RECONNAISSANCE The Reconnaissance phase, aka Footprinting, is the most important phase. This is the phase where you gather all the information on your target. What can possibly make or break your success is in this stage. If you take the first idea that pops in your head and attack your target, you will most likely fail. In this phase you will need to spend months gathering data on your target to find a vulnerability and be successful. You will need to perfect this skill to be a ethical hacker. Active Reconnaissance - in this search you directly interact with the computer system to gain information. This type of information gathering will leave your digital footprint to be traced back to you. If at all possibly try and avoid this type of scanning. Passive Reconnaissance - this type of search you are not directly interacting with the target. This way you don't leave any foot prints that will lead back to you and get you in trouble. Organizations has a plethora of information available on the web, you just have to know how to search for it. This first trick I am going to discuss will be a passive attack and it does not work on every web browser. First go to google's main page, if your using another browser like duckduckgo, and in the search bar type in "football", your first link should be NFL. Look for the web address, www.nfl.com, now just to the right of the address will be a drop down arrow. Click the arrow and you will see the word "cached", click the word and now you can search the website passively without leaving any footprints. If you click any links on that cached page you will go to a live site and leave a footprint. The next passive attack I will discuss will be cloning a website. Kali and other apps will let you clone the website and then go offline to do research. This way you are not actively interacting with the website, you are scanning a copy of it and your offline. If you did not know about it google has web crawlers that scan every website, unless blocked by the robots.txt, and keeps a copy in archives. You can access these archives and research more on your target without leaving any traces. Google Cached Page - Google Cache is normally referred as the copies of the web pages cached by Google. Google crawls the web and takes snapshots of each page as a backup just in case the current page is not available. (https://cachedview.com/) Archive.org Cache - The Archive.org, also known as Wayback Machine, is a digital archive of the World Wide Web and other information on the Internet created by the Internet. The service enables users to see archived versions of web pages across time, which the Archive calls a three dimensional index. You can use either of these to research your target without getting in trouble. If you saw something listed on a website and the next day it is gone you can go to the archive and examine it further in depth. There are many ways to use this technique to your advantage. During the recon phase you will be gathering information on the company, employers and third party vendors. Here are some things you will need to search on your target. Information gathering about the target: Most important I.P. gathering Search public information, gather as much info without sending a single packet Physical address Phone Number Fax numbers Email Addresses Hours of Operation Business Relations: 3rd Party Employee Emails/Name Social Media Connections News and Announcements - Merges Job Postings Job openings (software, Hardware, Network related information) When researching a company I like to check the job postings first. The company will spill their guts out if you will just take the time to read. Lets examine this job posting: Responsibilities: Analyzing network errors or anomalies, as well as specific network performance issues and/or error messages, in order to ensure maximum uptime and service quality and assess trends that may ultimately result in degradation of service -- Analyze and configure VOIP network traffic to ensure high quality of service and high availability Formulating and implementing monitoring, policies, procedures and standards relating to network management -- Manage and work with 3rd party vendors to procure and maintain network devices, assist in cost analysis to ensure highest value to Sage Intacct Troubleshooting API and other system issues at a per-packet level via packet trace and sniffer analysis, including the troubleshooting of 3rd party data