Original subtitles

OK so you don't have to follow along this video.

I just kind of want you to start getting the wheels spinning and thinking about other items that we

could be looking for when it comes to O.S..

Now we could look on a Web site like LinkedIn or Twitter and find useful information.

I was on this Web site for literally one minute.

I've logged in.

I went to Tesla and I've already kind of found something and I want to show you how fast this is.

So you come in here and you go to Tesla the company the company page here and I love to click on images.

There's always employee photos on images.

Now you scroll down a little bit and you can see somebody has recently posted a picture of their internship

at Tesla and what we can do is click on the picture and look for things like badge photos or desk fixtures

or anything of the sorts.

Now good employees are told to hide their badges from pictures and you could see they've done a pretty

good job.

But if you look down here right down here it's hard to zoom in.

But there is 100 percent a badge there.

Is this a great picture.

No but this is a good example of an easy way to find a badge is utilizing social media and you can find

a lot of stuff.

Very very very quickly.

So another thing to point out too is that Twitter is a goldmine for these kinds of things.

I have found badge pictures desk pictures software all kinds of stuff.

The Twitter and the linked ID now from the non physical perspective or information gathering perspective

for what seems like physical assessments.

The other thing to point out is that it's really good to find the people like LinkedIn is great so we

can come in here and we can find members right.

And these are all going to say LinkedIn members.

I don't have this account is just kind of my my peeping account that I just utilize when I want to look

in not trigger anything weird when I'm looking at a company because if somebody sees me as a person

looking at a company you might say why is this guy looking at my profile so we might not get names if

you don't have the premium on some of these you might see LinkedIn member but you can also dig some

names like here's a name here's a name here's a name and you take those names and you remember the formatting

from before right.

We had the formatting when we looked at a hundred IO and we said OK.

First initial last name.

Well I might take a first initial last name here and I'll add that to my list.

Now we could utilize scrapers out there to look through the employee lists and pull down all the the

names and then transfer those names into first initial last name.

You could write a script to do that with Python if you want to challenge yourself to do that.

I guarantee you there are tools out there to do this but this is the kind of information that we're

after we're after.

What kind of credentials can we gather and this loops all back.

This is the the the wheels spinning here right.

You want email addresses when we're talking network and we're talking what you're going to be doing

with these kind of assessments.

You want these email addresses you want anything that's been a part of a breach current credential leak.

Right.

And you just want as much information on the employees as you can gather when you take all these email

addresses and it says something it says thirty four thousand employees.

Do you take.

Thirty four thousand employees.

I would almost bet money on it that one of these employees has a password or something like fall 20

19 or winter 20 19 exclamation or something like Tesla.

One two three four exclamation.

People are always the weakest point of an organization and people will be lazy with their passwords

unless you absolutely force them to use long passwords.

I do not know Tesla's password policy but I get in almost every external assessment with a weak password

like fall 2019 or winter 2019.

So I want you to think about these things we're not gonna go to death into social media but have that

in your wheelhouse as well.

We're just trying to utilize as much resources that are out there in order to use them for our advantage.

So there's a lot of tools that I've shown you and I giving you a lot of the basics and really that's

all you need for information gathering.

Google is your best friend.

Utilize Google to your full advantage utilize social media people post things all the time.

They shouldn't be posting and just dig deep information gathering is one of the most important steps

along with scanning enumeration.

Keep repeating that to yourself and you'll be very very successful as a penetration tester.

So that is it for this section.

I kind of just wanted to give a brief overview of this and then give you some ideas to get your wheels

spin and really think about it.

Again we're harping on breach credentials mainly.

So from here we're going to move into scanning in immigration.

We're going to start doing our hacking getting into the real weeds of hacking and I'm very very excited

about that.

And you're going to see some of the stuff that you've seen before when it comes to reconnaissance pop

back up.

So I'm excited to see this play out through the course and how we're going to utilize it.

So that's it for this section.

I'll look forward to seeing you in the scanning enumeration section so I will catch you over there.