The reconnaissance phase: I can see you 2
but you can't see me. So as we look at 3
the hackers methodology, you remember 4
that the first step we have is 5
reconnaissance, and we talked about the 6
fact that we spend about eighty to 7
ninety percent of our time in this phase 8
before we actually begin our 9
exploitation. During phase one we're 10
going to perform reconnaissance, this is 11
our systematic attempt to locate, gather, 12
identify, and record information about 13
our target. This is also known as 14
footprinting, and this is a passive 15
collection technique. We'll do things like 16
using open source research, and internet 17
searches like Google, we'll use social 18
engineering, dumpster diving, and email 19
harvesting to collect as much 20
information as we can about the 21
organization before we start targeting 22
the organization for an actual exploit. 23
So what types of information are we 24
desiring? Well, we're going to gather any 25
information we can, but the things we're 26
really focused on are things like phone 27
numbers, contact names, email addresses, 28
security related information, information 29
systems that are being utilized, things 30
like we know if they're using Windows or 31
Linux, job postings, and resumes. So job 32
postings and resumes may seem like an 33
odd thing to collect, but the reason why 34
we collect job posting says there's a 35
lot of information that we'll find there. 36
For instance, if I was going after this 37
company, Technical Innovations, I look at 38
some of their job postings. In this one 39
there's a system administrator job. And I 40
start looking at the knowledge and 41
skills and abilities. They're looking for 42
somebody who has two thousand or two 43
thousand three Microsoft certifications. 44
That tells me they're probably running 45
Windows Server 2000 or Windows Server 46
2003, opening up a whole world of 47
exploits to me. They're using Unix or 48
Linux and HP blade systems, again that's 49
information that we can find useful as 50
we go through our exploitation. Further 51
down we see again, there's Windows 52
Servers. They keep popping up, Windows 53
Workstations, Windows Servers. That's 54
going to help me start mapping out what 55
that network might look like, so I can 56
start figuring out what kind of attacks I 57
want to generate. And finally they 58
mentioned shift work is required. Now 59
what does that tell me as an attacker? Well, 60
if shift work is required, that means 61
that there's people in the building most 62
likely 24 hours a day. So if I was going 63
to try to break in from a physical 64
standpoint, doing it in the overnight 65
hours may not be as effective as I 66
thought it might be. Because they're 67
doing shift work, there's people there, 68
people can therefore catch me, I want to be 69
more careful when I do that, and I'll 70
have to start developing that pattern of 71
life a little bit better, so I know when 72
the shift changes happen, and when people 73
are or are not at work. Some shifts only 74
work two shifts 75
in which case they might work 16 hours 76
of the day, leaving eight hours exposed. 77
Others work shift work where there's 24-hour 78
coverage. These are the things we have to 79
figure out by looking at that pattern of 80
life before we start an exploit, because 81
one of the exploits we can do is 82
actually doing physical break-ins, if 83
that's within the scope of our 84
assessment. So the second thing we're 85
going to look at here is resumes. Now 86
resumes may be helpful, there's a couple 87
of reasons. One is if I'm searching for 88
the name of a company, and not pull up 89
somebody's resume, I may find an employee 90
who used to work there who may not be 91
happy with their job. I can find out 92
information from them. Secondly I can 93
look at the type of skills of the people 94
that they've hired before, so while I 95
look at this professional summary in the 96
technical proficiency, that's interesting 97
but not necessarily too helpful, but when 98
i get to the second page of his resume i 99
can see that he has his professional 100
experience and educational and training. 101
In this case i can see that ABC energy 102
company that he worked at, hired him as a 103
Linux system administrator. He had over 104
200 Linux systems, he had red hat and 105
SUSE Linux, that's going to help me 106
narrow down my scope of exploitation. 107
Additionally, they use VMware, so that 108
tells me that they're using virtualized 109
environments. So, even if I break into a 110
single box, I'm going to find a way to 111
break out of that box and into the other 112
boxes, that can be difficult. So these are 113
things I want to start looking at. 114
Additionally he did a migration effort 115
of windows servers over to Red Hat 116
version 4. Now I know the exact version 117
that they were running, at least during 118
the time he was there. And as you can see in 119
the resume, he is presently employed 120
there, so that would tell me something 121
else. He also has incorporated that into 122
a two thousand three windows server 123
Active Directory domain. So again, as I'm 124
attacking, I go "Oh, he's got windows 125
server 2003, let me look at exploits that 126
can break those vulnerabilities." The next 127
thing I see is that he's using citrix 128
metaframe. So with Citrix that's another 129
client that we will be using, and we can 130
sort target vulnerabilities against 131
Citrix, if we couldn't get in through 132
windows or linux. Lots of different 133
options as I go through this guy's 134
resume and, figure out where those 135
vulnerabilities are for this 136
