All language subtitles for 001 Passive Reconnaissance (OBJ 2.1)

-: In this section of the course,

we're gonna discuss passive reconnaissance.

As we move from our planning

and scoping phase of our penetration test, we find ourselves

in the second stage of the engagement:

information gathering and vulnerability scanning.

During this stage, we're gonna be focused

on conducting reconnaissance and scanning.

Now reconnaissance focuses on gathering

as much information about the target as possible.

This reconnaissance can either be passive

or active in nature,

and we're gonna focus this section of the course

on the different passive reconnaissance actions

that we can conduct during our engagements.

This includes things like using open source intelligence,

social media scraping, reviewing the company's own website

and using publicly available repositories

to gain as much information as we can

about the target organization.

As I said, in this section of the course,

we're gonna focus on passive reconnaissance,

which is just one part

of the larger set of objectives inside of domain two:

information gathering and vulnerability scanning.

In this section, we're only gonna be focusing

on a single objective though: Objective 2.1.

This states that given a scenario

you must perform passive reconnaissance.

Now, while this objective seems short,

there's a lot of sub bullets listed underneath it by CompTIA

and we're gonna cover all of them in this section

as we go through the concepts

surrounding passive reconnaissance

that you need to know for the exam.

As we begin this section,

we're gonna first talk about information gathering

and some of the key sources of openly available information

that you can gather during an engagement.

Then we're gonna move into the world

of open source intelligence, also known as OSINT.

Now, open source intelligence is simply defined

as any publicly available information

and the tools we use to aggregate

and search that information.

We're also gonna spend some time looking

at common OSINT tools, such as Shodan and Recon-ng.

After that, we're gonna discuss social media scraping

which is a technique that allows you

to identify key administrative and technical contacts

of a given organization,

find key job responsibilities of those people,

and use job listings to identify the types of technology

that's used by the targeted organization.

We'll also discuss how to conduct DNS lookups

to identify important information about an organization,

and I'm gonna demonstrate how to perform

some basic passive reconnaissance functions

using a great website known as CentralOps.

Next, we're gonna cover the use of public repositories

as a key to find the data about your target organization

and how you can use search engine analysis

also known as Google hacking

to find all sorts of hidden information on your target

during an engagement.

Finally, we'll discuss how to identify cryptographic flaws

at your targeted organization

using some passive reconnaissance techniques.

So, let's get started in our coverage of domain two:

information gathering and vulnerability scanning

with passive reconnaissance in this section of the course.