All language subtitles for 008 Reconnaissance with CentralOps (OBJ 2.1)

-: CentralOps.net and sites like it are a wonderful resource

for the hacker,

as it helps to provide some anonymity

during our assessments.

CentralOps allows us to create a Domain Dossier

or Email Dossier on our victims.

Gathering openly available information,

such as the owner of the domain names,

the technical contacts,

technical details,

and the network ranges involved.

This is key information that's required for us to gather

as we attempt to understand the victim network

and plan our attacks.

We can use CentralOps from any computer with a web browser

and since we already have our Kali machine connected

to the internet, that's what we're gonna use.

So from our Kali machine, we're gonna open up Firefox.

From here, we're gonna go to CentralOps.net.

So once we get to CentralOps.net,

we're gonna go to the Domain Dossier.

So now we need to pick a domain to look up or an IP address.

For our example, I'm gonna use AVG.

So AVG is an antivirus company located

in the Netherlands.

So we're gonna look them up

and we're gonna choose all five options.

We want the traceroute, the service scan, the DNS records

the Whois of both network and domain.

And then hit go.

So the first thing we're gonna see,

is our Address lookup

and this is just gonna do a basic check of the name

to the IP address.

In this case, AVG will resolve to two different IP addresses

as displayed here on the screen.

After that we're gonna see the domain Whois record.

Now with a large company like AVG or Yahoo or Google

or somebody like that,

you're not gonna get as much detailed information

as you would if you had a small business.

So in this case we can look

at who they registered their domain through?

Which in this case was Mark Monitor Incorporated.

So we can, we can see that

and that might play into the spear phishing campaign

but it's probably not real helpful for us right now.

We're gonna go ahead and scroll down even further.

The next thing we're gonna come to,

is the detailed Whois record,

and in here we're gonna see the registration information.

We're gonna see who the person is registered to.

In our case, since it's a large company

they just put in Domain Administrator.

If it's a small business, you'll usually see the owner

of the business's name

or their technical support people.

You also will get information,

such as where they are.

In this case they are located in Amsterdam,

with the street name listed there.

You also get phone numbers.

This can be useful as part of a pre-texting campaign as well

and you'll get an email address.

In the case of a large company like this,

they probably are not monitoring this address

but it's domainadministration@avg.com.

If we had somebody's username in there,

for instance Jason.Dion@avg.com,

that could tell us the naming structure

for email addresses that could be useful

in a spear phishing campaign,

or a good point of contact to use

as part of a spear phishing campaign,

such as the technical registration point of contact.

If we have that information, we can use that

as a way into the network.

We're gonna continue scrolling down,

see what else we can find.

Again, Domain Administrator,

Domain Administrator,

not the most helpful thing

because again, this is a large company.

One of the things I noticed that's kind of interesting

is their name servers.

If you notice they're using akam.net.

Akam is actually a large network service provider.

They actually can help prevent denial of service attacks

from occurring.

So if that was gonna be our strategy

to take down this network,

it may not work as well.

If they're a small business,

they're probably not using akam

and that may be a way

that you can take down their network.

But again, a denial of service is never used

in ethical hacking.

There's really no reason for it,

but it's something we can consider using our research here.

We're gonna go down to the Network record.

Now the Network Whois,

is a little bit different.

You'll notice here it actually gives us a range,

93. 184. 217. 0

up through 0.31,

is actually being owned and operated by AVG.

That means they have 31 IP addresses

30 of which are ratable on the internet.

That is 30 possible targets,

whether they're routers, firewalls,

or actual servers tied to the internet

that we could be looking at,

if that is within the scope of our assessment.

As we go down a little bit further,

you can notice who actually registered

for these IP addresses, Derrick Sawyer.

So again, that can be a name that we can use

as part of a pre-texting campaign,

it may be a name that we use

as part of an email phishing campaign.

Lots of different uses when we find good names

and good email addresses for people.

We're gonna go down into our DNS records next.

So in our DNS records, you'll see the DNS records

for avg.com.

There's two address records as we saw earlier.

We see 93.184.217.9

and then we see 93.184.211.28.

These are two different servers

that are answering up for the name avg.com.

This is probably being done

because AVG is such a large company.

One server couldn't handle the loads.

So they have two servers that are acting as content switches

to provide that service to their customers.

And then again, we see a akam.net

as the name servers answering up.

So again, it's gonna be load sharing

and helping to handle a large amount

of load that would come against those servers.

Next we're gonna look at Traceroute.

So it starts out from the servers at CentralOps

and goes out across the internet

until it finds where it's going.

In this case, once we get to the ***

in line 10 through 13,

that's usually where it hits firewalls

and some companies will not respond to pings

or Traceroutes.

And the reason why

is they don't want you mapping their network.

So we know they have at least some firewalls

and some border security there.

Again, we already figured that out

because of the akam.net being the ones answering up

for their domain name.

So we know that they're pretty secure.

Now we'll move on to the Service scan.

And here in the service scan you'll see that FTP Timed out,

SMTP Timed out,

web browsing port 80 is open.

POP servers, IMAP server

and HTTPS, all have timed out

and this is pretty typical

when using a large company like AVG.

So let's do another Domain Dossier.

This time we're gonna use a small business.

from Domain Dossier, I'm gonna go to titancipher.com

and I'm gonna use Service Scan

and Traceroute, and then hit Go.

Now titancipher.com is a domain that I own.

It's hosted on a small server,

it's used on a WordPress platform,

which is actually hosted by Blue Host.

And as we go through, you're gonna see that.

It's gonna look a lot different

than the AVG answers we got last time.

So in this case, we have a single IP address

which is answering up for TitanCipher.