organization. So what are some tools we 137
use in reconnaissance? Well, there's lots 138
of tools that exist. We can use things 139
like nslookup, traceroute, ping, whois, 140
domain dossier, email dossier, Google, 141
social networking, discover, and meltigo 142
just to name a few. I'm going to 143
briefly talk about each of these as we 144
keep going, and in our labs we're going 145
to actually play with a couple of these 146
tools as we do a mock reconnaissance 147
phase. The first one we're going to talk 148
about is nslookup. Now nslookup stands 149
for nameserver look up, and it resolves a 150
fully qualified domain name, to an IP 151
address. For example, if you have my 152
website named JasonDion.com, computers 153
don't understand that, they understand 154
numbers. So if I did an nslookup of 155
Jason Dion.com, I'll get back the IP address of 156
my server. In this case 205.172.19.193. 157
This is what we call non-interactive 158
mode. I give it the command, and I give it 159
the website, and it will give me the 160
information back. There is also an 161
interactive mode. In interactive mode, you 162
just type nslookup and then hit enter. 163
This brings you up into the interactive 164
mode. At this point you can set certain 165
types, and modifiers. For example, on the 166
screen here you see I set type to MX, 167
that stands for mail records. By doing 168
this I can search for the mail records 169
associated with youtube.com, as you see 170
there I got those male exchangers 171
displayed to the screen. So as I 172
mentioned, there's a lot of different 173
options for nslookup. If you want to 174
learn more about it, I'd recommend going 175
and searching nslookup on the 176
web, you'll get all the details you'll 177
need. For the ethical hacker exam, you 178
will have to know several of these 179
modifiers. For our reconnaissance efforts, 180
because we're going to be limited in 181
scope and our reconnaissance, because 182
we're using a virtualized lab, you won't 183
need to know these in-depth. Now another 184
thing I want to mention here is, when you 185
do nslookup you're actually doing a look 186
up from your attack platform, in our case 187
kali linux, to a dns server to get that 188
information. Again, if you want to 189
do this anonymously, there's lots of good 190
tools out on the web. One of my favorites 191
is centralops.net. We'll play with that 192
during our labs as well. And this will 193
help us remain passive longer during our 194
reconnaissance phase. So if we use 195
centralops.net, here's an example of 196
what that would look like. You fill in 197
the blanks on the web page, you hit go, 198
and on the right side you'll see our 199
answers came back. You can see that for 200
JasonDion.com I was able to find the a 201
record, which is its address, their IP 202
address. I also found its name servers, 203
which can help me if i'm going to do a 204
DNS attack, and I found its mail servers 205
as well. The next tool we're going to talk 206
about is trace route. And trace route 207
displays the path between your device, 208
our Kali work station, 209
and the destination IP address, 210
showing each router hop along the way. So 211
every time I find a router or a firewall, 212
it's going to display that route. For 213
instance, if you do trace route and the 214
IP address, you'll get those routes in 215
between. If you do trace route and the 216
domain name, such as google.com, you'll be 217
able to see all the routers and 218
firewalls between your computer and 219
google.com. So the way traceroute works 220
is it's going to increase your time to 221
live for every time you send out a 222
packet. So it's going to send out three 223
packets with a time to live of one. It'll 224
go one hop, and then fail, and send back 225
an error message. Then it will send out 226
the next three packets with a time to 227
live of two. They'll go two hops, and 228
report back with an error message, and it 229
will keep doing this until it reaches 230
the destination. This allows it to know 231
exactly how many hops it takes, how long 232
each hop takes to get there, and which 233
route it through the network. Each time 234
a packet passed through a host, a router, or 235
firewall, it will decrease the time to 236
live by one, and forward the packet on. 237
When that reaches the time-to-live of 238
zero, it will actually produce a type 11 239
error, and that pack will be sent back to 240
the sender. Now, as it does this, and it 241
goes through all of the hops, it's 242
collecting all of this data back with 243
the time to live, and it will combine 244
that into the report for you to see. 245
Three times stamp values are returned 246
for each host along the path, and this is 247
actually the delay in the latency it 248
takes, so you can actually determine how 249
long it took to get from my computer all 250
the way to Google, and the particular 251
route it took. Now, what does latency tell 252
you? It can tell you what kind of 253
connection that people have. So for 254
instance, if they have a dial-up modem, I 255
know this is really old, but some places 256
still do, you'll have a longer latency, 257
100 to 150 millisecond. If you have 258
cellular, it's somewhere around 50 to 150 259
milliseconds. If using satellite, you'll 260
have very high latency, around six to 261
seven hundred milliseconds. If using 262
fiber-optic, it will be very low latency 5 263
240 milliseconds, so you'll be able to 264
tell that as you're doing this traceroute 265
and it can start giving me some more 266
information about the victim that you're going 267
