Centralops.net and sites like it are 2
a wonderful resource for the hacker, as 3
it helps to provide some anonymity 4
during our assessments. Centralops 5
allows us to create a domain dossier or 6
email dossier on our victims, gathering 7
openly available information, such as the 8
owner of the domain names, the technical 9
contacts, technical details, and the 10
network range is involved. This is key 11
information that's required for us to 12
gather as we attempt to understand the 13
victim network and plan our attacks. We 14
can use centralops from any computer 15
with a web browser. And since we already 16
have our Kali machine connected to the 17
Internet, that's what we're going to use. 18
So, from our Kali machine we're going to 19
open up firefox. From here we're going to 20
go to centralops.net. So once we get to 21
centralops.net, we're going to go 22
to the domain dossier. So now we need 23
to pick a domain to look up, or an IP 24
address. For our example, I'm going to use 25
AVG. So AVG is an antivirus company 26
located in the Netherlands. So we're 27
going to look them up, and we're going to 28
choose all five options. We want the 29
traceroute, the service scan, the DNS 30
records, the whois of both network and 31
domain, and then hit go. So the first 32
thing we're going to see is our address 33
lookup. And this is just going to do a 34
basic check of the name to the IP 35
address, in this case avg will resolve to 36
two different IP addresses, as displayed 37
here on the screen. After that we're 38
going to see the domain whois record. Now 39
with a large company like AVG, or Yahoo, 40
or Google, or somebody like that, you're 41
not going to get as much detailed 42
information as you would if you had a 43
small business. So in this case we can 44
look at who they register their domain 45
through, which in this case was 46
Markmonitor Incorporated. So we can we 47
can see that and that might play into 48
the spearfishing campaign, but it's 49
probably not real helpful for us right 50
now. We're going to go ahead and uh, 51
scroll down even further. The next thing 52
we're going to come to, is the detailed 53
whois record. And in here we're going to 54
see the registration information, we're 55
going to see who the person is 56
registered to, in our case since, it's a 57
large company, they just put in domain 58
administrator. If it's a small business 59
you'll usually see the owner of the 60
business's name, or their technical 61
support people. You also will get 62
information such 63
as where they are. In this case they are 64
located in Amsterdam, with the street 65
name listed there. You also get phone 66
numbers, this can be useful as part of 67
a pre texting campaign as well. And 68
you'll get an email address, in the case 69
of a large company like this, they 70
probably are not monitoring this address, 71
but its domainadministration@avg.com. 72
If we had somebodies user name in there, 73
for instance Jason.dion@avg.com, that 74
could tell us the naming structure for 75
email addresses that could be useful in 76
a spearfishing campaign, or a good point 77
of contact to use as part of a 78
spearfishing campaign, such as the 79
technical registration point of contact. 80
If we had that information we can use 81
that as a way into the network. We're 82
going to continue scrolling down, see 83
what else we can find. Again domain 84
administrator, domain administrator, not 85
the most helpful thing because again, 86
this is a large company. One of the 87
things I noticed that's kind of 88
interesting is their name servers. If you 89
notice they're using akam.net. Akam 90
is actually a large network service 91
provider. They actually can help prevent 92
denial of service attacks from occurring. 93
So, if that was going to be our strategy to 94
take down this network, it may not work 95
as well. If they're a small business they're 96
probably not using akam, and that may 97
be a way that you can take down their 98
network. But again a denial of service is 99
never used in ethical hacking, there's 100
really no reason for it. But it's something we 101
can consider using our research here. 102
We're going to go down to the network record. 103
Now the network whois is a little bit 104
different. You'll notice here, it actually 105
gives us a range 93.184.217.0 up 106
through .31 is actually 107
being owned and operated by AVG. That 108
means they have 31 IP addresses, 30 of 109
which are routable on the internet. That 110
is 30 possible targets, whether they're 111
routers, firewalls, or actual servers tied to 112
the internet that we could be looking at, 113
if that is within the scope of our 114
assessment. As we go down a little bit 115
further you can notice who actually 116
registered for these IP addresses, Derek 117
Sawyer. So again, that can be a name that 118
we can use as part of a pre texting 119
campaign, it may be a name that we use as 120
part of an email phishing campaign, lots 121
of different uses when we find good 122
names and good email addresses for 123
people. We're going to go down into our 124
DNS records next. 125
