- [Instructor] Let's look at the Recon-ng tool.
This is my all time favorite reconnaissance tool
you can use it to find a wealth of information.
Really every now and then you get one tool
that combines all of your resources into one
and this is exactly what this tool does.
It's also modular so you can add to the tool as well
you can submit your information for other people to use
as well and this tool is constantly being updated
so more and more people are contributing to it
and making it a much better product.
So we run Recon-ng.
And you can see it looks almost like a Metasploit interface
if you've used Metasploit before and it has
many different options if you type in the question mark
or you type in help, you get a whole list of commands
that you can type in.
They have this thing called workspaces where,
if you're working on multiple organizations,
you could separate them into different workspaces.
So at the bottom where it has Recon-ng default,
so here in the default workspace but we can create
our own workspace which is a separate environment.
So often times you'll work with multiple websites
or multiple domains and you wanna separate them
into workspaces, this tool does really good job with that.
So we're just gonna type workspaces add example
and it's going to create the example workspace
so you can see down at the bottom,
recon-ng switched from default to example.
You see a whole bunch of red text down here
and this is basically saying there are certain
API keys that are not set, this tool has a lot
of functionality and you can add API keys
for certain sub tools that this runs,
we'll get into that in a minute.
Once again, if you're ever stuck,
you can hit the question mark and it'll give you
a list of commands you can type, this tool also has
command completion so if you hit the tab button,
it'll help you complete certain commands as well.
So we're gonna type add domains, example.com
so basically when we typed in the add command,
we hit space and hit tab, and when we hit tab,
it popped up a list of things that you can add
so we can add company names, contact names,
credentials, domains, hosts, locations, vulnerabilities
but we decided to add in domain.
So we're gonna base all of our recon resource based off
the head domain example.com.
Of course you would use
whatever organization you're working with.
So what type of information can we use from here?
The search command can be used to search
for available modules in recon-ng.
So if you just type search domains,
it'll pop up a list of anything that you can use
to populate a domain or use domains to actually
find additional information.
Or typing in search domains with a minus sign after it
which means we're gonna use the domain example.com
and populate other information from that.
So, let's look at some of these modules,
you type in the load command to load a particular module.
We're loading PGP search so we can look
for any type of PGP keys that have been issued
to this organization, if you type the show command
or the question mark command, you see any types of
things to help you out so the show info command
shows particular information for this module.
You can see at the very bottom it changes
to recon-ng example which is our workspace
and PGP search, this is a module we're looking within,
and we typed in show info while we were within
the PGP search module and that allows us to look at
what this particular module does.
So we can see that this particular module
searches the MIT public PGP key server
for any email addresses associated with the domain.
And it updates the context table with the results.
So it'll basically search this web server
for any type of PGP keys that have been issued
for that domain, it'll let you go who the PGP keys
were issued to, only thing about recon-ng
is it's all open source so you can look at the source code
behind this and see exactly how it was programed.
So if you type show source you can see exactly
how this particular module was programed.
The next module we're gonna look at is the who is module.
So if you type in load who is_POCS,
we type in show info, we can see that it's searching
Erin who is database for information
to this particular domain, it's gonna update
the context table with any results.
So we type in run to actually run the command
and when we do we can see that it is finding
certain contacts for example.com.
It's finding many contacts for this domain
just from looking up who is.
62 new contacts, 114 in total.
So if you do show contacts, we can see here,
all of the individuals that have found a part of this domain
of course this is example information we're looking at
so you would use the actual organization
in your real testing.
But it's really interesting 'cause you see
their first name, their last name, their email address,
you can see their location as well,
just from looking at the public who is information.
If you type in the show dashboard command
within recon-ng it'll show you all the tools
that you have run so you can see activity summary,
we've run the metacrawler, we've run PGP search,
we've also run the who is module,
and then down below you can see results summary.
You can see that we have one domain that we're looking up,
that is populated and we also have 62 contacts,
going into this organization so these 62 individuals
are really good phishing targets but they're also
individuals that could be used
for a password guessing attack as well.
