2.2 Reconnaissance 2

00:00

Hey, guys, Welcome back to the cyber kilt. In course of Savary.

00:05

This is, uh, the man imminent. This episode we're going to start our targeted attack. First step is reconnaissance.

00:11

So, as I said before and we discussed, there are seven steps of the Sybil Cochin

00:16

the first step. And as I said, the most important step is reconnaissance. Because you can think of reconnaissance as the base of the attack. When you have good reconnaissance, it would make the next

00:26

a few steps

00:28

a lot easier. So you want to have good reconnaissance to build a successful, targeted attack on top of this.

00:37

So every Constance, we gather information on the target before the actual attack start. That's the whole goal of reconnaissance. There are a number of ways O. R. Types of reconnaissance. There's passive on active reconnaissance and passive. What we're doing is we're looking for publicly available information on the Internet.

00:54

We're not interacting with the target. We're trying to keep our distance,

00:59

and this phase you can take your time because

01:02

the other side does not really know that you're actually started a targeted attack on them. However, an active,

01:10

uh, the there's an interaction with the other side. They can discover

01:15

the reconnaissance going on and then build their defense. Based on that, I've seen a number of companies that monitor pink attacks to their server as soon as they get a pink attack,

01:23

they would actually investigate that pink attack. Where did it come from? And what was the plan

01:30

or what is the intention off the pink attack?

01:34

So let's start with passive

01:37

reconnaissance.

01:38

A lot of people call this foot printing because what we're doing is we're looking for publicly available information on the Internet. Not yet. There we were. We communicate with the end

01:49

Stargate or the Attack Eddie, the target of this attack. So there's a number of techniques that are used doing reconnaissance or passive reconnaissance. The 1st 1 is who is

02:01

and do. It would actually give you give us a lot of information, uh, about the the target. So let's say we're going to separate Dr Tea, and

02:13

this would give us the upset would also give us the admin off the upset, and this information might not seem that just

02:21

thing. However, admin is usually have excessive privileges. And if you're planning on doing a social attack. That's the guy you want to go for, because usually he has system admin brought If it was Lennox, Andi has this privileges that no one asks my top.

02:38

So

02:40

the first thing is, who has recovered that the second thing is on a slick up. Let's say you have 70. That i t. But you don't actually know the I pee a lot of people would would do is the gonna pin get? But, Alvarez, I just said pink is considered to be an active attack like an active conscience because you're actually communicating with the device.

03:00

However, and this look up

03:01

is not because of what you're actually doing it in a slick up,

03:05

you're querying the d N issue, not actually communicating with. Then device.

03:09

And I'm gonna copy this.

03:13

We're going to use it in the next example. So

03:15

let's go to the next one. Census Census is oh, upside that is publicly available

03:22

and has a lot of information about

03:23

websites around the Internet.

03:27

So you'll get a lot of information from census that would help you during this face. So let's face the I P that we just copied here

03:36

and look at the kind of mission that would give us. It would give us the I. P address would give us the rotting off the I P address. It would give us the location off the server. Who's hosting it? What is the verdict here Last it would actually show this apartment is disabled and so on. So you want to spend more time here? Because

03:55

if you look at it, if I I type savagery that I t.

04:00

I would get pages and pages and pages off host I, P's and ah, addresses that are somewhat related to ah, savagely

04:12

the other example that I want to show you his Children

04:15

and I'm going to do the exact same thing. I'm gonna taste. I pee first, Keeping in mind that that's not only I P that there is, we just saw three eyepiece. And if I go back to senses, I'm going to get a lot more peace than the ones that I get and who is

04:30

so it would actually give us this map on the open ports and service is that are available. So let's look at savagery that I t.

04:41

And then

04:42

well, look at what kind of doctor do you get? So we get a number of outfits is not the only single one that we get before

04:49

most of them are in the United States. This is kind of the same information. However, I'm getting the technology that they're using. So I know they're using grouping rails and so on.

05:00

So the next thing that I want to talk about

05:04

is social media

05:06

and

05:08

social media is

05:10

a good thing.

05:12

And when you look at the big picture we started communicating with each other. We started to learn more using social media. However, sometimes we tend to share a lot more than we should. On social media. There are two examples here. The 1st 1 is the technologies that I'm using. So let's say I work for a company and then

05:29

I add to my lengthen account, saying that

05:31

I can support Siskel, Model X, Y Z and, uh,

05:38

Brocade Switch X.

05:40

Why's he too?

05:43

What happens is basically I'm telling the Attackers or the hackers my company uses

05:50

this and this mother's this model is their fire on this model. Is there stretch or a lot of that they're actually using

05:59

on DDE

06:00

this might not seem like something that is,

06:03

huh,

06:05

Interesting to the hacker, However, it's really is because when you're given this information, he knows exactly what kind of

06:14

basically vulnerabilities you might have in the future. Or if you ever have easier today, trust me, he will be the first to jump. On. The other aspect is social media and social media. There's the social aspect of social media. So if you go to a less professional type of social media like Facebook or any up,

06:31

uh, the Instagram Rania of these less professional than lengthen

06:35

where we shared our personal information by the then our professional information,

06:41

you'll find a lot of information that would help and attack writable the profile on someone. So, you know, if he's interested in scuba diving, go on horseback riding where he loves cars, so soccer or football or something like that, and then you can build

06:57

a a profile about this guy. Imagine if this guy was the admin that we just saw

07:01

on. Who is

07:03

Andi? He was interested in something that you were able to catch, isn't just using

07:10

one

07:11

ah, social engineering attack.

07:14

So the last thing that I want to talk about year is Dumpster diving, and it's kind of the most disgusting of the past of reconnaissance. But it's also the only one that is actually physical.

07:24

So a lot of companies dispose the information and not so secure way. So what they do is they just throw it in the garbage and then from the garbage backed out to the dumpster, what hackers can do is jump into this dumpster and collect this information. So if they have any manuals, if they have any contracts, if they have any information that

07:43

that they don't really want

07:45

to share with the would anyone out there,

07:49

the hacker or the attacker would have access to it through their dumpster.

07:55

So we covered reconnaissance on passively. Constance. Let's go back and answer these questions. So what is the purpose of reconnaissance?

08:05

The purpose of Re Constance is to build the base off a successful, targeted attack by collecting and gathering as much information as possible that would help me in later stages.

08:16

Second is what are the two cod two main types of the conscious and recover this. There's the active where you interact with the target and There's the passive which recovered and you don't interact on, try to gather information publicly available on the Internet.

08:33

There it is. How is posting information on social media? Help, adversities? And as you said, we're giving a lot more information than we should. What kind of systems we support with all the interest of off system admin is and so on.

08:46

The last question is the I p I get from rank and us look up on the company's Web site. There's only one I need. That's actually not true, because there's a lot of ups links that are hidden from who is or on a slick up because they're siblings or they're not available for, ah, honest look up

09:05

because they're not supposed to be access statically.

09:09

So in today's video, we cover the Step one of the Sabra guilty and Reconnaissance.

09:16

We talked about passive reconnaissance, and we going through a couple of example of passive reconnaissance in the next video, we're going to talk about activity constant space on actively constance technique.