- And then something to discuss briefly
- is the use of Open Source Intelligence or OSINT
- or OSINT, depending upon how you want to pronounce it,
- but there are numerous tools and websites available
- for intelligence gathering and reconnaissance,
- so Open Source Intelligence,
- these tools exist as either standalone applications,
- they could be browser plugins
- and they can be passive or active in nature,
- so it's probably beyond the scope of the course
- to go into any of these in any type of detail,
- but I wanted to list out some of the ones,
- the more popular ones, that you can use
- for these different types of you know,
- intelligence gathering activities,
- so Maltego, Metagoofil,
- Shodan, the Google Hacking database,
- really that's an interesting one,
- where you can go out and plugin different types of hacks
- or what they call Google Dorks and those things
- will go out and show you websites,
- that have those vulnerabilities in them,
- so you really use the search engines
- to find websites, that have vulnerabilities
- that you can go out and try to exploit,
- now I certainly don't recommend using any of these tools
- actually for illicit purposes
- and you don't want to use these tools
- against legitimate websites and companies,
- because you can, as a security professional,
- you're just trying to test things out,
- if you don't have permission ahead of time,
- when you're doing port scans and network scans
- and these types of things,
- things that are actively targeting a website or a company,
- you could be held liable,
- so don't use these things without permission,
- but again, all of these different types of tools
- allow you to get intelligence gathering
- from fingerprinting websites and operating systems,
- server information, you can find the background information
- on web addresses, email addresses,
- the server addresses behind the scenes, if you will
- for these various websites and so forth,
- Social Engineering Toolkit allows you to go in
- and find out a lot of information about a company,
- that's publicly available,
- who the people are, who the directors are,
- you can use the Wayback Machine as we see here
- to go out and see what a website looked like
- maybe five, six months ago, a year ago, five years ago,
- so all of these tools allow you
- to gather a lot of information about a company,
- things that they're passionate about,
- who their board of directors are,
- different types of projects they're involved in,
- where they're located, who their top management is,
- right and then you can see things over time too,
- you can talk about people, who were there five years ago,
- but no longer, but when you use
- your Social Engineering techniques,
- or when hackers do, I should say,
- and they contact people within a company
- and they have all this background information already,
- it makes them seem like they're part of that company
- or at least have insider knowledge of that company,
- so it makes it much easier for them to extract information
- from a Social Engineering perspective
- from potential victims.
- So all of these tools allow either
- a penetration tester or a hacker, right,
- depending on which side of the coin you're on,
- it allows them to get a lot of information
- behind the scenes, so they're really armed
- with a lot of pieces of the puzzle,
- before they ever actually go out
- and try to exploit the website
- or you know, penetrate a company in some fashion.