1 1 00:00:00,300 --> 00:00:01,230 In this lesson, 2 2 00:00:01,230 --> 00:00:03,900 I'm going to show you how to use Recon-ng. 3 3 00:00:03,900 --> 00:00:04,860 For the exam, 4 4 00:00:04,860 --> 00:00:07,650 you do not need to know how to actually use these tools 5 5 00:00:07,650 --> 00:00:09,480 and all of their command line options. 6 6 00:00:09,480 --> 00:00:12,390 But you should know why you would use each tool, 7 7 00:00:12,390 --> 00:00:14,160 and in the basic case of OSINT, 8 8 00:00:14,160 --> 00:00:15,330 and then more specifically, 9 9 00:00:15,330 --> 00:00:17,100 what type of OSINT information 10 10 00:00:17,100 --> 00:00:18,840 you could get from these tools. 11 11 00:00:18,840 --> 00:00:21,300 It's important to remember that open source intelligence 12 12 00:00:21,300 --> 00:00:23,970 is not trying to connect to our targeted servers. 13 13 00:00:23,970 --> 00:00:26,580 Instead, we're trying to find out information about them 14 14 00:00:26,580 --> 00:00:28,620 by connecting to other servers on the internet 15 15 00:00:28,620 --> 00:00:31,020 or by searching elsewhere on the internet. 16 16 00:00:31,020 --> 00:00:33,510 Recon-ng has a lot of great capabilities, 17 17 00:00:33,510 --> 00:00:35,460 because it uses a system of modules 18 18 00:00:35,460 --> 00:00:38,280 to add additional features and functions for your use. 19 19 00:00:38,280 --> 00:00:41,160 For example, there's a module to conduct whois queries 20 20 00:00:41,160 --> 00:00:44,370 to identify administrative and technical points of contacts. 21 21 00:00:44,370 --> 00:00:47,310 There's another one to conduct PGP key searches 22 22 00:00:47,310 --> 00:00:49,770 and another for social media profile searching, 23 23 00:00:49,770 --> 00:00:52,320 yet another for file crawling of websites, 24 24 00:00:52,320 --> 00:00:54,600 and yet another one for DNS record searching 25 25 00:00:54,600 --> 00:00:56,130 and enumeration. 26 26 00:00:56,130 --> 00:00:57,360 If you have a list of emails 27 27 00:00:57,360 --> 00:00:58,740 for your reconnaissance efforts, 28 28 00:00:58,740 --> 00:01:00,420 you can also use Recon-ng 29 29 00:01:00,420 --> 00:01:02,460 to check if those emails have been the victim 30 30 00:01:02,460 --> 00:01:05,940 of a data breach previously by checking, have I been pawned? 31 31 00:01:05,940 --> 00:01:06,780 And if so, 32 32 00:01:06,780 --> 00:01:08,670 you might be able to find those passwords available 33 33 00:01:08,670 --> 00:01:12,450 as part of a password dump for sale over on the dark web. 34 34 00:01:12,450 --> 00:01:14,910 Now, Recon-ng is a Python script, 35 35 00:01:14,910 --> 00:01:17,790 and it makes it cross-platform and supported by Linux, 36 36 00:01:17,790 --> 00:01:19,920 MacOS and Windows. 37 37 00:01:19,920 --> 00:01:22,890 This web reconnaissance framework does come pre-installed 38 38 00:01:22,890 --> 00:01:24,690 in Kali Linux by default. 39 39 00:01:24,690 --> 00:01:26,310 The next thing we're going to go ahead and do 40 40 00:01:26,310 --> 00:01:28,560 is work with Recon-ng. 41 41 00:01:28,560 --> 00:01:30,030 So to start up Recon-ng, 42 42 00:01:30,030 --> 00:01:32,910 you just type in recon-ng and hit Enter. 43 43 00:01:32,910 --> 00:01:34,800 When you do that, it's going to load up. 44 44 00:01:34,800 --> 00:01:36,570 And now you're in a special command prompt 45 45 00:01:36,570 --> 00:01:38,820 within the Recon-ng environment. 46 46 00:01:38,820 --> 00:01:40,830 Notice here, we're in Recon-ng, 47 47 00:01:40,830 --> 00:01:43,260 and we are in the default workspace. 48 48 00:01:43,260 --> 00:01:46,710 Now, Recon-ng is a wonderful web reconnaissance framework. 49 49 00:01:46,710 --> 00:01:49,590 And it works a lot like Metasploit does for exploits 50 50 00:01:49,590 --> 00:01:51,120 and the Social-Engineer Toolkit 51 51 00:01:51,120 --> 00:01:52,770 works for social engineering. 52 52 00:01:52,770 --> 00:01:54,930 It brings a lot of tools and a lot of capabilities 53 53 00:01:54,930 --> 00:01:56,100 into one place. 54 54 00:01:56,100 --> 00:01:59,310 But because of that, it is a little bit more complicated. 55 55 00:01:59,310 --> 00:02:00,570 Now also, the other thing to note 56 56 00:02:00,570 --> 00:02:03,660 is a lot of the things you're going to find online for Recon-ng 57 57 00:02:03,660 --> 00:02:04,740 are going to be wrong, 58 58 00:02:04,740 --> 00:02:06,060 and they're not going to work. 59 59 00:02:06,060 --> 00:02:07,620 The reason for that is there was a switch 60 60 00:02:07,620 --> 00:02:09,030 in a lot of the syntax 61 61 00:02:09,030 --> 00:02:11,850 going between version 4 and version 5. 