Practical White Hat Hacker Training - Passive Information Gathering(OSINT)

1. www.prismacsi.com © All Rights Reserved. 1 Practical White Hat Hacker Training #2 Passive Information Gathering This document can be shared or used by quoted and used for commercial purposes, but can not be changed. Detailed information is available at https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode.

2. www.prismacsi.com © All Rights Reserved. 2 OSINT • Open Source Intelligence (OSINT) • No communication with the target that may create an anomaly • Gathering information using internet services • Do searches on search engines • Analyze developer sites • Assemble all the information you obtained • Have an overview before active scanning to obtain the most accurate data

3. www.prismacsi.com © All Rights Reserved. 3 Sceriano • We are a group of Zambian hackers. • Capital: Lusaka • Language: English • Let’s suppose we are a hacker group for hire. • We need to collect information. • We need to look from every point of view.

4. www.prismacsi.com © All Rights Reserved. 4 OSINT • Let's start by identifying the basics. • Finding the main site by Google search • IP detection by Pinging • IP Range Detection • IANA • Arın , Ripe , Apnic , Japnic may be used • Researching the location with IP2Location

7. www.prismacsi.com © All Rights Reserved. 7 OSINT • What we can find through domain information? • Whois record analysis - Who.is • Discovering the other domains by using Reverse Whois • Whois history analysis • Discovering the attack area through subdomain detection • Detecting virtual hosts is important! • Detecting Email addresses • Detection of email structure • Important for creating missing mail addresses!

22. www.prismacsi.com © All Rights Reserved. 22 OSINT • Discovery through the other useful resources has its benefits! • Analysis can be done via Yougetsignal. • Subdomain discovery • Analysis through Bing • Subdomain discovery • Analysis via Netcraft • Technology and service analysis • Analysis through Archive.org • Content analysis by time

28. www.prismacsi.com © All Rights Reserved. 28 OSINT • It is useful to take advantage of the internet's active analysis resources! • Analysis should be done via Shodan • Analysis should be done via Censys • Haveibeenpwned.com • Have email addresses detected previously been used at a given address and have these addresses been previously hacked? • Have they been shared in Paste sites? • Are the passwords of these e-mail addresses still in use?

34. www.prismacsi.com © All Rights Reserved. 34 OSINT • Developer sites are one of the most critical points! • Analysis must be done through Alexa • Pastebin sites must definitely be examined • Critical data can be captured by analysis via Stackoverflow • Analysis through Github can give access to source code and perhaps internal critical data.

41. www.prismacsi.com © All Rights Reserved. 41 Google Hacking DB • Example Dorks • Intitle:index.of url:domain.com • Intitle:index.of inurl:domain.com filetype:sql • Site:domain.com –site:www.domain.com unique • Filetype:log intext:”putty” • Filetype:xls “username | password” • Ext:phps “mysql_connect” • inurl:/view/index/shtml

45. www.prismacsi.com © All Rights Reserved. 45 OSINT • Important data can be obtained from search engines and social media thereby expanding the attack surface. • User login screens must be discovered. (For social engineering attacks) • Job postings must be analyzed • Social media analysis must be done

47. www.prismacsi.com © All Rights Reserved. 47 OSINT • Metadata analysis should be done, important data can also be obtained from this. • Office files can be examined • Pdf files can be inspected • Images – EXIF data can be analyzed. • Available tools • Exif-reader • Foca • Metagoofil

48. www.prismacsi.com © All Rights Reserved. 48 List of Additional Tools Processes handled manually with these tools can be automated for a wide-scale application. • theHarvester • Spiderfoot • Recon-ng • Foca • Metagoofil • Maltego • Searchsploit

49. www.prismacsi.com © All Rights Reserved. 49 In the end • Domains have been determined • IP ranges have been determined • Technologies used have been analyzed and preparations done • Used software have been analyzed and preparations done • Leak data have been analyzed and added to password lists • We are now ready for active scanning!

Practical White Hat Hacker Training - Passive Information Gathering(OSINT)

PRISMA CSI

Practical White Hat Hacker Training - Passive Information Gathering(OSINT)