integration services and/or other Web-enabled solutions Participation in a 24x7 on-call rotation on a periodic basis; this requires functional knowledge of all Sage Intacct network devices, domain controllers, VPN and subsystems outside of the networking layer in order to provide on-call support Requirements: -- BS/BA degree, or equivalent work experience, CCNP certification preferred 5+ years direct experience required in the management and administration of network infrastructure - routers, switches, load balancers, SSL acceleration technology, etc. -- 5+ years experience with network protocols for routing and access, including but not limited to: BGP, IS-IS, OSPF, RIP, EIGRP, RADIUS, TACACS, STP, etc. In-depth knowledge of TCP/IP and BGP an absolute requirement -- Extensive working experience with Cisco ASA 5500 series, Dell N2000 and N3000 switches Experience with VPN remote access and PTP VPN tunnels Experience with multi-site routing, peering, and disaster recovery network architectures Experience with the use and implementation of enterprise monitoring and management frameworks and tools Experience working in structured change management processes for highly available datacenter networks -- Familiarity with WiFi standards and experience managing wireless network configurations, Cisco Meraki experience is a plus Firewall/security experience (ACL, GRE/IPsec tunnels, FWSM, IDSM2, and secure remote access/management practices) -- Experience with Palo Alto Networks firewalls is a plus -- Familiar with one or more of the following monitoring tools: Zabbix, Nagios, PRTG or Cacti Education and Certification Requirements: Preferred – Bachelor’s degree (computer science, business administration or related field) or equivalent experience Preferred certifications Cisco CCNA or CCNP Palo Alto Networks PCNSE The second line under responsibilities I placed 2 tick marks by it, the company asks you to be knowledgeable with VOIP. The first thing that pops into my head is Wireshark. Wireshark captures packets as they go across the network and when the company uses VOIP it is turned into a packet and traverses the network. Wireshark will capture that packet and you can listen to the phone conversation. The next tick mark I made deals with 3rd party vendors. Always check for 3rd party vendors since they have access to the company you are researching. If I want to hack a company and their security is super tight, fort knox, I will attack the 3rd party vendors and then access the company. The next couple tick marks as you see the company asks for people knowledgeable with Cisco Networking gear. They also go in-depth about what equipment they are using, Cisco ASA 5500 series, Dell N2000 and N3000 switches, so they are telling you right there what they are using. The 6th tick states familiarity with WIFI and Cisco Meraki is a plus. This tells me I could possibly gain access to their network threw WIFI, and they are using the cloud so I should research the clouds weakness. The next tick states experience with Palo Alto, which is a used to prevent cyber attacks. The last tick tells me all the network monitoring tools they use. How nice of them to give me all this information. Now I research each of these ticks in-depth and find weaknesses. Take for example, Nagios monitoring system, go to your web browser and type in "Nagios vulnerabilties", there is 247,000 results. I am sure we can find some good information if we dig deep enough. Right off the bat they talk of Cross Site Scripting(XSS), SQL Injection, Remote Code Execution(RCE) and Privilege Escalation. We will discuss these topics more in-depth at a later time, but just wanted to show you how much information is on the web. Physical addresses - come in handy when you want to go dumpster diving or digging in the trash. Trash is free game, you can go threw it and the owners can not say a thing, but if they have a fence around their dumpster or their business then you are trespassing. Kevin Mitnick said he went threw AT&T's dumpster and found a bag full of shredded paper. His team took the bag to Starbucks, grabbed some coffee and dug into the bag. After they pieced everything back together, they had each employers name, email and password. Word to the wise, BURN your important documents. You can find a lot of information in dumpsters that can come in handy later on, which ill discuss more on Dumpster Diving later on. Email addresses - Most companies follow a