62 62 00:02:11,850 --> 00:02:14,213 You can see here I'm operating with version 5.1.2, 63 63 00:02:15,060 --> 00:02:17,550 which is the latest at the time of this recording. 64 64 00:02:17,550 --> 00:02:18,900 So all the things I'm going to show you now 65 65 00:02:18,900 --> 00:02:20,790 are based on that version. 66 66 00:02:20,790 --> 00:02:23,310 These will not work in the older version 4. 67 67 00:02:23,310 --> 00:02:24,570 And the old version 4 commands 68 68 00:02:24,570 --> 00:02:27,030 will not always work in the newer version 5. 69 69 00:02:27,030 --> 00:02:27,863 So keep that in mind 70 70 00:02:27,863 --> 00:02:30,630 if you're looking at any tutorials online or YouTube videos. 71 71 00:02:30,630 --> 00:02:32,550 If they're older than about 2020, 72 72 00:02:32,550 --> 00:02:34,740 you may run into some issues there. 73 73 00:02:34,740 --> 00:02:36,030 Now to use this, 74 74 00:02:36,030 --> 00:02:39,150 we're going to launch into Recon-ng just like we did here. 75 75 00:02:39,150 --> 00:02:42,300 And now I like to personally set up my own workspace 76 76 00:02:42,300 --> 00:02:44,400 instead of using the default workspace. 77 77 00:02:44,400 --> 00:02:46,500 This gives me almost a place to store 78 78 00:02:46,500 --> 00:02:48,150 and save all my different commands 79 79 00:02:48,150 --> 00:02:51,510 and tools and information that I find in one area. 80 80 00:02:51,510 --> 00:02:54,600 And so to do this, we are going to use the workspaces command. 81 81 00:02:54,600 --> 00:02:56,730 Now, if you don't know any of the commands in Recon-ng yet, 82 82 00:02:56,730 --> 00:02:58,110 which you probably don't, 83 83 00:02:58,110 --> 00:03:00,150 you might want to first type in help. 84 84 00:03:00,150 --> 00:03:01,290 When you type in help, 85 85 00:03:01,290 --> 00:03:03,570 it'll list out all the commands you can use. 86 86 00:03:03,570 --> 00:03:06,090 And you'll see there that we have one called workspaces 87 87 00:03:06,090 --> 00:03:07,410 at the bottom of the list. 88 88 00:03:07,410 --> 00:03:09,780 And this is used to manage workspaces. 89 89 00:03:09,780 --> 00:03:11,610 A workspace is just a defined area 90 90 00:03:11,610 --> 00:03:12,930 to keep your different information 91 91 00:03:12,930 --> 00:03:15,330 from different engagements into different buckets, 92 92 00:03:15,330 --> 00:03:17,370 so they're not mixing between clients. 93 93 00:03:17,370 --> 00:03:19,080 So what I'm going to do is I'm just going to type in the word, 94 94 00:03:19,080 --> 00:03:20,490 workspaces. 95 95 00:03:20,490 --> 00:03:22,650 And then from workspaces, if I hit Enter, 96 96 00:03:22,650 --> 00:03:24,960 it's going to tell me I didn't give enough syntax, 97 97 00:03:24,960 --> 00:03:26,820 because we didn't know what to do with it yet. 98 98 00:03:26,820 --> 00:03:30,120 Here we can do a create, list, load or remove. 99 99 00:03:30,120 --> 00:03:31,380 In our case, we can see 100 100 00:03:31,380 --> 00:03:32,820 if there's any workspaces already. 101 101 00:03:32,820 --> 00:03:33,653 And there shouldn't be, 102 102 00:03:33,653 --> 00:03:35,430 because this is a brand new installation. 103 103 00:03:35,430 --> 00:03:37,500 But by doing that we do workspaces, 104 104 00:03:37,500 --> 00:03:39,270 Space, list and hit Enter. 105 105 00:03:39,270 --> 00:03:41,490 And you see we only have the default one. 106 106 00:03:41,490 --> 00:03:43,710 I'm going to go ahead and create one called Dion. 107 107 00:03:43,710 --> 00:03:47,790 And to do that, we're just going to type in workspaces create. 108 108 00:03:47,790 --> 00:03:50,223 And then I'm going to use the folder name of Dion. 109 109 00:03:51,180 --> 00:03:54,450 Now if I go ahead and do workspaces list, 110 110 00:03:54,450 --> 00:03:57,720 you're going to see two, default and Dion. 111 111 00:03:57,720 --> 00:03:59,460 All right, now that we've done that, 112 112 00:03:59,460 --> 00:04:02,097 we can go ahead and select that workspace to work in it. 113 113 00:04:02,097 --> 00:04:04,680 And in this case, because I just created that workspace, 114 114 00:04:04,680 --> 00:04:07,560 it automatically put me into the Dion workspace. 115 115 00:04:07,560 --> 00:04:08,670 But let's say I had another one, 116 116 00:04:08,670 --> 00:04:12,173 because I was going to do workspaces create Udemy. 