What else can we find from domains.
You can see there's quite a few.
We're gonna try to do a bing search,
so basically we're gonna use recon-ng to perform
a bing search for this domain and see
if there's any additional hosts that we could find.
Recon-ng didn't find any additional websites
for this domain, you'll most likely find many more
for an organization that you're doing this work for.
We're gonna load group host for this next example.
Basically what group host does is it performs
the NS lookup that we discussed previously where you can
try doing an NS lookup for hundreds of different host names
and hopefully you'll find one belonging to this domain.
So for example we'll look up see if there's a
www.example.com we'll try looking for a vpn.example.com
we'll look for a webmail.example.com and many others
until we find some that actually exist.
You can see that this is basically brute forcing host names
using DNS, it's just looking at the DNS records
for these entries, it's gonna update the host table
with the results, so you'll wanna really build out
and find out what additional systems are belonging
to this organization.
You can see it's searching hundreds of different
potential sites for this organization, so you can see
it's looking for consumer.example.com, contact.example.com
content.example.com and hundreds of others
and you can see that it found one new host from there.
So you can see all of those, we found out
there is a www.example.com, if you were working
for a larger organization then you'll probably find
a host of more servers, which is really neat.
'cause you find there's www.example.com
it shows the IP address belonging to that
and you can also populate some geographical fields
for this IP address as well.
Let's try loading certificate transparency
like we did before using
the Google certificate transparency report.
So we ran that and we found some new sites
that belong to the organization and see
that we found dev.example.com as a new one.
Support.example.com, so we found these new systems
belong to the organization without even attacking
the organization, something like dev.example.com
would probably be a good target because it looks
like it's a development system that may not be
protected as well as something like the www.example.com.
We're gonna load netcraft, see if it finds
any information, we didn't get any real useful
information from there, but we can also load showden
and see what types of information you could find
from showden like we did on the showden website.
This is one of the searches that actually does require
an API key so you can go to showden and actually
get an API key that you can use within recon-ng
and we can see that it found two ports that are open
for that particular host, we can see 80 and 443 are open
for this host so 80 http and 443 https
are both listening in on that particular IP address
that we have, so you can imagine if we have
a whole list of IP addresses belonging to an organization
and we run this command it's gonna find
a lot of different ports that are open
and are doing all this without actually scanning
the organization ourselves.
If you do the show ports command,
you can see that IP address and the ports
that are associated with this particular host.
And while we're looking at this host table
by using the show host command,
we could see the host that we found,
the IP addresses that are associated with those hosts,
we could also see the modules that we used
to actually find those particular hosts so,
we found the www by using brute host,
we found the others using
the certificate transparency module.
So we can resolve the host also in here.
If there are any kind of DNS resolutions
there will be for an actual domain,
of course we're using example.com here
so you're not gonna find any, but we're going
to resolve the host and it'll tell you
what the IP addresses are associated with that domain.
hacker target is another module that we can run.
We ran hacker target and it found another
example host, there's tvmig.example.com
so as you see all these different modules
can really build off each other and you can find out
a host of information for an organization
just by using this one tool.
Another neat thing is, with recon-ng it's fully scriptable
so if you find yourself doing the same thing
over and over again for your security engagements
you can program it so it'll automatically run
all the necessary modules for you through recon-ng
and you'll get your results met.
So we're loading ssl sans which is another tool
and looks like we found even more hosts.
What is ssl sans actually doing?
Let's look at show info,
we can see it uses ssl tools.com API
to obtain the subject alternative names for domain
and it's updating our host table with the results.
So what can we do knowing the hosts.
So now that we have our host table populated
we can run bing IP on the host
which basically finds other systems
that are using that IP address,
we can also form some geographic locations
on those IP addresses using the free geo IP
and that will pinpoint the location on a map
where that IP address belongs
or where the IP address is actually located.
So if we look at the dashboard again,
we can see that we're starting to build out
some good information for this organization.
