Gathering information about your victim.
It's a very important phase.
During penetration testing if you spend enough time gathering information passive and active you can
guarantee that you will be able to compromise as much system as you can and to have a very effective
plan while doing penetration testing.
So please don't get boring from the amount of information that we are gathering because later on you're
going to understand how those information will be utilized to compromise different system.
So what should we look for when we are doing a passive information gathering.
We are looking for two types of information.
We are looking for technical information and we are looking for personal information technical information
can be used for different technical attack while personal information can be useful social engineering.
Your objective is to show to your customer that you can compromise the system.
This can be done technically or this can be done screw people that they are working in this organization.
So it's not just the technical rule.
I mean we are looking for all kinds of weakness.
We are looking for network weakness application weakness people weakness.
So consider that.
So as much information as you can get we're going to see later on how to utilize those to do a good
and effective penetration is now assuming that I'm looking for information for a company called Easy
comes now.
What I'm doing right now does not request any permission from easy counselor because I'm just getting
information from public records that is available from anyone.
That's why this is a passive phase.
I am not interacting with my victim in any way.
So as we mentioned you can go to the Web site and you can check what they are offering their location.
How good is the Web site.
But let's go a little bit deeper.
Okay I can go to some Web sites that may help me get some more information about is he.
So let's start with who is and who dot is will get you information about the domain name.
I mean to whom this domain is registered so if we go here and you type the domain name every w not easy.
Cancel the order
and let's see
what we are getting here.
So what should do that right.
Oh I'm sorry.
One more time.
Easy
answer dot org
and let's see what we get.
So let me just increase the screen a little bit so you can see what I'm talking about.
So I can see this domain.
You know it's registered.
Since when.
And it expired one expert in 2013.
And when it has been updated so it has been registered since to 2014 and this is actually not very old
domain.
So you know this could be an indication it give you the DNS name server and you're going to see later
on how knowing the DNS server are important it give you as the registration information where the company
is located.
Do they have a contact number.
The email of the administrator is so you can see this is the address and this is the phone number.
And here there is an email.
Maybe this is not the right e-mail.
Actually this is a network solution e-mail and some the domain provider will not publish sure personally.
But actually this is rare.
I mean we're gonna check out our Web site you may find an e-mail for a contact person.
This is a very important piece of information.
And so on what else we can get.
So if we go here to the Web site info you can also get
the Sony what is it
is three DNS records.
I need to get XXX IP so see what we have here.
Okay
I'm gonna show you in a few seconds how such a small piece of information can lead to a lot of problem
for this company.
So nothing is here.
Web site info
cause there is a lot of advertising because it's a free Web site so you should expect it anyway.
Let's see another Web site that also will give me more information.
So I'm gonna see who is that.
See this is called Who Is search you are searching about so domain.
So who is dot SC.
And here you can type the domain name is it.
I'm going to type easy
soon.
Or
and let's see here what we can.
And by the way this is important.
While you are searching do not just depend on one tool or one Web site.
Just use a different tool and different Web site.
And here.
No I'm keep writing the wrong domain name you just make sure that I'm getting
easy counsel.
I didn't try to.
About that.
And let me copy it.
So here you can see also some information.
This will include the IP of this website and IP is not hard to get.
I mean if you're ping on the Web site you get the IP and you can see that there is two or three other
sites hosted on the same server.
This is also very important because later on you're going to see there is some common showing you different
site on some server.
And sometimes if the site is secure you can try to compromise another site on the server and then access
the server and then get to the secure Web site
the registration information up here contact number e-mail contact person.
So this is some piece of imports.
Now how is this information can be useful.
I'll give you a small example.
For instance if an e-mail was found here the admin e-mail you can compromise this e-mail.
And according to that request a password to be sent to your to be sent to the admin e-mail that you
already compromised and then you have access to the Web site.
This is one way for doing that.
Some people are following the expiration date especially if it was a big Web site.
And once the domain expires they will give one months and then the domain will be available.
Anyone can buy it.
So they will buy it and they will try to negotiate.
Actually this is not considered illegal because you know you're just getting the opportunities to look
for important Web site.
And so some information can be get from me.
Some information can be manipulated from it.
But this is actually very important information.
What else I can get about is Eakins council Web site.
I can check their server.
The Web site is hosted on which server and how many domain do they have.
And we're going to do that by a Web site called Net craft
now.
Whatever I'm doing.
It's available on different Web site.
I mean do not stock monuments on the sites that I'm sharing with you.
But if you are getting the concept you can search for any other Web site that do the same.
So net craft is an extremely important Web site.
It will give you the technical platform of a specific domain.
So I'm interesting in easy comes I'm going to type here.
Easy
so good.
And I'm going to search for this domain and let's see what what I can get from here.
Just increase the size.
So as you can see I can see that they have a spindle is it comes with dot org.
And this are
hosted on a server that run Linux.
I can see that they have WW is it comes to dot com and this is also Linux.
I can see different some of them are on Windows Server 2008 you know.
And actually this is a specific site that sometimes shows that actually in bank Web site I was searching
after getting of course an approval for the bank Web site.
And I was searching for on which operating system the site is hosted and I found that it's hosted on
Windows Server 2000.
So if you find that it's hosted on 2000 and 2003 I said this is can be very very easy to compromise.
So also this piece of information it's quite important now know how many domain it got and use a different
platform that is running and everything I've done so far is passive information.