117 117 00:04:14,490 --> 00:04:16,500 Now I'm going to have three different workspaces. 118 118 00:04:16,500 --> 00:04:17,910 Oh, I actually typed that wrong, 119 119 00:04:17,910 --> 00:04:19,680 so make sure you type it correctly. 120 120 00:04:19,680 --> 00:04:21,900 Everything in Linux is case sensitive 121 121 00:04:21,900 --> 00:04:24,030 and obviously spelling sensitive. 122 122 00:04:24,030 --> 00:04:25,470 I forgot the S on workspace, 123 123 00:04:25,470 --> 00:04:26,970 and that's why I got that error. 124 124 00:04:26,970 --> 00:04:28,200 So here we go. I listed it out. 125 125 00:04:28,200 --> 00:04:30,300 And you see there are three workspaces now, 126 126 00:04:30,300 --> 00:04:32,010 Dion, Udemy and default. 127 127 00:04:32,010 --> 00:04:33,390 When you create a new workspace, 128 128 00:04:33,390 --> 00:04:36,330 by default, it moves you into that workspace. 129 129 00:04:36,330 --> 00:04:38,280 So you'll notice when I created Dion 130 130 00:04:38,280 --> 00:04:39,720 right next to recon-ng, 131 131 00:04:39,720 --> 00:04:42,060 there was this thing that said bracket Dion bracket. 132 132 00:04:42,060 --> 00:04:44,700 And that told me that I was in the Dion space. 133 133 00:04:44,700 --> 00:04:46,860 And you can see that just below the first table 134 134 00:04:46,860 --> 00:04:49,290 where I entered workspaces create Dion, 135 135 00:04:49,290 --> 00:04:51,360 it moved me into that Dion workspace. 136 136 00:04:51,360 --> 00:04:53,880 Then when I created the Udemy workspace, 137 137 00:04:53,880 --> 00:04:56,310 it then changed me from Dion into Udemy. 138 138 00:04:56,310 --> 00:04:58,170 But let's say I wanted to go back into Dion, 139 139 00:04:58,170 --> 00:04:59,190 how would I do that? 140 140 00:04:59,190 --> 00:05:02,340 Well, to do that, we're just going to type in workspaces load 141 141 00:05:02,340 --> 00:05:03,690 and then the name of the workspace. 142 142 00:05:03,690 --> 00:05:05,820 In my case, it's Dion. 143 143 00:05:05,820 --> 00:05:08,520 Now you can see I am back into Recon-ng 144 144 00:05:08,520 --> 00:05:10,740 inside the workspace Dion. 145 145 00:05:10,740 --> 00:05:12,300 All right, the next thing we have to do 146 146 00:05:12,300 --> 00:05:14,370 is we have to have some modules installed 147 147 00:05:14,370 --> 00:05:17,580 to be able to do some functionality inside of Recon-ng. 148 148 00:05:17,580 --> 00:05:20,250 Now by default, there is no modules installed 149 149 00:05:20,250 --> 00:05:22,470 when you first get Recon-ng. 150 150 00:05:22,470 --> 00:05:23,730 And this is a brand new install. 151 151 00:05:23,730 --> 00:05:25,680 And if you just loaded up your virtual machine, 152 152 00:05:25,680 --> 00:05:27,210 you have a brand new install as well. 153 153 00:05:27,210 --> 00:05:29,340 And so these are things we have to work through. 154 154 00:05:29,340 --> 00:05:30,173 So what we're going to do 155 155 00:05:30,173 --> 00:05:31,950 is we're actually going to go into the module section, 156 156 00:05:31,950 --> 00:05:33,840 which is another one of those keywords. 157 157 00:05:33,840 --> 00:05:35,490 Again, if you get lost at any time, 158 158 00:05:35,490 --> 00:05:36,810 just type in help. 159 159 00:05:36,810 --> 00:05:38,850 And you'll notice there we have a modules command, 160 160 00:05:38,850 --> 00:05:41,730 and it says that it interfaces with installed modules. 161 161 00:05:41,730 --> 00:05:43,650 So to check if there's any installed modules, 162 162 00:05:43,650 --> 00:05:45,750 I'm just going to type in modules. 163 163 00:05:45,750 --> 00:05:47,790 And then I would use the command search. 164 164 00:05:47,790 --> 00:05:49,620 Now if you don't know any of the commands for modules, 165 165 00:05:49,620 --> 00:05:52,050 again, just type in modules and hit Enter. 166 166 00:05:52,050 --> 00:05:53,280 There is your different options. 167 167 00:05:53,280 --> 00:05:55,530 You can load, reload or search. 168 168 00:05:55,530 --> 00:05:57,630 Search is essentially like listing. 169 169 00:05:57,630 --> 00:05:58,920 But you can list all of them 170 170 00:05:58,920 --> 00:06:00,810 if you just type in search and hit Enter. 