We have one domain, we know a couple of ports that are open
we have 14 hosts now that are on the domain
and we have 62 contacts belonging to that organization.
So let's look at these contacts.
So now that we have a list of people's names
and email addresses and locations,
there's some really neat things that we can do with that.
Let's look and see if any of these organizations
have ever been in a public breach that we know about.
If we load the HIPB_breach module,
that's the have I been pwned site,
so if you ever go to haveibeenpowned.com,
you type in your email address you can find out
if your email address has been associated
in any public breach and it'll pop back results
and tell you that your email address was in this breach.
What's neat about this is we have a list of 62 individuals
we can see in our example some of the email addresses
are repeating but we can still run all those email addresses
against the have I been pwned website
and see if any of them show up in public breaches.
So let's hit run.
We can instantly see you@example.com was in 17 breaches
it was an adobe breach, it was in many others,
there's Myspace breach, there's some torrent breaches
and it'll give the dates for those as well.
So now you know that you have you@example.com
that's in 17 of these breaches, you can search the internet
for these breaches and you can probably find
the password for that email address.
If you can find the password for that email address
in several of these breaches, you can probably get
a good idea of how this individual formatted their password
most likely this person used similar passwords
in all of these locations and if they did,
then they probably used the same password
for their company as well so once you understand
the person's password format from these public breaches,
you can try to log into their corporate email account
or VPN with that same password.
You can see nobody@example.com
of course these are just tests but,
you can see that that email address was associated
in several different breaches as well.
Unknown@example.com was in an Adobe breach
and many other breaches, we could also see
that me@example.com was associated in many breaches
as well, some of the same and some new breaches as well.
Also has the dates for each of the breaches
so we can see that if we can find their password
in some of the more recent breaches,
that might also mean that they are still using that password
as well, so we can see there are some 2017 breaches
that occurred, one in May of 2017, so if you can find
the password associated with that breach
in that email address, chances are,
they are still using that password in other areas as well.
So we can see that we found four email addresses
that were used in breaches.
Another neat thing about recon-ng is you can have
full reporting so you can take all your results
and put it into an html document or a csv,
and you can find information there.
We're gonna export it to a html find
so we type in load reporting/html and we type in run
and you can see it pops up an error and it says,
framework exception, value required for the customer option.
So it looks like this module is actually looking
for us to configure something before we can run it.
So if we type in show options, we can see that,
there are two fields at the top that are required,
there's the creator that's required, and customer.
So if you're creator you can put in your own name,
customer is whatever customer you're working for
so if you type in set and then the name of the section
that you're actually setting the value for.
So we're trying to set the value of creator,
we type set, space, creator and we can put our own name
in there, I'm just gonna say My Name for this one,
and then you can set customer.
To the trainee, and now let's run that,
and it says the report has been generated.
And now we can see basically everything we found
in a nice html document.
And we can see all the hosts that we found,
we can see how we found these hosts,
and get that nice list of contacts as well.
You know, several of them are in public breaches,
and now we can also see that these four email addresses
were in public breaches, and some of the modules
you can use to actually pull back passwords
that are in the breaches and we can also look on the web
to find some of these passwords as well.
And you can look at ports that are available.
You see that 80 and 443 are available for this post.
So we did an overview of recon-ng,
there are many more modules out there for it,
once you find the location for some of these servers
you can also trigger some of the modules
such as some of the picture modules you can use
to actually see if anybody took pictures in these locations
so maybe the location that you find
for one of these systems that maybe this IP address here
was located in a server in a data center,
and you can run some modules to say,
show me any pictures that were taken within half a mile
of this IP address and maybe somebody took some pictures
that had their geo setting tagged on there,
and they posted it to some of these websites,
and they released pictures containing some sensitive
information that they took pictures of in the data center.
So there are many many more modules, I encourage you
to experiment with different modules within recon-ng,
once again we ran these tests without touching
the organization at all, and so it's pretty neat,
you can do all this information without actually
attacking the organization just using completely free
information on the internet.