pattern when dealing with email accounts. Each company can be different so during your research grab a couple different email addresses to study. The thing you are looking for is the format the company uses, Jon Smith@XXXXX or JSmith@XXXXX or is it SmithJ@XXXXX after you figure the pattern out then start a brute force attack on the email account, ill discuss other ways using social engineering later on. Hours of operation - lets make sure when we start our exploiting stage that workers are not still at work. Business Relations - find all the 3rd party vendors Social Media - Check facebook, linkedin, and other social media for information on your target. Check the employers facebook page for information. They might talk about issues at their job or even seen a posting where the I.T. guy said "Have to pull an all nighter, our firewall went down". Thanks for the tip my man. New and Announcements - Watch for upcoming events that you could attend to gather more information, especially watch for "MERGES", when companies merge they are vulnerable. The network might have issues, company equipment might fail the possibilities are endless. Look how corona has changed so much, "As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from Zoom".....ZOOM ? Zoom vulnerabilities ? researcher Mazin Ahmed, who presented his findings at DEF CON 2020, the company also left a misconfigured development instance exposed that wasn't updated since September 2019, indicating the server could be susceptible to flaws that were left unpatched. After Ahmed privately reported the issues to Zoom in April and subsequently in July, the company issued a fix on August 3 (version 5.2.4). Wait did you catch it? read it again...... He told Zoom they was vulnerable to an attack in April and they did not patch the issue till August....so for 4 months Zoom was open game. There are groups you can join, might be for a fee, that receives these issues and usually it takes around a year for the patch to come out. So that says you could find out the companies vulnerabilities and have about a year before they issue a patch. Some places to do your researching at: News and Groups Bulletin Board Systems Facebook Instagram Twitter LinkedIn Bing Dogpile Google Yahoo Webferret - https://download.cnet.com/WebFerret/3000-2379_4-10002998.html EDGAR - Publicly traded companies ( https://www.sec.gov/edgar.shtml ) groups.google.com Best People Search: SwitchBoard ( https://inter800.com/switchboard/ ) GooleFinance ( https://www.google.com/finance ) YahooFinance ( https://finance.yahoo.com/ ) blackbookonline.info ( https://www.blackbookonline.info/ ) Reunion.com Classmates.com ( https://www.classmates.com/ ) Plaxo.com ( https://en.wikipedia.org/wiki/Plaxo ) Zaba Search ( https://www.zabasearch.com/ ) Spokeo ( https://www.spokeo.com/ ) pipl.com familytreenow.com thatsthem.com luller.com WARDIALING: phonenumber.com 411.com yellowpages.com Wardialing - is a technique to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for modems, computers, bulletin board systems (computer servers) and fax machines. There are to many ways to list all the possibilities with this technique. The major one I will talk about is Fax Machines, this is the place you should attack and hard. Fax machines are sometimes still hooked up to dial up if your old enough to even know what that is. Fax machines has weak securities and in big companies they have employees email addresses and passwords stored. Around 10 years ago I think it was, the terrorists was buying all of the militaries copying machines, come to find out even after erasing the memory you could still pull up all the information the military was scanning, that included social security numbers, addresses and more. Anyone need a Fake Passport, CC, or ID ? Another thing to research is for an offsite storage building. Major companies store their backup data at another location incase a fire breaks out or a major catastrophe happens. This way the backups will not be damaged and the company can be back up and running in minimal time. The term you might hear or search for is Hot, Warm and Cold Sites. Hot site means it is up and running, Warm site means it can be up in a short time, and Cold site will take awhile for it to get running. These buildings are where the companies store there backup data and usually is not guarded making it a easy target to get information from. Google Earth to see target: Google Street car drives around the