So in our DNS records, you'll see the DNS 126
records for avg.com. There's two address 127
records as we saw earlier, we see 93.184.279 128
and then we see 93.184.211.28. 129
These are two different servers that are 130
answering up for the name avg.com. This 131
is probably being done because AVG is 132
such a large company, one server couldn't 133
handle the load, so they have sort two 134
servers that are acting as content 135
switches to provide that service to 136
their customers. And then again we see 137
akam.net as the name servers answering 138
up, so again it's going to be load 139
sharing and helping to handle a large 140
amount of load that would come against 141
those servers. Next we're gonna look at 142
traceroute. 143
So it starts out from the 144
servers at centralops, and goes out 145
across the internet until it finds where 146
it's going. In this case, once we get to 147
the star star stars in line 10 through 148
13, that usually where it hits firewalls, 149
and some companies will not respond to 150
pings or traceroutes, and the reason why 151
is they don't want you mapping their 152
network. So we know they have at least 153
some firewalls, and some border security 154
there, again we already figured that out 155
because of the akam.net being the one's 156
answering up for their domain name, so we 157
know that they're pretty secure. Now 158
we'll move on to the service scan. And 159
here in the service scan you'll see that 160
ftp timed out, smtp timed out, web 161
browsing port 80 is open, pop servers, imap 162
servers, and https all have timed out, and 163
this is pretty typical when using a 164
large company like AVG. So let's do 165
another domain dossier. This time we're 166
going to use a small business. From 167
domain dossier, I'm going to go to 168
Titanpcipher.com. And I'm going to use 169
service scan and traceroute, and then hit 170
go. Now tightencipher.com is a domain that 171
I own. It's hosted on a small server, it's 172
used that on a wet, a wordpress platform, 173
which is actually hosted by Bluehost, and 174
as we go through you're going to see 175
that. It's going to look a lot different than the 176
AVG answers we got last time. So in this 177
case we have a single IP address, which 178
is answering up for Titancipher. If we go 179
into the domain records, you'll see that 180
it's bluehost.com, that tells me who 181
they're using, and the fact that they're using 182
Bluehost tells you 183
they're probably using WordPress as 184
their platform, because bluehost is known 185
for that. So if you can find 186
vulnerabilities in WordPress, you can 187
then use those against that particular 188
domain. Next we're going to scroll down 189
and you'll see more information about 190
the actual person who owns it, their name, 191
their address, their phone numbers, their 192
email addresses, all information that 193
could be useful again for a spear 194
phishing campaign or something of that 195
nature. Network whois. So network whois 196
again, that's going to show us who owns 197
the IP addresses. In this case, it's 198
actually owned by Unified Layer Networks. 199
They own a large block, then they've 200
given part of that block to Bluehost, who 201
then gave a single IP to Titancipher.com. 202
So if you notice here they have a 203
class A address, so with the /16 they're 204
going to have over 64,000 IPS. You don't 205
want to just go in there blindly and 206
scan 64,000 IPS if you're targeting one 207
Titancipher.com, it wouldn't make any 208
sense. So this is going to help you 209
identify who owns the network, and what 210
parts of the network there are. We're going 211
to scroll down a little further, and we're 212
going to find, and we're going to find 213
the dns records. Now the dns records here 214
are going to show us that there's a name 215
server answering up, bluehost.com. 216
Titancipher is being answered up by Bluehost 217
who is their provider. They do have a 218
mail server, mail.titancipher.com. They do 219
have a name server, second name server, on 220
bluehost. We also see their a records, 221
which is their IP address. Next, we can 222
look at the traceroute. This traceroute 223
you see looks a lot different than the 224
traceroute we saw with AVG. In this case 225
everybody has answered up. We get both 226
the IP addresses, and the fully qualified 227
domain names, so we know every single 228
piece between centralops and that 229
particular server that's answering up. 230
Now notice the last server that answers 231
up, that .193. Something quite interesting 232
here, when it resolved, it didn't resolve to 233
tightencipher.com. Can you guess why? 234
Well the reason why is that this just 235
shows us that it's a shared server, it's 236
not owned exclusively by Titancipher. 237
In fact it's owned by unified layer who 238
owns Bluehost. So there may be 20, 30, 40, 239
50 different websites on this particular 240
server, Titancipher is just one of them. 241
Now that's important to know, because if 242
you try to have titancipher.com 243
you may not be hitting Titancipher.com, 244
you may be hitting some of 245