171 171 00:06:00,810 --> 00:06:03,360 Or you can actually search for a keyword, 172 172 00:06:03,360 --> 00:06:04,620 because there are many modules, 173 173 00:06:04,620 --> 00:06:06,630 and maybe you just want a specific module 174 174 00:06:06,630 --> 00:06:08,280 for a specific use case. 175 175 00:06:08,280 --> 00:06:10,200 If I go ahead and hit search and hit Enter, 176 176 00:06:10,200 --> 00:06:12,690 you're going to see that I have no modules found, 177 177 00:06:12,690 --> 00:06:14,250 and it has a red arrow there. 178 178 00:06:14,250 --> 00:06:16,740 That's because I haven't installed anything yet. 179 179 00:06:16,740 --> 00:06:19,380 And so now we need to go and find some modules. 180 180 00:06:19,380 --> 00:06:20,490 How do you do that? 181 181 00:06:20,490 --> 00:06:22,020 Well, looking back up at the help area, 182 182 00:06:22,020 --> 00:06:24,600 you'll see a command called marketplace. 183 183 00:06:24,600 --> 00:06:27,150 This interfaces with the module marketplace. 184 184 00:06:27,150 --> 00:06:28,470 And this is where you can search for 185 185 00:06:28,470 --> 00:06:31,560 and download a single module or all the modules. 186 186 00:06:31,560 --> 00:06:33,210 Now, some modules you're going to find 187 187 00:06:33,210 --> 00:06:34,603 are going to require you to get an API key 188 188 00:06:34,603 --> 00:06:37,230 to be able to associate with the service. 189 189 00:06:37,230 --> 00:06:40,200 For example, there's a module to be able to search Twitter. 190 190 00:06:40,200 --> 00:06:41,970 And Twitter requires you to register with them 191 191 00:06:41,970 --> 00:06:44,160 as a developer to get an API key, 192 192 00:06:44,160 --> 00:06:45,930 so you can then make that API connection 193 193 00:06:45,930 --> 00:06:49,590 from Recon-ng into Twitter and start searching their stuff. 194 194 00:06:49,590 --> 00:06:51,930 Now, to make things easy for our demonstration, 195 195 00:06:51,930 --> 00:06:53,130 we're not going to go into that. 196 196 00:06:53,130 --> 00:06:56,850 And I'm going to pick a module that does not require API keys. 197 197 00:06:56,850 --> 00:06:58,920 If you're going to use Recon-ng for real, 198 198 00:06:58,920 --> 00:07:01,650 go online, look at the Recon-ng manual. 199 199 00:07:01,650 --> 00:07:02,520 You'll be able to walk through 200 200 00:07:02,520 --> 00:07:03,720 how to do all of those things, 201 201 00:07:03,720 --> 00:07:06,330 because there's a lot of capability in this tool. 202 202 00:07:06,330 --> 00:07:09,900 For the exam, you do not need to know how to use Recon-ng. 203 203 00:07:09,900 --> 00:07:10,980 I just wanted to show you, 204 204 00:07:10,980 --> 00:07:12,330 so you can get comfortable with it, 205 205 00:07:12,330 --> 00:07:14,250 so you can use it in the real world a little bit 206 206 00:07:14,250 --> 00:07:15,780 and then take it from there. 207 207 00:07:15,780 --> 00:07:17,010 Now, what we want to do first 208 208 00:07:17,010 --> 00:07:19,440 is we want to find a module that we can use. 209 209 00:07:19,440 --> 00:07:21,600 The one I'm going to use is known as recon 210 210 00:07:21,600 --> 00:07:25,230 slash domain contacts slash whois pocs. 211 211 00:07:25,230 --> 00:07:27,120 I know this one doesn't require an API. 212 212 00:07:27,120 --> 00:07:29,970 And the purpose of this is for us to be able to use this 213 213 00:07:29,970 --> 00:07:33,150 to look up the whois data for different domain names. 214 214 00:07:33,150 --> 00:07:33,983 Now, to do this, 215 215 00:07:33,983 --> 00:07:36,900 we're just going to use the command marketplace. 216 216 00:07:36,900 --> 00:07:39,180 And then we're going to use the term install. 217 217 00:07:39,180 --> 00:07:40,260 Now, just like before, 218 218 00:07:40,260 --> 00:07:41,970 if you don't know how to do something, 219 219 00:07:41,970 --> 00:07:44,040 you can simply type in marketplace and Enter, 220 220 00:07:44,040 --> 00:07:45,690 and it will give you the syntax. 221 221 00:07:45,690 --> 00:07:47,460 And then you're going to put the one that you're looking for. 222 222 00:07:47,460 --> 00:07:50,070 In my case, I know exactly which one I'm looking for. 223 223 00:07:50,070 --> 00:07:53,910 It's recon slash domains dash contacts 224 224 00:07:53,910 --> 00:07:57,780 slash whois underscore pocs. 225 225 00:07:57,780 --> 00:07:58,650 Hit Enter. 226 226 00:07:58,650 --> 00:08:00,840 And it's going to go ahead and install that module. 227 227 00:08:00,840 --> 00:08:02,700 You'll see right here, it installed the module, 228 228 00:08:02,700 --> 00:08:04,230 and then it reloaded it. 229 229 00:08:04,230 --> 00:08:06,690 If I want to validate that actually happened, 230 230 00:08:06,690 --> 00:08:09,660 I can do that by using the module search command 231 231 00:08:09,660 --> 00:08:12,510 like I did before to show there was no modules found. 