Another valuable and very interesting category of tools that we need
in our pen testing toolbox is that of open source intelligence.
Now,
open source intelligence is a classification of tools
that means any place we can go,
that's open source free data that's available to us to
do research on what we found with other tools.
So let's assume that we have an IP address or we have a domain name.
Either one of those we want to find more information about them,
find out what it really represents, we can dig
down with these tools and find more information surrounding the technical
response that we got from perhaps our scanning and enumeration tools.
For those tools we can start off with the
who is tool who is is implemented in multiple ways you can have.
There is a who is command at the command-line under Linux or there's multiple
whois
websites. We'll take a look at those in just a second
who is provides domain details about the IP address or the domain itself.
Actually that you've requested.
NS lookup is another query tool that will give you DNS information
that's available on most operating systems already
foca
stands for fingerprint organizations with collected archives.
So to reach out and find documents
whose metadata refer to a particular organization,
the harvester gathers info from many different sources. It's a little different.
It doesn't depend on domain and organizational information.
It will look at emails hosts, open ports.
It looks at a lot of different places
to kind of figure out information about the owner
of these entities show Dan will find internet connected devices. We see that censys
will do that as well. At the very bottom,
these two tools help
Attackers and pin testers find devices that are connected to the internet.
And in fact, if you know your personal public IP address,
it's not a bad idea to use these tools to find out how many
of your doorbells or ranges or tvs are actually being exposed to the internet.
This is a great tool to try to find
as many IoT devices that can be potentially attacked.
Maltego is data mining for investigations.
The more information that you gather throughout your pen testing endeavors,
it becomes more and more difficult to make
sense of it.
So if you've got reams and reams of data, you might benefit from using a tool like
Maltego
to help you dig in and find correlations.
Remember the whole concept behind data mining is that the name is a bit of a misnomer,
we call it data mining, but that's not really what we're doing.
Think about this.
If you want to go dig for gold, you're gold mining,
but you're actually digging in the dirt.
So what we're really doing is we're digging in data to find interesting knowledge.
So some people actually say this should be called knowledge mining.
But the idea is we want to find interesting correlations in reams of data.
That tool will help you do that.
Recon NG is a web reconnaissance tool that will help us
look at at web entities and find information about those.
So all these tools help us
to find more pieces of the puzzle to draw a
complete picture of the targets that we're attempting to attack.
Let's take a look briefly at who is an NS lookup.
There are several different ways that we could
issue a WHOIS query.
Let's try saying who is
bbc.com.
All right. So we see we get a lot of information there.
If we scroll back up, it tells us
all the way to the top. There we go.
The domain name,
the domain ID,
lots of information, contact information,
it's blank for many large environments.
Registrar is two cows, domains.
These are the name servers that are in use
and lots and lots of disclaimers and additional information.
You can scroll through this and find all kinds of information
as to who owns a domain and how it's configured.
And NS lookup will allow us to do some of the similar things,
but it's a little bit different output.
So let's try
in this lookup, bbc.com
and we see we get less information, but it's more IP address specific.
So if we're looking for a correlation between
a domain name and IP addresses,
NS lookup would do the trick if we're looking for more descriptive information,
who is, who is queries will do the trick
and you can use this information in lots of different ways.
Actually, I was just contacted by
a friend of mine that works for a public institution
that friend had basically received some communication
that was very suspect in nature.
It actually contains some information
that
meant that further investigation would be warranted.
And this person was not a technical person contacted me and said, hey,
can you tell me who owns this IP address?
Who is this? What can you find out about it
using open source information? And so I basically used OS N
to find out who owned the IP address.
And I verified that that particular IP address was in a certain range.
And so I responded back to my friend and said, ok, this is the company
and I went and found the website and this is the website turned out,
it was actually a small business
and they had a page on their website that said about us
and it had a picture of every person that worked there.
So I was able to basically say, yeah,
whoever sent this was one of these people probably.
And then that person took it and is going to do
some of the work to figure out who actually sent it.
So again, this is all open source information, all you know,
nothing that I needed permission to do.
I was just simply using who is in NS lookup and web browser queries.
So there's a lot of information that you can find out there. Always look into your OS N
it'll give you gold mines of information.