The first passive reconnaissance or recon that we're going to perform is something called open source
intelligence or O.S., There's a terrific framework out there, a really nice graphical representation
with a lot of tools linked in its O.S. framework dot com.
Specifically, we're going to look at a tool called Domain Dossier.
And it's going to let us gather some information about a company without scanning the company, without
using intrusive network tools.
We're just gonna gather some information passively that's publicly available.
So let's see how to do that.
You can use your Kalli computer, your VM for this, or you can actually use just your regular desktop
computer.
This one is actually safe to run from your desktop.
It's open source, but you can run this from your VM as well, whichever one you prefer.
The Web site you can see here has, oh, sent framework dot com, and it's a graphical user interface.
It's like a mind map.
It allows us to see under the Osip framework, we've got the ability to look for user names, email
addresses, domain names.
And every time you expand one of these options, you get more tools that you can use to find email addresses.
For example, we might want to use something like the harvester, which will actually use in just a
couple of lessons.
And we want to gather information on a domain name.
We might want to use the who is records.
And one quick, easy way to do that is with domain dossier.
You can see there are literally hundreds of tools linked here in the open source framework.
Some of them you have to install locally.
Some of them we have access to for a Web search.
Some of them are already installed in Caleigh Linux.
The harvester that we use to find some e-mail addresses in a couple of lessons is one of those that
you can use directly from inside Kalli.
But domain dossier is one of the free, open source web tools that we can access through a regular browser.
So click domain dossier and then pick an IP address that you want to research.
So I mentioned if we wanted to find out more information about CNN dot com, let's say that CNN has
hired us to do a little information gathering to help them know what kind of information is being shared
out on the Internet.
We can enter CNN dot com and domain dossier and scroll down a little bit.
And you can see some information like you might get one or two good e-mail addresses, this is kind
of small.
There we go.
So the Turner Media Group at Turner dot com.
If you didn't know this, CNN was run by Turner Media or Turner Broadcasting.
That would help you gather a little bit more information about them.
You might get some other information about a particular contact and then you'll get some information
about various services that are set up for their network.
Well, we didn't get any good names with Turner, but I'll actually tried against my own university.
This is all passive information that's publicly available.
So there's nothing illegal about searching for this information.
UMG Daddy to you.
Happens to be the cool university I teach at.
And if I scroll down a little bit, I've got some actual contacts here.
I have the chief information officer or the CIO over all of I.T..
I have a technical contact who's a server administrator and an email address.
So I've already got some information that I could use if our trying to gather information about an organization
to let them see what's publicly available.
Or if I were trying to run a phishing campaign to test the users in this organization to see if I click
through emails, I might want to send Justin Torbert an email from Steve McCleod, because Steve is
actually Justin's boss, too, to try to get him to click through and give me his username and password.
Now, of course, we're not going to do that in a real situation unless we're being paid and we have
the explicit written permission and a legal contract with the company.
But this is one way that hackers gather information free and completely open source online.
And it's good for you to know in your organization or for your own personal use if there's information
out there that a hacker could use to target you.
At the very least, this gives us some users that we need to make sure I understand the importance of
checking e-mails before they click through.
They need a lot of phishing training because they're public information is out there for anybody to
see.
Thank goodness our team has some pretty good fishing training, but the Osam framework has hundreds
of other tools that go along with domain dossier that allow you to look for everything from phone numbers
to, well, you name it.
You can find businesses on the map and see that, you know, their physical locations, et cetera.
So I hope this is a useful tool for you.
In the next section, we're going to start a little deeper.
Passive recon using a couple of tools in Caleigh.