country recording data, WIFI, MAC addresses ( https://www.google.com/streetview/ ) API at shodanhq.com/research/geomac ----Blackhat 2010 Sammy Kramkars " How I met your girlfriend" ( https://www.wired.com/2015/12/the-greatest-hits-of-samy-kamkar-youtubes-favorite-hacker/ ) This is a older technique, but sometimes still works, Extract DNS - Zone transfers. DNS servers are an excellent target for hackers and penetration testers to gather data from, the information is considered highly valuable to attackers. This contains a full listing of internal IP addresses that belong to our target. We will dig deeper later on. Go to the companies cloned site, right click the main page and click "view source" and "inspect element". Sometimes people that code the website leaves notes to themselves so they wont forget, but then forgets to remove the notes. Some admins might leave passwords in there or issues they was working on. Every little bit of information will help. Search for VPN's to connect to companies or individuals Search for: Company Resume firewall Google Resume firewall So I searched for Chevron Resume Firewall, and it showed me a Resume of a person that worked at Chevron or was applying for a job at Chevron. Study his qualifications, this might tell you more information about what equipment they have at the targets company. Send a email with a empty .bat file. Once rejected break down the rejection for vendor, version of anti-virus, inspect the header for IP, software brand of email server running Offline Browser - Teleport Pro - https://en.freedownloadmanager.org/Windows-PC/Teleport-Pro.html Multiple Search Engines: All-in-one ( https://all-io.net/ ), Dogpile ( https://www.dogpile.com/ ), groups.google.com Advanced Search in websites - AltaVista ( http://ca-en.altavista.com/ ) Sites to research recent cyber attacks: https://www.malware.us-cert.gov/MalwareSubmission/pages/submission.jsf https://www.usa.gov/federal-agencies/computer-emergency-readiness-team https://nvd.nist.gov/ https://www.securitytracker.com/ https://securiteam.com/ http://www.hackerwatch.org/ https://www.securityfocus.com/ https://www.scmagazine.com/ https://www.w4rri0r.com/vulnerabilities-attacker-surface.html https://www.wired.com/2015/12/the-greatest-hits-of-samy-kamkar-youtubes-favorite-hacker/ https://owasp.org/www-project-top-ten/ https://www.veracode.com/security/owasp-top-10 Learn how hackers are attacking companies so you can be up to date and learn how to defend it. I am briefly going to talk about Google-Fu or Google Hacking. Looking up information can take a lot of time and when you hit that enter button on whatever you are researching and it says 565,000 results can be discouraging. So how you list your topics of search in the google search bar determines the result factor. There are ways to cut the results down to a fraction and save yourself a lot of time going threw all the threads. I chose to research Emmitt Smith: emmitt smith - About 2,790,000 results black male/emmitt smith - About 1,390,000 results Dallas Cowboys/emmitt smith - About 1,130,000 results So the more information I added google honed in more and I had less results to parse threw. You can narrow it down even further with the right knowledge. Here are some ways to better your research and lower your results. intitle or allintitle: intitle - search word is within the title. allintitle - only return websites that contain all the keywords in the webpage title. Example allintitle:index of ***** URL - inurl:admin - reveals admin or configuraton on targets website Filetype:PDF Combine them - site:dsu.edu filetype:PDF Term Action filetype: Search for a file by its extension (e.g. PDF) cache: View Google's Cached version of a specified URL intitle: The specified phrase MUST appear in the title of the page Johnny Long has a great book out called "Google Hacking for Penetration Testing" (download for free at pdfdrive.com) or watch the presentation Johnny Long gave at Defcon 13 ( https://www.youtube.com/watch?v=fo1BR9itwOY ) Start researching more indepth on each of these topics and take notes in a composition notebook, they run around a dollar each. I have a notebook for each phase and write everything that I find of value inside them. This way when I engage a target, I pull my notebooks out, run down the lists, fill in the blanks and this makes it so much easier because as we get older and learn more things we forget older things. Start practicing on