All language subtitles for 1. Passive Reconnaissance Overview

So in this section we are going to be talking about information gathering and all information gathering

we're going to do in this section is going to be passive.

So I'm calling this passive recon or passive reconnaissance.

I wanted to give a brief overview of what we're going to be covering and talk about some high level

topics before we get into the weeds and really dive into our target.

So let's talk about the different types of passive recon so on the physical or social side physical

meaning actually going on site and maybe doing a physical engagement or the social engineering aspect

of maybe doing a fishing assessment or even including in a physical engagement or a bashing assessment

just gathering this information from the physical social aspect is incredibly useful.

So we have location information so we might utilize something like satellite images or often we'll go

on site and do drone reconnaissance where we fly a drone around and try to gain information.

And what we're really after with these images of this drone recon is we're trying to find out hey what

is the building layout look like.

Are there badge readers are there break areas.

Does security exist.

Do they have somebody posted out front.

Can you just walk right in the door.

What is their fencing look like.

Are there areas where they're just leaving the doors propped open.

Where do people go out and smoke in these break areas.

Because those are a good place to just walk up to somebody light up a cigarette even if you don't smoke

and to start a conversation and then tailgate right in with them into the building.

Now the other aspect of this is the job information so we might be looking for employees online I might

want to know somebody whose name job title phone number who their manager is I try to get a good idea

of what people look like.

So if I see them on site I have a good idea who they are.

I also look for pictures so I cannot tell you how many times a badge photo is posted on LinkedIn or

somebody posted on Twitter that you can see all the means out there about people posting their photos

at work.

And it's bad.

It happens all the time.

I see it to this day.

So we're looking for badge photos I'm looking for desk photos computer photos I had a situation once

where somebody took a picture of her watching a game at work she was watching a basketball game at work

and the basketball game was on her computer and on her screen there it showed all the different tools

that they utilized at work.

She had a work application open in this photo.

There was a desk in the background you can see different things.

And it just gives us information and that's where they were after.

What kind of information can we gather.

Now this course is not a course on physical or social so I kind of wanted to give a high level of what

to expect.

We won't really be doing a whole lot of this in this course with this type of information gathering

but these are the things that you should be looking for.

So if you are tasked with the physical assessment do go out there and look for satellite images try

to get a good feel of the building layout and also try to get a feel for who the employees are who maybe

the I.T. manager is in case you're going to say you know I work for I.T. they may ask you who your manager

is you might need to know those names.

And of course look for pictures you can find a good badge photo and what that looks like.

You can make a fake badge go on site and you'll be way more passable with that badge but sometimes they

don't even look it can be drawn in crayon.

So from there let's go ahead and talk about what we will be doing a lot of which is the Web and hosts.

So when you get a web or a host assessment the first thing you really should do is what is called Target

validation.

So we're going to be targeting something on bug crowds.

We're not really going to focus on this but what we're going to do in the real world is we would validate

the target.

Now there are situations where a client will give you an IP address or a Web site and they might they

might fudge it.

Right.

They might accidentally fat finger it put the wrong number but the wrong letter and the Web site and

then guess what.

You're off attacking somebody else's Web site and there if you are a podcast listener there's a good

darknet diaries episode on this.

If you don't as a darknet diaries go check it out.

There's a great episode with a guy named Rob Fuller a.k.a. musics and he talks about getting the wrong

IP address on an assessment and attacking the wrong people and actually gaining access to that machine

which is a really really big big screw up on both parts right.

So you should always validate your targets on top of this.

We're doing our web and our hosts on the web side.

We're going to look for subdomains and we'll talk more about that as we get into it.

But we can do that with we can do that with any map sublets or there's so many different tools that

we can use and we'll cover some of the tools and how to do it.

Get a little deep into that as well especially as we get into the web side of things.

There's fingerprinting we need to know what's running on a Web site or what's running on a host.

What kind of services are out there.

Are they running a web server What's that web servers.

ISIS is an Apache what version is it right.

Are they running what ports are open on their machines.

Oh they have FTC open what version of FTB is open.

So we need to fingerprint machines and kind of understand what on the passive side.

We're not touching any machine right.

So we're not gonna be doing much scanning against the host.

We just have to utilize what kind of information might already be out there.

So if we go out to a Web site it's on the border of active.

But as long as we're not scanning it in my book it's still passive.

So we'll do.

We will cover some of the passive slash active side in this section and then when we get into scanning

we'll get way more active with it.

Lastly we're gonna hit heavy especially in the beginning on data breaches data breaches are the most

common way when we're doing an external assessment that we get into networks Absolutely by far.

When we talk about data breaches we're talking about breached incidents from the past that have leaked

data.

Again these are like Home Depot Equifax linked in all kinds of breaches that are out there that have

had credentials dumped and then those credentials become available to us eventually.

And we try to utilize those to gain access or at least utilize the user names to gain access.

Nowadays most the time there's not going to be an easy just scan find something vulnerable and exploit

it on the external side of the house.

So we're looking for these data breaches and this information that we can gather and this is why information

gathering and then enumeration and scanning most important by far the better scanning enumeration that

you can do and the better information gathering you can do the better hacker you're going to be in the

better you're going to be at your job.

So take these first two sections really serious.

So we're going to start in with identifying what our target's going to be for this part of the section

and then we're going to go ahead and start talking about data breaches and why they're important and

go deeper into that.

And then we'll go off some of these tools that you see here on this list and really dive into those.

So I will look forward to seeing you in the next video when we identify our target and get some information

gathering started.