these other servers in there and if you 246
do that, you'd now be breaking the law, 247
because you were only hired for an assessment 248
by this one company. So you have to be 249
very careful when you start looking at 250
where they're hosted. This is really 251
important information when we look at the 252
domain dossier. Next we're going down to 253
our service scan. In the service scan 254
you'll see that they're using FTP, that's 255
a known vulnerability for us. And it even 256
tells us what type of ftp, in this case 257
pure ftpd server. That's an important 258
piece of information that we could use 259
if we were going to hack this company. 260
SMTP times out, therefore it's not 261
answering up for smtp. That's good to 262
know, don't throw any smtp attacks. They're, 263
they are running a web server. They're 264
running nginx 1.10.2. We now 265
know the version number and the software 266
they're using. That's useful to find 267
vulnerabilities. Again, all we're doing 268
here is information gathering at this 269
point. Pop3 server does answer up, so 270
there is something listening there. Imap 271
143, another mail server. It's answering 272
up as well, things that we need to take 273
note of. 274
If we get into their secure site 275
we see port 443, secure HTTP server. So 276
it's secure HTTPS we can see their ssl 277
certificate here, they're using a sha256 278
RSA token as as their server validation. 279
That is information that it can be 280
useful. Bluehost.com is the ones who 281
gave them that information, so we might 282
be able to use that as part of a 283
spearfishing campaign again. You can see 284
the fact that we have apache running as 285
the server, you see that there at the 286
bottom HTTP 11 200 ok server apache. 287
Again more information that we want to 288
take note of. They also have a PHP 289
session ID, that's something else that we 290
can take note of. We see 291
JasonDion.com/WP. 292
WP usually stands for WordPress, so that 293
could be vulnerabilities we could take 294
care of. So these are all different 295
things that we can look at as we move 296
forward in our exploitation later on. The 297
next thing we're going to look at is our 298
email dossier, and we'll just click on 299
that. And then we're going to give an 300
email address that we want to test out. 301
If we have email.test@hotmail.com for 302
instance, let's see if that's a valid 303
email address. Click go, we find out that 304
it is a bad email address because it was 305
rejected by the server. 306
Now instead if I use an email address 307
that I think is valid, for instance 308
titancipher@gmail.com 309
hit go, we'll see that 310
this passed the validation test. As we 311
scroll down we'll see that it actually 312
found the MX records for Google for that 313
particular address, and when it tried to make 314
a connection over smtp to google to say 315
does this email address exist, we can see 316
that it did come back and say that it 317
was successful, right here, showing us 318
that that was a good valid email address. 319
Let's try another one. What if we had one 320
like titancipher23@gmail.com, 321
let's see if that's a valid email 322
address. We hit go, bad address does not 323
exist. So if we try to start sending 324
spear phishing emails towards 325
titancipher23@gmail.com, they would just get 326
rejected. But Titancipher@gmail.com does 327
exist, it would be a valid address to use. 328
Where this becomes helpful is when we 329
start looking up information on the 330
company. For instance, if we go back to 331
AVG, if we think they're naming scheme 332
was first name dot last name, and we 333
found a name of someone who we think is 334
an employee, John Smith, we can try in 335
here john.smith@avg.com, and see if it 336
comes back as a valid or invalid address. 337
This will help us know what is good 338
addresses and what are bad addresses. If 339
you start sending a lot of emails to a 340
server with bad email addresses, that 341
server will start realizing that it is 342
spam coming from your address, and 343
they'll block you down. You always want 344
to be targeted in your approach, you 345
don't want to just shotgun things. You 346
want to be precise like a sniper. This is 347
just one of the tools that you can use 348
during a reconnaissance phase. There's 349
literally hundreds of different tools 350
available out there, but this is just one 351
that I particularly happened to like. I 352
recommend you try out various tools to 353
figure out which one works for you and 354
your style. Now during the rest of our 355
course we'll be skipping over the 356
reconnaissance phase. This is because our 357
virtual lab we built is separate from 358
the internet, and therefore there 359
simply won't be any openly available 360
information available for us to find. 361
This lesson was to show you the process 362
an attacker goes through in collecting 363
some of the basic information they need 364
in order to develop their attacks. 365
Now that the reconnaissance is complete 366
we're going to move on to phase two. 367
The scanning and enumeration phase.