overthewire.org, start off with Bandit and complete the 34 stages and then move to the next playground, I think there are 17 playgrounds on overthewire to learn from. Capture the Flag (CTF) competitions can be rewarding, soul destroying and intimidating all at the same time. I’d strongly recommend getting stuck in and signing up to CTFs as soon as possible. Don’t wait until you’ve mastered a specific skill as CTFs are a brilliant learning resource first and foremost. Set aside time every week to get onto a CTF and treat this time as sacred. Don’t let anything distract you away from this time slot if you can help it! Consider joining a CTF team to enhance your pool of learning resources. There are always teams looking for new members. The “OpenToAll” team is one that comes to mind, who are now at an astounding 300+ team members. Here are some tools to research that you will use during the Reconnaissance Phase: HTTrack - Makes a offline copy of the website Blackwidow Pro or Wget can extract complete copy of website The Harvester Whois.net Netcraft Host NSLookup Dig MetaGoofil SEAT Maltego SamSpade NetScan GTWhois XWhois Archive.org Trellian Web Investigator MyReputation BiDiBLAH Big Brother Advance Administrative Tools Wikto ActiveWHois Spiderfoot Msr Strider URL Tracer WTR -Web the Ripper 2 Dirbuster Wget - Linux/UNix Teleport Pro - Windows Athen 2.0 SiteDigger Traceroute Search engines for Hackers: censys.io shodan.io viz.greynoise.io zoomeye.org netograph.io wigle.net intelx.io fofa.so hunter.io haveibeenpwned.com As we go along we will add more to this phase and discuss the topics more. So do some research, dig into these topics and if you have any questions ask one of us. Updated 11/24/2020 Username search tools #OSINT https://t.co/hzHoHiDbFB https://t.co/6vE7pCI5Q8 https://t.co/0gOGizBPIG https://t.co/XeS26gkzzu https://t.co/wMW7nFZCNa https://t.co/GbmYe47gtO https://t.co/fEAARCFsAU? https://t.co/heIvHUWeuQ https://t.co/mRerIKvDht https://t.co/qYO1k6TOWx https://t.co/p4eVgqZixX https://yandex.com/ http://www.mavetju.org/unix/dnstracer-man.php https://www.maltego.com/?utm_source=paterva.com&utm_medium=referral&utm_campaign=301 https://null-byte.wonderhowto.com/how-to/use-spiderfoot-for-osint-gathering-0180063/ https://www.spiderfoot.net/ https://hakin9.org/buster-an-advanced-tool-for-email-reconnaissance/ https://hakin9.org/people-tracker-on-the-internet-osint-analysis-and-research-tool/ https://www.entireweb.com/ https://www.lycos.com/ https://www.teoma.com/ https://millionshort.com/ https://www.offensiveosint.io/offensive-osint-s01e01-osint-rdp/ https://www.martinvigo.com/email2phonenumber/ https://www.secjuice.com/artificial-intelligence-ai-and-osint/ https://phonexicum.github.io/infosec/osint.html https://www.reversephonecheck.com/ https://www.kitploit.com/2020/06/sifter-74-osint-recon-vulnerability.html https://www.tracelabs.org/initiatives/osint-vm https://osint.link/ https://www.bellingcat.com/resources/how-tos/2019/12/26/guide-to-using-reverse-image-search-for-investigations/ http://www.faganfinder.com/filetype/ https://www.yippy.com/ https://github.com/jivoi/awesome-osint (EVERYTHING) https://github.com/Z4nzu/hackingtool (EVERYTHING) https://github.com/infosecn1nja/Red-Teaming-Toolkit (A TOOL FOR EVERY PHASE) https://osintframework.com/ (CLICK THE BLUE DOTS) https://github.com/PaulSec/API-dnsdumpster.com https://github.com/JoeWrieden/AutomatedOSINT https://github.com/0xApt/awesome-bbht A bash script that will automatically install a list of bug hunting tools that I find interesting for recon, exploitation, etc. (minus burp) For Ubuntu/Debain. https://github.com/jakejarvis/awesome-shodan-queries https://github.com/Cignoraptor-ita/cignotrack https://github.com/m0rtem/CloudFail https://github.com/OWASP/D4N155 https://github.com/darkoperator/dnsrecon https://github.com/ex0dus-0x/doxbox https://github.com/sandialabs/dr_robot https://github.com/ChrisTruncer/EyeWitness https://github.com/thewhiteh4t/FinalRecon https://github.com/ElevenPaths/FOCA https://github.com/obheda12/GitDorker https://github.com/Sachaaaaaa/Grhoth https://github.com/khast3x/h8mail https://github.com/m4ll0k/Infoga https://www.osintcombine.com/instagram-explorer https://github.com/instant-username-search/instant-username-search https://github.com/ChrisTruncer/Just-Metadata https://github.com/pielco11/JungleScam https://github.com/initstring/linkedin2username https://github.com/laramies/metagoofil https://github.com/MISP/MISP-maltego