232 232 00:08:12,510 --> 00:08:14,460 So let's go ahead and do that. 233 233 00:08:14,460 --> 00:08:16,620 And now instead of no modules being found, 234 234 00:08:16,620 --> 00:08:18,630 I see that I have one module found. 235 235 00:08:18,630 --> 00:08:20,550 It's under the recon category. 236 236 00:08:20,550 --> 00:08:22,800 And it is the one I just installed. 237 237 00:08:22,800 --> 00:08:24,900 Now, if you want to to install all of the modules, 238 238 00:08:24,900 --> 00:08:26,330 and there are a lot of them out there, 239 239 00:08:26,330 --> 00:08:27,420 if you want to see them all, 240 240 00:08:27,420 --> 00:08:30,420 just type in marketplace and then hit search 241 241 00:08:30,420 --> 00:08:31,740 and then hit Enter. 242 242 00:08:31,740 --> 00:08:32,970 And you'll see there is a bunch. 243 243 00:08:32,970 --> 00:08:33,803 There are so many 244 244 00:08:33,803 --> 00:08:36,060 that it is actually going off of my screen. 245 245 00:08:36,060 --> 00:08:38,070 And so if you wanted to actually scroll up here, 246 246 00:08:38,070 --> 00:08:39,120 you can go through 247 247 00:08:39,120 --> 00:08:42,030 and see that there are a ton of different modules. 248 248 00:08:42,030 --> 00:08:43,920 And all of these have different functionality. 249 249 00:08:43,920 --> 00:08:45,660 If you want to know what each one does, 250 250 00:08:45,660 --> 00:08:48,100 you can actually look them up inside of Recon-ng 251 251 00:08:48,990 --> 00:08:50,670 using the info command. 252 252 00:08:50,670 --> 00:08:51,660 And you'll be able to learn more 253 253 00:08:51,660 --> 00:08:53,010 about those particular tools. 254 254 00:08:53,010 --> 00:08:55,500 Or again, go online, go ahead and Google 255 255 00:08:55,500 --> 00:08:57,420 or Bing or DuckDuckGo 256 256 00:08:57,420 --> 00:08:59,550 or whatever your favorite search engine or choice is 257 257 00:08:59,550 --> 00:09:00,383 and look up those. 258 258 00:09:00,383 --> 00:09:02,130 And you'll figure out which ones they are, what they do, 259 259 00:09:02,130 --> 00:09:04,710 and which ones may be helpful in your reconnaissance. 260 260 00:09:04,710 --> 00:09:06,690 Now, if you want to to install all of these, 261 261 00:09:06,690 --> 00:09:07,890 you certainly can. 262 262 00:09:07,890 --> 00:09:10,180 And to do that you just type in marketplace 263 263 00:09:11,190 --> 00:09:14,010 install all. 264 264 00:09:14,010 --> 00:09:15,060 And if I hit Enter right now, 265 265 00:09:15,060 --> 00:09:17,700 it's going to go and install every single one of those. 266 266 00:09:17,700 --> 00:09:19,290 Now, the reason I'm not going to do that 267 267 00:09:19,290 --> 00:09:20,970 is because it's going to clutter up our screen. 268 268 00:09:20,970 --> 00:09:22,380 It's going to throw a bunch of errors, 269 269 00:09:22,380 --> 00:09:24,450 because we haven't set up all the API keys 270 270 00:09:24,450 --> 00:09:27,060 for all 40 or 50 different Recon modules. 271 271 00:09:27,060 --> 00:09:29,010 And so I'm going to not do that right now. 272 272 00:09:29,010 --> 00:09:30,000 But if you want to do that, 273 273 00:09:30,000 --> 00:09:31,740 and you want to set up your system fully, 274 274 00:09:31,740 --> 00:09:34,320 you can install all and then go find API keys 275 275 00:09:34,320 --> 00:09:36,360 for every single one of those modules. 276 276 00:09:36,360 --> 00:09:37,860 Now the next thing we need to do 277 277 00:09:37,860 --> 00:09:40,650 is actually take that module and load it. 278 278 00:09:40,650 --> 00:09:43,380 Now again, if I type in modules search, 279 279 00:09:43,380 --> 00:09:46,020 you're going to see that I have installed that module. 280 280 00:09:46,020 --> 00:09:48,420 But it doesn't mean it's loaded and ready for me to go, 281 281 00:09:48,420 --> 00:09:49,620 because you can see where I am 282 282 00:09:49,620 --> 00:09:51,510 inside of the Recon structure. 283 283 00:09:51,510 --> 00:09:53,880 I'm at recon-ng, Dion. 284 284 00:09:53,880 --> 00:09:55,050 I'm not inside a module. 285 285 00:09:55,050 --> 00:09:56,310 I'm not inside any of the options. 286 286 00:09:56,310 --> 00:09:58,080 I'm just inside the workspace. 287 287 00:09:58,080 --> 00:10:01,080 So again, we're just going to type in modules and hit Enter. 