Instructor: As usual, the first thing that we do 2 2
before we start trying to exploit 3 3
or find any vulnerabilities, 4 4
we do information gathering, 5 5
so we try to gather as much information as possible 6 6
about the target. 7 7
Web applications are no different, 8 8
so we're going to start 9 9
by trying to get as much information as we can 10 10
about the target IP address, 11 11
the domain name info, the technologies used on the websites, 12 12
so what programming languages used, 13 13
what kind of server is installed on it, 14 14
what kind of database is being used. 15 15
We're going to gather information about the company, 16 16
the DNS records and we'll also see if we can find 17 17
any files that are not being listed 18 18
or any sub domains that are not visible to other people. 19 19
Now you can use any of the information gathering tools 20 20
that we used before. 21 21
For example, you can use Maltego 22 22
and just insert an entity, as a website. 23 23
And then start running actions to our transformers 24 24
just like we seen in the Maltego video. 25 25
I'm not gonna be explaining that 26 26
because it is exactly the same 27 27
as we did it with a normal person, 28 28
so I'm gonna be skipping through that. 29 29
You can also use Zenmap like we did before 30 30
or even Nexpose and test the infrastructure of the website 31 31
and see what information you can gather from that. 32 32
Again, I won't be going over that because we seen it. 33 33
There's no difference between a website or normal computer 34 34
as I said a website just another computer. 35 35
So what I'm gonna be focusing on 36 36
is technologies that you only see in websites 37 37
such as domain names, DNS records and stuff like that, 38 38
that you won't be able to use or we haven't seen before 39 39
in the previous videos. 40 40
So, the first thing that we're going to have a look on, 41 41
is Whois Lookup. 42 42
Whois Lookup is a protocol that's used 43 43
to find owners of internet resources. 44 44
For example, server, an IP address or domain. 45 45
So we're actually not hacking or doing anything, 46 46
we're literally just retrieving info from a database 47 47
that contains information about owners of stuff 48 48
on the internet. 49 49
So for example, when you sign up for a domain name, 50 50
if you wanted to register a domain name for yourself, 51 51
for example z.com, when I do that 52 52
I have to supply information about myself, 53 53
my address and then the name will be stored in my own name 54 54
and people can see that z owns this domain name. 55 55
So this is all we're going to do. 56 56
If you google Whois Lookup you'll see a lot of websites 57 57
providing the service, 58 58
so I'm using whois.domaintools.com, 59 59
and I'm just gonna put my target domain name, 60 60
and I'm just gonna use isecurity.org. 61 61
So as you can see very simple, 62 62
and we get a lot of information about our target website. 63 63
You'll see the email that you can use 64 64
to contact the domain name info, 65 65
usually you'll be able to see the address of the company 66 66
that has registered this domain name, 67 67
but we can see that this company is using privacy 68 68
on their domain so you can't really see the address, 69 69
but they're not using privacy, 70 70
you'll be able to see their address 71 71
and more information about the actual company. 72 72
You can see when the domain name was created, 73 73
you can see the IP address of isecurity.org, 74 74
so if you pinged this, you should get this IP address 75 75
and I'll show you. 76 76
If I do ping isecurity.org, 77 77
you'll see it's the same domain name here, 78 78
same IP address here sorry. 79 79
You can see the IP location, we can see the status 80 80
obviously it's active. 81 81
You can also access the history 82 82
but you need to register for that. 83 83
And obviously we can see the title here 84 84
and something that's very useful here, 85 85
we can see that it's using apache web server, 86 86
so this is a software that can be used as a web server, 87 87
and we can see that Isecurity uses this web server 88 88
and it's of version 2.2.31, 89 89
so again we can use this to find exploits, 90 90
we can see that it's using Unix, 91 91
the operating system of the website of the server 92 92
and it's using the following add-ons as well, 93 93
it's using mod ssl and open ssl. 94 94
Now right here, you can find more information 95 95
about the company who registered this domain, 96 96
so again Isecurity is using privacy 97 97
so you won't be able to see the address, 98 98
you can see that it's saying that the target person 99 99
is using a privacy protection. 100 100
But usually you'll be able to see phone numbers 101 101
and addresses of that company. 102 102
So as you can see very simple stuff 103 103
but it's very helpful in the long run 104 104
just to know what your target, what's their IP, 105 105
what services are they using, 106 106
we can also here actually I didn't show 107 107
you can see the name servers that are being used 108 108
and you can see that they are provided 109 109
by a company called dimnof.net. 110 110
Now if you go on dimnof, 111 111
you'll see that this is a hosting company. 112 112
So if we go on the english version, 113 113
that you'll see that this is a hosting company 114 114
and again you can even use this hosting company 115 115
and try to social engineer your way maybe 116 116
into hacking into your target, into Isecurity.