https://github.com/ninoseki/mitaka https://github.com/AzizKpln/Moriarty-Project/ https://github.com/HA71/Namechk https://github.com/th3unkn0n/osi.ig https://github.com/milo2012/osintstalker https://github.com/sundowndev/PhoneInfoga https://www.youtube.com/watch?v=WW6myutKBYk https://copycookie.com/phoneinfoga-advanced-information-gathering-osint-framework-for-phone-numbers/ https://github.com/s0md3v/Photon https://github.com/nethunteros/punter https://github.com/m8r0wn/pymeta https://github.com/dchrastil/ScrapedIn https://github.com/thewhiteh4t/seeker https://github.com/HA71/sherlock https://github.com/kpcyrd/sn0int https://github.com/SpiderLabs/social_mapper https://github.com/laramies/theHarvester https://github.com/krmaxwell/tinfoleak https://github.com/jofpin/trape https://github.com/Ekultek/WhatBreach https://github.com/inurlx/XSPID3R Photo location search #map #geo #OSINT #SEO #infosec http://oldto.sidewalklabs.com/ http://locationscout.net/ http://shothotspot.com/ http://whatwasthere.com/ http://hotogrammar.yale.edu/ io search engines #osint #seo #infosec #search http://darksearch.io/ dark web http://scinapse.io/ academic http://fnd.io/ itunes & app store http://redditsearch.io/ reddit http://filefactory.filesearch.io/ files http://keywordtool.io/ keywords https://inteltechniques.com/JE/ https://technisette.com/p/tutorials https://i-sight.com/resources/101-osint-resources-for-investigators/ http://browsershots.org/ https://www.uk-osint.net/ OSINT YouTube Videos https://www.youtube.com/watch?v=WW6myutKBYk Using phone numbers to gather info https://www.youtube.com/watch?v=SMxya-M6KhU Different tools https://www.youtube.com/watch?v=SvL9bpsY-ZQ Finding info in various ways https://www.youtube.com/watch?v=DSEGmdzs9Kg DefCon OSINT https://www.youtube.com/watch?v=RwwpXALAp3I Spiderfoot https://www.youtube.com/watch?v=d-Ql_WSwF0A MALTEGO https://www.youtube.com/watch?v=yrOOdq25wMw Sans Search Tips: Surround literals with " ", as in "Soc Sec Num" Add minus (-) to a search term to maximize effectiveness of resulting hits - Excludes pages with a given word Search for airline status - Type in airline and flight number - Front end for Travelocity Search for VIN for vehicle information Search for UPC number for product info By dumping records from your DNS servers, attackers can determine which machines are accessible on Internet. Using nslookup, information can be gathered Type C:\> nslookup >server [DNSServer] >set type=any >ls -d [domain] site:sans.org then: -www after you look at the results -isc review the results -ics review the results -labs review the results and keep taking away results you dont care to see "cache:www.counterhack.net" .bak is backup files that exposes passwords. site:www.[target].com bak Usa Foca to download all the files you can find on a target. Take a excel document and put a macro in it, email it to the person that created the document and title it "Fix Immediately" , they will open it and fix it not realizing they just clicked a virus, worm, or keylogger. use index of XXXXXXX to go str8 to their directory and search their files and folders. (site:wafflehouse.com intitle:index.of). Work more on this............................ you can also find remote desktop systems: ext rdp indexable directories: intitle:index.of"parent directory" search for ID's and passwords Video Cameras.... search for inurl:"ViewerFrame?Mode=" pastebin.com go on there and search for userid and passwords, password ngc.com is northrup gruman password list. shodan will give you the amount of IOT and their IP address images.shodan.io will give you the images of Remote Desktop Systems that are open to the internet... then in the search bar.....port:5900 will show VNC open to the internet with no paswords needed shodanhq.com dnsstuff.com tracert.com traceroute.org network-tools.com securityspace.com https://github.com/domssilva/vulnsearch A deep look at some recon methodologies and web-application vulnerabilities of my interest where I will merge all my notes gathered from books, videos, articles and own experience with bug bounty hunting / web and network hacking https://tools.tldr.run/ bunch of different tools https://intelx.io/ search database https://github.com/Err0r-ICA/TORhunter Designed to scan and exploit vulnerabilities within Tor hidden services. TORhunter allows most tools to work as normal while resolving .onion https://hunter.io/ find email and addresses fast https://rocketreach.co/login