288 288 00:10:01,080 --> 00:10:02,160 You're going to see the syntax. 289 289 00:10:02,160 --> 00:10:04,410 We have load, reload and search. 290 290 00:10:04,410 --> 00:10:07,620 I'm going to go ahead and type in modules load. 291 291 00:10:07,620 --> 00:10:10,800 And then I want to use the whois underscore pocs, 292 292 00:10:10,800 --> 00:10:13,200 which is the short name for the module I loaded. 293 293 00:10:14,040 --> 00:10:16,200 There we go. Notice how my prompt change. 294 294 00:10:16,200 --> 00:10:18,750 Now I'm inside this module. 295 295 00:10:18,750 --> 00:10:19,860 Now that we're in the module, 296 296 00:10:19,860 --> 00:10:21,240 we need to specify the options 297 297 00:10:21,240 --> 00:10:22,800 that we want to use with the module. 298 298 00:10:22,800 --> 00:10:23,790 And we're going to do that 299 299 00:10:23,790 --> 00:10:26,460 by entering information into our database. 300 300 00:10:26,460 --> 00:10:27,780 Now, inside of Recon-ng, 301 301 00:10:27,780 --> 00:10:29,790 there's actually a database installed with it. 302 302 00:10:29,790 --> 00:10:32,010 And you're able to put information into the database, 303 303 00:10:32,010 --> 00:10:33,630 both things you want to search for 304 304 00:10:33,630 --> 00:10:35,490 and information that's going to come back 305 305 00:10:35,490 --> 00:10:37,200 when you do those searches. 306 306 00:10:37,200 --> 00:10:39,300 Now, to do this and work with the database, 307 307 00:10:39,300 --> 00:10:41,190 we need to use the db command. 308 308 00:10:41,190 --> 00:10:43,110 And again, if you get lost at any time, 309 309 00:10:43,110 --> 00:10:44,340 just type in help. 310 310 00:10:44,340 --> 00:10:47,370 You'll notice there, the third line down is db, 311 311 00:10:47,370 --> 00:10:50,280 which interfaces with the workspaces database. 312 312 00:10:50,280 --> 00:10:52,260 Each workspace has its own database. 313 313 00:10:52,260 --> 00:10:54,690 And that's another reason you want to have a workspace 314 314 00:10:54,690 --> 00:10:57,120 dedicated to whatever engagement you're working on. 315 315 00:10:57,120 --> 00:10:59,790 So we're going to go ahead and use db. 316 316 00:10:59,790 --> 00:11:01,890 And then again, we can hit Enter. 317 317 00:11:01,890 --> 00:11:04,800 And it'll tell us what things we can do with the database. 318 318 00:11:04,800 --> 00:11:06,090 We can delete a database. 319 319 00:11:06,090 --> 00:11:07,680 We can insert a line in a database. 320 320 00:11:07,680 --> 00:11:09,240 We can add notes to a database. 321 321 00:11:09,240 --> 00:11:11,520 We can query it using SQL commands. 322 322 00:11:11,520 --> 00:11:13,710 Or we can look at the database schema. 323 323 00:11:13,710 --> 00:11:15,510 Now, if I wanted to see the schema of the database, 324 324 00:11:15,510 --> 00:11:18,990 I can just type in db schema and hit Enter. 325 325 00:11:18,990 --> 00:11:19,823 And when I do that, 326 326 00:11:19,823 --> 00:11:21,750 again, it scrolls off the screen a little bit. 327 327 00:11:21,750 --> 00:11:22,620 But as we scroll up, 328 328 00:11:22,620 --> 00:11:25,120 you can see the different tables that we're using. 329 329 00:11:26,017 --> 00:11:27,417 I'll get up here to the top. 330 330 00:11:31,080 --> 00:11:31,950 There we go. 331 331 00:11:31,950 --> 00:11:33,750 So the first one we have is domains. 332 332 00:11:33,750 --> 00:11:35,400 And this will hold domains, notes 333 333 00:11:35,400 --> 00:11:37,470 and the module that found the information. 334 334 00:11:37,470 --> 00:11:39,570 Under companies, it has company description, 335 335 00:11:39,570 --> 00:11:40,467 notes and module. 336 336 00:11:40,467 --> 00:11:42,480 And you're going to see each of these are going to interact 337 337 00:11:42,480 --> 00:11:45,630 with different parts of Recon-ng and different modules. 338 338 00:11:45,630 --> 00:11:46,470 Domains is the one 339 339 00:11:46,470 --> 00:11:48,240 we're actually going to be working with here, 340 340 00:11:48,240 --> 00:11:51,570 because I'm using the whois point of contacts module. 341 341 00:11:51,570 --> 00:11:53,070 So let me go ahead and get back here to the bottom. 342 342 00:11:53,070 --> 00:11:54,840 I'm just going to hit Enter. It'll drop me right down. 343 343 00:11:54,840 --> 00:11:55,830 Okay, and now what we want to do 344 344 00:11:55,830 --> 00:11:57,840 is go back to our database command. 