is used for reconnaissance.
It combines a lot of these tools.
It does have some manual work that you can manually
go through this.
It's also fully scriptable so you can
program it to do whatever you want.
But basically this tool kind of combines all of the others
into a really nice framework for
performing all of your reconnaissance phases.
The first reconnaissance tool that we're going to
look at is Spiderfoot.
So if you run Spiderfoot, this starts a web server
and you just need a browse to that website
on your computer
and up pops this nice interface that you can use to
basically scan an organization
for some reconnaissance information.
So, many of the things that we did manually
in the previous lessons,
this tool automates the process.
You can see here things that it can look for
and search for accounts
belonging to the organization that
on sites such as eBay and Slashdot and Reddit.
It can look do perform Bing searches for the organization,
look on an archive.org for previous versions
of files and pages belonging to the organization.
Performs DNS lookups and email lookups
for the organization, Google searches.
So some of the Google searches that we
were performing using the Google hacking database
this tool does some of those for you.
Still very important to understand how to do that
manually because you can do more
targeted searches, perform your own manual searches but
tools like this are essential for speeding up
the reconnaissance process and helping you out.
I'll look for Pay Spin like we searched for
for the organization.
Look for phishing sites that could be targeting your client
and it can also perform searches for malicious websites
that could've been on the organization
so it'll look for blacklists and
see if any of the organization IP addresses are on those
so perhaps one of the IP address belonging to the
organization has been infected and that'll
appear in blacklist and so this will list that as well.
But it'll also gather a list of phone numbers
and contacts and software for your client as well.
All you have to do is pick which
test you want to run,
hit Scan, it'll start scanning.
If you run all the tests,
it can take a very long time but you
can see how it'll quickly pop up a list
of results for the organization.
So with theHarvester tool we can find out a
list of email addresses belonging to the organization.
This is an essential piece of performing any
type of phishing attack or looking at email
addresses that are probably the most likely targets
of a phishing attacks so you can notify your
organization about that.
So you can run theHarvester Python script
and it basically says
tells you exactly the type of switches you should run.
So we're gonna run python, space,
theHarvester, dot, py, to run the tool.
Dash, D and the domain belonging to the organization.
We're just using example.com here.
We're listing out the top 200 results for the organization.
We're gonna do all the checks
and we're gonna output the results to an html file.
You can see it's performing the searches,
searching PGP keys
and Bing results.
And it's performing all of this work for you
so you don't have to manually
look for the email addresses yourself.
And you can see at the end it pops
up a whole list of email addresses that it found
belonging to example.com.
You can use these for your future phishing attack
or you can also use these email addresses
or the usernames to try to log into the website.
So perhaps you'll have a webmail site belonging to
the organization or a VPN site
or an Office 365 portal for the organization
and you can use these addresses
as potential targets for maybe a password attack
against the organization and hopefully you'll
get lucky and get credentials that you can use to
actually log into an organization.
One popular attack that individuals
use is to try one password against all these
individuals so instead of trying to brute force
a password for a single person which will
probably lock out the account,
you'll guess one password across all of them
so instead of guessing a hundred passwords
for you.example.@example.com,
you will try using the password, let's say,
password against all hundred passwords that were
all potential email addresses that were discovered.
So chances are one person had that password
and you'll be able to log into their account.
Let's look at the Discover tool to find out
more information that we can pull from reconnaissance.
So the Discover tool is pretty neat.
All you have to do is
type in the domain belonging to the organization
and you could find out really useful information.
It can actually do active testing as well
on the organization.
Right now we're just looking at the passive
information but as you can see from some off the
other options you can run some scans.
So there's web scans, nikto scans against the organization.
You can crack wifi passwords as well.
You can start Metasploit
but for us we're going to look at some of the passive tools.
So you can see you can choose between
passive and active testing.
We're just gonna do the passive recon.
So all you have to do is type in the organization name
and the domain
and it'll start searching for email addresses,
names, a lot of information belonging to the organization
and afterwards you'll have a
list of contact, emails, names.
You'll have a list of hosts belonging to the organization
so you'll have a list of servers and networks.
It even performs Netcraft like we did in earlier lessons.
It can see the squatting section is for
it'll look at the organization's domain name
and switch some characters around to find
out similar domains.
A lot of times attackers will use that for
phishing where they'll pick, they'll register a
name that's really close to the organization's
name and use that for phishing so this tool helps
discover some of those so you can help notify
the organization you're working for that
here are potential phishing domains and you can see which
ones are actually being in use or not.
It could also pull files belonging to the organization
like we discussed, it can get
really important metadata from the organization.
And it puts it in a nice, pretty report for you as well.
That is the Discover tool.