after. And here's just an example of what 268
a traceroute output looks like. So for 269
instance here you see traceroute 270
JasonDion.com, you'll see the first gateway 271
10.0.2.2, you'll see a couple of series of 272
stars, that's usually a firewall that's 273
not reporting back, but it knows there's 274
something there, and then it continues on 275
through all of the routers, in this case 276
starting at Hawaii.RR.com, and going all 277
the way down to unifiedlayer.com which 278
is my hosting provider. 279
Again, going back to centraloffice.net 280
they have great tools for us, we can 281
do the same tracer out there, and again 282
that keeps us at that arm's reach. We're 283
not actually touching the server, we're 284
going to we're doing it from centralops 285
server to the victim, not from our 286
computer to the victim in this case. Next, 287
we're going to talk about ping. And ping 288
is actually used to check the IP 289
connectivity between two network devices. 290
And we often use this in network 291
troubleshooting, but we can also use it 292
in our hacking efforts. So with linux, 293
ping is actually gonna go until it's 294
terminated. When you use it on windows, it 295
only does a count of four. So we can do 296
ping and the domain name, or ping in the 297
IP address, and it will start telling us 298
is that distant end up? We use as often 299
in what's called a ping sweep, where 300
we'll start pinging an entire range of 301
networks to find out who is up and who 302
is down in that range of IP addresses. 303
Here's an example where I'm pinging 304
again my server, JasonDion.com, I did it 305
for a count of six and you'll see that 306
it responded. It send out 64 bytes each 307
time. It responded back with the IP 308
address, and the time-to-live decreased by 309
one, and the time of how long it took, in 310
this case about ninety nine milliseconds. 311
And once again, we can go back to central 312
ops and do this from an arm's length 313
distance. We can do it the same way well 314
tell the domain we want to go to or the 315
IP address, how long to wait for a 316
timeout, how many hops is too many, how 317
many packets to send, and the data size. 318
It will do that information and pop back 319
the display as you see on the right of 320
your screen. The next tool we have is 321
what's called whois. And what whois 322
does, is it provides information on the 323
domain name owner. So we can get things 324
like the server address, the owner's name, 325
their physical address, their phone 326
numbers, and how to contact them. Why 327
might this be helpful to us? We can use 328
this to develop a successful social 329
engineering attack against them. For 330
example, if we know who their web hosting 331
provider is, we can craft an email to the 332
owner of the domain that says "your 333
website domain is going to expire, click 334
here to renew." if they click there, we can 335
use as a way to get into their networks. 336
So here's just a simple whois command: 337
whois JasonDion.com, and up it pops 338
with the information. It tells me the 339
name servers, and some basic information 340
such as when it does expire. If I want to 341
get more details I would go to internic.net, 342
and I can put in the domain name 343
there, or again we can go to central ops. 344
And central ops has what's called a 345
domain dossier. Domain dossier will 346
actually give us the 347
whois record for the domain and the 348
network, the DNS records like we talked 349
about before, and the traceroute, which we 350
talked about before, and the addition of 351
a service scan. We can run all of these 352
from Central ops server, keeping us more 353
anonymous. There's also another function 354
there called the email dossier. And the 355
email dossier is actually going to provide us 356
those mail records we looked up before. 357
It'll do email address validation for us, 358
and we can get the IP and server 359
addresses for those emails, as well as an 360
smtp connection log. So in this example I 361
have titancipher@gmail.com. This 362
is an email I use with a lot of hacking 363
competitions from our students. If you 364
notice here, we can go in there, click go, 365
and we'll see what we get. In this case 366
we see that it has a confidence rating of 367
three which says that this passed a 368
validation of the email. It is a real 369
email address. We could see the MX 370
records, and then on the right side 371
you'll see the SMTP session, where the 372
server from central ops actually 373
talked to Google server to validate that 374
that was a good email address. And you 375
can see the commands that were run there. 376
Another wonderful resource we have is 377
Google. Now I know this seems like it's 378
obvious, but there's a lot of information 379
on the internet that's just open source. 380
We can use Google to search press 381
releases, corporate websites, and 382
everything else at once, and the way you 383
craft your commands in Google can really 384
help you become more efficient as you 385
search for this information. There have been 386
numerous books written about google 387
hacking, including adding things like the 388
file types, or adding or subtracting 389
keywords using pluses and minuses and 390
operators and or operators. There's lots 391
of ways to do what we call google 392
hacking and just getting a really good 393
well crafted search that you can find 394
the information you want quickly. What 395
can we find through google? Well let's 396
get an example of a powerpoint file or 397
an excel file. I can search for that 398
company name and a file type of xls, 399