345 345 00:11:57,840 --> 00:12:00,480 And what we want to do is insert information 346 346 00:12:00,480 --> 00:12:01,770 into that database, 347 347 00:12:01,770 --> 00:12:04,800 specifically the domain names that we want to look at. 348 348 00:12:04,800 --> 00:12:07,710 Now what I'm going to do is I'm just going to type in db, 349 349 00:12:07,710 --> 00:12:09,840 insert and then domains, 350 350 00:12:09,840 --> 00:12:12,570 which is the field that I want to insert information in. 351 351 00:12:12,570 --> 00:12:14,160 And at that point, I hit Enter. 352 352 00:12:14,160 --> 00:12:14,993 And it's going to say, 353 353 00:12:14,993 --> 00:12:16,830 what do you want to enter in here? 354 354 00:12:16,830 --> 00:12:19,170 Well, the thing I want to enter is the domain name, 355 355 00:12:19,170 --> 00:12:22,110 so if I wanted to search diontraining.com, 356 356 00:12:22,110 --> 00:12:23,280 I can enter that in. 357 357 00:12:23,280 --> 00:12:24,750 If there's any notes I want to put in, 358 358 00:12:24,750 --> 00:12:26,100 I could put them in here and true. 359 359 00:12:26,100 --> 00:12:27,810 I'm just going to hit Enter and make that blank. 360 360 00:12:27,810 --> 00:12:30,030 And it's going to insert that into one row. 361 361 00:12:30,030 --> 00:12:31,980 Now if I want to enter another domain to search, 362 362 00:12:31,980 --> 00:12:33,390 I can do that here as well. 363 363 00:12:33,390 --> 00:12:36,000 Let's go ahead and do insert domains. 364 364 00:12:36,000 --> 00:12:38,373 And in this case, I'm going to use udemy.com. 365 365 00:12:39,840 --> 00:12:41,370 Another one I want to enter, 366 366 00:12:41,370 --> 00:12:43,650 let's go ahead and do db insert. 367 367 00:12:43,650 --> 00:12:44,880 And we'll do domains, 368 368 00:12:44,880 --> 00:12:46,593 and I'm going to use tesla.com. 369 369 00:12:48,030 --> 00:12:49,740 And again, no notes. 370 370 00:12:49,740 --> 00:12:50,573 All right, 371 371 00:12:50,573 --> 00:12:52,680 we have now inserted three different domain names, 372 372 00:12:52,680 --> 00:12:55,920 diontraining.com, udemy.com and tesla.com, 373 373 00:12:55,920 --> 00:12:57,450 into our database. 374 374 00:12:57,450 --> 00:13:00,300 Now if we want to see that and verify it took, 375 375 00:13:00,300 --> 00:13:03,390 we can use the command show and then the name of the table, 376 376 00:13:03,390 --> 00:13:04,830 in this case, domains. 377 377 00:13:04,830 --> 00:13:06,870 So show domains. 378 378 00:13:06,870 --> 00:13:08,610 And here is our table. 379 379 00:13:08,610 --> 00:13:10,500 Boom, we have three rows, 380 380 00:13:10,500 --> 00:13:13,530 diontraining.com, udemy.com, tesla.com. 381 381 00:13:13,530 --> 00:13:14,790 No notes on any of them. 382 382 00:13:14,790 --> 00:13:16,950 And the module was user-defined, 383 383 00:13:16,950 --> 00:13:19,500 because I manually enter that information. 384 384 00:13:19,500 --> 00:13:21,630 All right, now that we have loaded our module, 385 385 00:13:21,630 --> 00:13:24,360 now that we have entered our information into the database, 386 386 00:13:24,360 --> 00:13:26,790 we are ready to start searching the whois database 387 387 00:13:26,790 --> 00:13:29,010 for these points of contact. 388 388 00:13:29,010 --> 00:13:29,843 Now, what we're going to do 389 389 00:13:29,843 --> 00:13:32,640 is we are going to use this whois poc module. 390 390 00:13:32,640 --> 00:13:34,680 If you don't know what that module is, 391 391 00:13:34,680 --> 00:13:35,970 well, we're inside of it now, 392 392 00:13:35,970 --> 00:13:38,340 so we can just type in the command info. 393 393 00:13:38,340 --> 00:13:39,360 By typing info, 394 394 00:13:39,360 --> 00:13:41,850 it's going to tell me about the module I'm currently in. 395 395 00:13:41,850 --> 00:13:44,310 Notice when I typed info for whois pocs, 396 396 00:13:44,310 --> 00:13:47,370 it tells me this is the Whois POC Harvester, 397 397 00:13:47,370 --> 00:13:50,100 who wrote it, the version and a short description of it. 398 398 00:13:50,100 --> 00:13:52,170 It's going to use the ARIN whois database 399 399 00:13:52,170 --> 00:13:55,170 to able to harvest POC data from the whois queries 400 400 00:13:55,170 --> 00:13:56,223 for the given domain. 401 401 00:13:56,223 --> 00:13:58,800 This is also going to update our contacts table 402 402 00:13:58,800 --> 00:14:00,990 with the results inside of our workspace. 