We spoke about how to search for some technical information.
And as I keep saying you're going to see later on how to utilize those information even if they are
not set clear so far but still we're going to see how to use some tools to get advantage from this information
to achieve our objective.
In this section are in this lecture I'm going to talk about gathering information about people.
Now there is a different way for doing that some way.
I will not explain like using social network so you can go to Facebook and search about a specific person.
What is his hobby where his work or even things like Linkedin account or you can get his full profile.
This is very useful in social engineering.
You're gonna see how.
But what I'm going to show you I'm going to show you some Web site and some tools that allow you to
get even deeper information about people.
So now let's start with a simpler simple way.
If we are searching for information about people who work in easy comes off so I need to get their e-mail.
There is some tool for doing that.
But let me do that in a simple way first then I'm going to go and explain a very important intelligence
tool and show you how to do that in an automated way so you can search on Google.
I mean I know that I'm looking for people who work on for instance is it comes so I can search can open
Google and I can search for at easy council dot org right.
And that's mean I'm looking for any e-mail an easy council dot org.
This is an easy way for doing that.
So if you keep searching definitely you get some people working on easy concepts or you just need patience
and penetration testing in general need someone you know that has patience because you spend time searching
and so that's you.
Are we getting anything.
Of course using the tools that we're going to explain in this section would be much more easier.
But I'm just showing you that people are posting e-mails and are posting contact information and different
tips.
So here we go.
This is an e-mail for someone working there is a some other e-mail.
Here you go.
So you can get people working on a specific company just by searching ads or domain name.
Right.
We have a couple of pictures to show you how to properly use Google for session.
I mean we all are using Google Google for session.
But if you use some operator you can get actually very very deep information.
We're going to see that in this section I'm going to have two specific lecture about Google hacking
but we can start with that.
But we have some specific Web sites that allow you to search for people for instance.
We have a site called people but it's written this way.
So if you go to this Web site and you search for or research using anything you know about anyone you
know here's an email.
A phone number.
User name.
You know you will see the amount of information because he's searching everywhere.
So you can like use this Web site and you'll be amazed.
I mean I search for myself.
He get me all my history.
You know where I was living before where it's quite amazing actually.
So this is actually one of the Web site.
This is a global.
There is a specific Web site only for U.S. people.
It's called Zorba search Serbia
search.
And in Zorba search
let's see this is only for us.
So for myself I lived in U.S. for a while.
So let me type my name
and let's search so you'll get all my address where I lived all my numbers and the locations this is
for free.
You know the address and the number and everything.
And if you paid me just increase the screen size for you you can even get more like employment history
or credit history or properties.
And you know so it's it's quite interesting.
You know this information is that you can get about people.
So this is also another Web site.
So
many Web sites will allow you to you too to get information personal information.
Now the question is I'm doing the penetration testing.
How that can be useful.
How getting personal information could be.
Let me tell you that 70 percent of today's attacks it measures attacks that we are hearing about like
Yahoo and and Sony and RSA.
All of those attack has been done through people because they have very strong infrastructure they are
spending a lot of money on security.
So the only weakness was people.
So if you are able to collect some information maybe I can use a fake e-mail to send to one of the employees
and showing it's coming from his manager and ask him to download the PDA.
Fine.
And once you download the PDA file I mean it's quite easy.
You're going to see that.
So what I'm saying is personal information is very important to understand or to get information about
people who's working as a company to get information about their profile what they are doing and so
on.
Now instead of searching manually here and there I would like to introduce to you a very very powerful
tool called multiple.
This is called an intelligence tool for reconnaissance.
And this tool will allow you to actually gather much more information in an easier way instead of searching
on different Web site.
It's a very very powerful tool.
So let's see how to use multiple.
So I'm going to show you how to start from here and then I'm good at few lectures about multicore but
I believe this is a very very powerful weaknesses too.
So if you go to application and you go to information gathering you will find multiple here sorry submission
because you will find multiple here.
And if you are using multiple for the first time you need to create an account.
It's free.
They have two different Ed. They have
the community edition which is free and they have a professional edition which is paid.
So this is multiple.
And we are going to see how to use it in the upcoming lectures.