that'll pop back every spreadsheet that 400
it can find in google. I can take one of 401
those, embed malware, and send it out to 402
an employee as part of a spear phishing 403
campaign. It's going to look legitimate 404
because it was a real file from the 405
company, and it has real information from 406
the company, but I gave them just a 407
little something extra, which is how I 408
can get myself into the network. Social 409
media, so we all love our social media 410
but it is truly a treasure trove of 411
information. We have things like Facebook, 412
and LinkedIn, Google+, Twitter, Pinterest, 413
Tumblr, and many others. This is really 414
useful in doing social 415
engineering campaigns, and spearfishing 416
campaigns against employees and we can 417
really target who we want. For example, if 418
I can find out that the receptionist has 419
a child at a particular middle school, I 420
can send emails crafted as if I'm from 421
the middle school. If I go to LinkedIn, I 422
can find resumes and history. If I go to 423
google plus, I might find some things 424
about what people like to do in their 425
off time, and I can use that to create 426
patterns of life. Again these are all 427
different ways that we can start getting 428
more and more information to figure out 429
how we want to attack this network. One 430
of the tools we're going to use in our 431
lab is what's called creepy. And what 432
crepey allows us to do, is go after 433
networks like Google+ and Twitter. We can 434
actually put in a username, or keywords, 435
and it will find the tweets and the 436
Google+ entries associated with those. For 437
example, we're going to use Titancipher, 438
which again is that made up account that 439
I have, and where there's a twitter 440
account associated with it. We can go and 441
pull all of the tweets that that person has 442
made, we can geo locate them and start 443
establishing pattern of life, time of day, 444
and where they are, and what they do. The 445
next tool is one that comes inside of 446
Kali Linux. It's stored in the scripts 447
folder, and it is a tool written by Lee 448
Baird, it's called Discover. Discover 449
combines many information gathering 450
tools with a single script. It gives you 451
a menu-driven interface. You can run 452
discovere.SH, which is a shell script, to 453
start the script, and then we can start 454
going through and doing different things 455
with it, such as our recon for our domain, 456
our person, or our Salesforce, we can do 457
scanning. We can use iceweazel to 458
search websites, we can crack Wi-Fi 459
passwords, there's a lot of tools, it's 460
about 15 or 20 tools, all shoved into 461
this discover script, and it makes your 462
job much easier. And finally we get to 463
maltego. Maltego is a graphical tool 464
that allows you to do some basic 465
enumeration and reconnaissance. It kind 466
of combines some more of our step one and step 467
two steps of the hackers methodology. 468
Some things we can do is DNS, whois, we 469
could search Network blocks and IP 470
addresses, and we can target individuals. 471
Now the thing I really like about maltego 472
is it does a really good job of 473
visually depicting the relationships 474
between people, information, and the 475
networks they utilize. So, for example, as 476
I'm starting to build a network map 477
based on all the enumeration I'm doing, I 478
can start putting that in and start 479
getting a feel for what it looks like. 480
Maltego does a great job. It also can do 481
things based on interactions, kind of 482
like social media. If you think about the 483
old seven degrees of Kevin Bacon- 484
I know Joe, and Joe knows Mary, then I 485
know Mary by two steps removed. Maltego 486
will start showing you those 487
relationships. By building that it will 488
help me craft better social engineering 489
campaigns, and better exploitation. 490
Maltego is also included as part of Kali 491
Linux. So how do we put all this together? 492
Well, at this point we've collected 493
examples of emails, names, phone numbers, 494
server addresses, documents, presentations, 495
and much more. We've even gotten PDF 496
files, and word files, and Excel, and 497
PowerPoint, and we can embed malware into 498
those. We can use real employee names, 499
positions, and writing styles to mimic 500
their emails. We can take all that and 501
conduct a really realistic spear 502
phishing attack, or if I have a domain 503
name, for instance I own TitanCipher.com 504
for my hacking competitions, I could also 505
buy Titancypher, with a Y, .com. Now if 506
I have that one I can use that as a 507
watering hole. I can make it look just 508
like the original Titancipher.com, but 509
embed malware in there, that way when 510
people come to go to titancipher.com 511
if they mistype it, they go to the 512
incorrect site. So, for instance, if you 513
had google with 3 o's instead of 2 o's 514
or yahoo with 3 o's instead of 2 o's, 515
something like that will allow us to 516
have similar domain names that people 517
can get mistyped and go over to us. Also 518
we can identify subdomains. If we find 519
developer sites, or mail servers, those 520
are possible keys for exploitation. 521
Especially if we can find something like 522
a developer site, because developer sites 523
tend to run beta software as they're 524
developing things. Which mean they have 525
more bugs, and more vulnerabilities. These 526
are just some of the ways that we can 527
find a foothold into the network. Next 528
we're going to put some of these tools 529
in action, and we're going to play with 530
them in the lab environment.