Comprehensive Overview of Information Gathering and Network Scanning Techniques

Shodan Search Engine

• Definition: Shodan is a search engine specifically designed for hackers, allowing users to find devices connected to the internet. It is often referred to as the search engine for the hackers.

• Utilization: Users can create a free account using any email ID to explore various services running on different IPs globally.

  • Examples of Searchable Services:

    • FTP (File Transfer Protocol): Users can search for devices with FTP ports running (e.g., ftp://IP_ADDRESS).

    • Webcams: Users can search publicly available webcams to explore their feeds.

    • Industrial Control Systems: Shodan can be used to explore databases such as MySQL or to find devices such as Apache/Tomcat.

• Vulnerability Exploration: With knowledge of a specific service or device, users can search for known vulnerabilities (e.g., Apache Tomcat $90.59$).

WHOIS Lookup Tools

• WHOIS Records: A method to find registered information about a domain or IP address.

• Steps to Use WHOIS Tools:

  1. Search WHOIS on Google to find various WHOIS services. Examples include:

     • whoisdomaintools.com

     • whois.is

  2. Input the desired domain (e.g., certifiedhacker.com).

  3. Locate relevant information such as:

     • Registration Details: Date created, expiration date, name servers, and registrant address.

     • Administrative Contacts: Potential email addresses and phone numbers.

• Privacy Considerations: Some information may be obscured if the organization opted for privacy protection.

• Use Cases: Useful for verifying the legitimacy of organizations or domains.

Internet Research Tools

Netcraft

• Netcraft Overview: Provides tools for internet research like threat maps and site reports.

• Site Reports: Users can find detailed reports on registered domains including:

  • Owner information, hosting country, names of organizations, and geolocation.

  • Actionable Task: Use Netcraft to find the operating system details for certifiedhacker.com.

DNS Dumpster

• Definition: A tool used to gather information about a domain's DNS records by allowing users to find:

  • Subdomains, MX records, A records, and geolocation.

• Instructions to Use: Simply type in the domain (e.g., certifiedhacker.com) and start the test.

• Output: Users receive a report with all DNS-related information, and this data can be downloaded in an Excel sheet.

Time Machine Archive (Wayback Machine)

• Definition: The Wayback Machine allows users to view past versions of web pages from any specified date.

• Usage: Users can input URLs (e.g., certifiedhacker.com, facebook.com) and see snapshots of how specific sites appeared at those points in time.

Reconnaissance Tools and Frameworks

OSINT Framework

• OSINT Overview: A collection of tools and resources for open-source intelligence gathering.

• Domain Tools: Resources are categorized for easy access, such as:

  • WHOIS lookup tools

  • Inventory of services for email addresses, social media usernames, and emails.

  • Search engines (like Google, DuckDuckGo).

  • Specialized tools for specific types of data extraction (e.g. subdomain enumeration).

SpiderFoot

• Definition: SpiderFoot is an open-source intelligence (OSINT) automation tool. It integrates with over $100$ public data sources to automatically gather intelligence on a target, such as IP addresses, netblocks, domain names, and email addresses.

• Purpose: It automates the reconnaissance process to discover publicly accessible information that could be leveraged for vulnerability research or threat intelligence analysis.

• Actionable Step: Perform a full reconnaissance scan by using all the tools mentioned in the video—including Shodan, WHOIS, Netcraft, DNS Dumpster, and the Wayback Machine—to compile a complete intelligence profile on a target.

• Homework: Students are assigned to explore certifiedhacker.com and demo.testfire.net using SpiderFoot and the aforementioned tools to gather intelligence automatically.

Understanding Email Tracing

Email Functionality and Tracing Steps

• Basic Functionality: When sending an email, it travels through various servers.

  1. Outgoing server (e.g., Gmail) sends email to the Internet.

  2. The Internet routes it to the recipient's server (e.g., Yahoo).

  3. Email is delivered to the recipient's inbox.

• Traceability: Users can inspect the header of an email to verify its authenticity by checking the originating IP address and the journey through servers. If an unexpected server is identified, the email may be fraudulent.

Network Scanning

Nmap Introduction

• Nmap Overview: A powerful network scanning tool used to discover hosts and services on a network, gathering information about open ports, services running, OS version, etc.

• Scan Types: Basic commands include:

  • nmap IP_ADDRESS

  • nmap -sV IP_ADDRESS (Service version)

  • nmap -O IP_ADDRESS (OS detection)

  • nmap -A IP_ADDRESS (Aggressive scan)

• Gathering info: Users are encouraged to employ Nmap with their local IP addresses to get familiar with its functionalities.

Summary of Concepts Covered

• Overview of various reconnaissance tools such as Shodan, WHOIS, Netcraft, and DNS Dumpster.

• Discussion of time machine services for historical web page views.

• Exploration of SpiderFoot and OSINT frameworks.

• Understanding of email tracing through IP analysis.

• Familiarization with Nmap for network mapping and vulnerability assessment.