If we go into the domain records, you'll see

that it's bluehost.com that tells me who they're using

and the fact that they're using Bluehost tells you

they're probably using WordPress as their platform

because Bluehost is known for that.

So if you could find vulnerabilities in WordPress

you can then use those against that particular domain.

Next we're gonna scroll down

and you'll see more information

about the actual person who owns it,

their name their address,

their phone numbers, their email addresses,

all information that could be useful.

Again, for a spear fishing campaign

or something of that nature.

Network Whois...

so Network Whois again,

that's gonna show us who owns the IP addresses.

In this case, it's actually owned

by Unified Layer Networks.

They own a large block,

then they've given part of that block to Blue host,

who then gave a single IP to titancipher.com.

So if you notice here, they have a class A address.

So the /16, they're gonna have over 64,000 IPs.

You don't wanna just go in there blindly

and scan 64,000 IPs,

if you're targeting one titancipher.com,

it wouldn't make any sense.

So this is gonna help you identify who owns the network

and what parts of the network there are.

I'm gonna scroll down a little further

and we're gonna find the DNS records.

Now the DNS records here are gonna show us

that there's a name server answering up Bluehost.com.

TitanCipher is being answered up

by Bluehost who is their provider.

They do have a mail server, mail.titancipher.com.

They do have an name server,

second name server on Bluehost.

We also see their A records, which is their IP address.

Next, we can look at the Traceroute.

This Traceroute you see looks a lot different

than the Traceroute we saw with AVG.

In this case, everybody is answered up.

We get both the IP addresses

and the fully qualified domain names,

so we know every single piece

between CentralOps

and that particular server that's answering up.

Now notice the last server that answers up that 193,

something quite interesting here.

When it resolved, it didn't resolve to titancipher.com.

Can you guess why?

Well, the reason why is that this has showed us

that it's a shared server.

It's not owned exclusively by TitanCipher.

In fact, it's owned by Unified Layer who owns Blue Host.

So there may be 20, 30, 40, 50 different websites

on this particular server.

TitanCipher is just one of them.

Now that's important to know

because if you try to hack titancipher.com,

you may not be hitting titancipher.com

you may be hitting some of these other servers in there

and if you do that, you'd now be breaking the law

because you were only hired for an assessment

by this one company.

So you have to be very careful when you start looking

at where they're hosted.

This is really important information when we look

at the Domain Dossier.

Next we're gonna go down to our Service scan.

In the Service scan, you'll see that they're using FTP.

That's a known vulnerability for us

and it even tells us what type of FTP.

In this case, Pure-FTPd server.

That's an important piece of information that we could use

if we were gonna hack this company.

SMTP Timeout, therefore, it's not answering up for SMTP.

That's good to know.

Don't throw any SMTP attacks.

They're...they are running a web server,

they're running Nginx/1.10.2.

We now know the version number

and the software they're using.

That's useful to find vulnerabilities.

Again, all we're doing here

is information gathering, at this point.

POP3 server does answer up,

so there is something listening there.

IMAP-143, another mail server.

It's answering up as well.

Things that we need to take note of.

If we get into their secure site,

we see Port 443 secure HTTP server,

so a secure https.

We can see their SSL certificate here.

They're using a shaw256RSA token

as as their server validation.

That is information that can be useful.

BlueHost.com is the ones who gave them that information.

So we might be able to use that

as part of a spear phishing campaign again.

You can see the fact that we have Apache running

as the server.

You see that, they're at the bottom.

HTTP/1.1 200 OK.

Server Apache.

Again, more information that we wanna take note of.

They also have a PHP session ID.

That's something else that we could take note of.

We see jasondin.com/wp.

WP usually stands for WordPress,

so that could be vulnerabilities we could take care of.

So these are all different things that we can look at,

as we move forward in our exploitation later on.

The next thing we're gonna look at

is our Email Dossier

and we'll just click on that,

and then we're gonna give an email address

that we want to test out.

If we had email.test@hotmail.com for instance,

let's see if that's a valid email address.

Click go.

We find out that it is a bad email address

because it was rejected by the server.

Now instead, if I use an email address

that I think is valid for instance:

titancipher@gmail.com,

hit go.

We'll see that this passed the validation test.

As we scroll down,

we'll see that it actually found the MX records for Google

for that particular address.

And when it tried to make a connection over SMTP to Google

to say, does this email ad address exist?

We can see that it did come back

and say that it was successful...

right here showing us

that, that was a good valid email address.

Let's try another one.

What if we had one like...

titancipher23@gmail.com?

Let's see if that's a valid email address.

We hit go.

Bad address, does not exist.

So if we tried to start sending spear phishing emails

towards titancipher23@gmail.com,

they would just get rejected.

But titancipher@gmail.com does exist.

It would be a valid address to use.

Where this becomes helpful

is when we start looking up information on the company.

For instance, if we go back to AVG,

if we think their naming scheme was first name.last name

and we found a name

of someone who we think is an employee, John Smith,

we can try in here, john.smith@avg.com

and see if it comes back as a valid

or invalid address.

This will help us know what is good addresses

and what are bad addresses.

If you start sending a lot of emails

to a server with bad email addresses,

that server will start realizing that there's a spam coming

from your address and they'll block you down.

You always wanna be targeted in your approach.

You don't wanna just shotgun things.

You wanna be precise like a sniper.

This is just one of the tools that you can use

during a reconnaissance phase.

There's literally hundreds

of different tools available out there,

but this is just one

that I particularly happen to like.

I recommend that you try out various tools

to figure out which one works for you and your style.

This lesson was to show you the process

that an attacker goes through

in collecting some of the basic information they need

in order to develop their attacks.