403 403 00:14:00,990 --> 00:14:02,310 So that data we get back 404 404 00:14:02,310 --> 00:14:04,950 is going to fill part of our database in the workspace, 405 405 00:14:04,950 --> 00:14:07,350 so we can go back and look at that information later. 406 406 00:14:07,350 --> 00:14:09,540 Now we have some options that we have to have. 407 407 00:14:09,540 --> 00:14:10,650 We have a source. 408 408 00:14:10,650 --> 00:14:12,330 We have the value of default. 409 409 00:14:12,330 --> 00:14:13,530 It's required field, 410 410 00:14:13,530 --> 00:14:15,900 and the description is the source of input. 411 411 00:14:15,900 --> 00:14:17,610 Now, by default, 412 412 00:14:17,610 --> 00:14:20,100 that means it's going to go and grab it from the table. 413 413 00:14:20,100 --> 00:14:21,990 Those three domain names we just put in 414 414 00:14:21,990 --> 00:14:25,290 in rows one, two, and three using the domains table. 415 415 00:14:25,290 --> 00:14:27,210 If I wanted to do this from a file, 416 416 00:14:27,210 --> 00:14:30,060 I could do that as well by changing this default value 417 417 00:14:30,060 --> 00:14:32,340 from default to the file name. 418 418 00:14:32,340 --> 00:14:34,410 In our case, we're going to do it right from the database. 419 419 00:14:34,410 --> 00:14:36,360 It keeps it nice. It keeps it clean. 420 420 00:14:36,360 --> 00:14:38,220 And that's the way we're going to do it. 421 421 00:14:38,220 --> 00:14:39,690 Now, if I wanted to change that, 422 422 00:14:39,690 --> 00:14:44,100 I could do that by changing that by saying options set, 423 423 00:14:44,100 --> 00:14:45,630 because I'm changing the options. 424 424 00:14:45,630 --> 00:14:47,940 In this case, I want to set the value of that 425 425 00:14:47,940 --> 00:14:49,740 from default to something else. 426 426 00:14:49,740 --> 00:14:51,360 Now in our case, I don't want to do that, 427 427 00:14:51,360 --> 00:14:52,920 so I'm going to go ahead and delete that. 428 428 00:14:52,920 --> 00:14:53,753 But you could do that 429 429 00:14:53,753 --> 00:14:55,710 if you wanted to go ahead and read it from a file, 430 430 00:14:55,710 --> 00:14:58,050 read it from an SQL query or something else. 431 431 00:14:58,050 --> 00:14:59,730 As you can see here, the default is 432 432 00:14:59,730 --> 00:15:02,640 to select distinct domain from domains 433 433 00:15:02,640 --> 00:15:04,470 where domain is not null, 434 434 00:15:04,470 --> 00:15:06,450 which just basically means go into the database, 435 435 00:15:06,450 --> 00:15:07,980 look for the domains table. 436 436 00:15:07,980 --> 00:15:10,470 And any domain inside of the domains table, 437 437 00:15:10,470 --> 00:15:12,180 I want to grab each one that's not blank, 438 438 00:15:12,180 --> 00:15:13,230 and we're going to test it. 439 439 00:15:13,230 --> 00:15:14,850 So this is going to allow me to test all three of them 440 440 00:15:14,850 --> 00:15:16,230 with one command. 441 441 00:15:16,230 --> 00:15:18,210 Now that we know that our options are good, 442 442 00:15:18,210 --> 00:15:19,560 to run this command, 443 443 00:15:19,560 --> 00:15:22,920 we are just going to simply type run and hit Enter. 444 444 00:15:22,920 --> 00:15:24,450 When we do that, it's going to go off, 445 445 00:15:24,450 --> 00:15:26,340 and it is pulling that information, 446 446 00:15:26,340 --> 00:15:27,690 and it's grabbing all that information, 447 447 00:15:27,690 --> 00:15:29,280 and it dumps it to the screen. 448 448 00:15:29,280 --> 00:15:30,420 Now, that's helpful. 449 449 00:15:30,420 --> 00:15:32,550 But the screen makes it pretty hard to read, 450 450 00:15:32,550 --> 00:15:34,380 because I'd have to scroll up and look at that, 451 451 00:15:34,380 --> 00:15:36,150 because we just found 16 new records, 452 452 00:15:36,150 --> 00:15:38,190 and 12 of those were new contacts 453 453 00:15:38,190 --> 00:15:39,600 that were either not duplicated 454 454 00:15:39,600 --> 00:15:41,610 or were new things that we wanted to add. 455 455 00:15:41,610 --> 00:15:43,920 Those all got put into our database. 456 456 00:15:43,920 --> 00:15:45,150 Now, if you remember back, 457 457 00:15:45,150 --> 00:15:47,130 I said we can show things from the database 458 458 00:15:47,130 --> 00:15:48,480 using the show command. 459 459 00:15:48,480 --> 00:15:52,680 Before, we use show with domains to show the three domains. 460 460 00:15:52,680 --> 00:15:56,130 Now I want to go ahead and use show with contacts 461 461 00:15:56,130 --> 00:15:58,020 to see the contacts table. 462 462 00:15:58,020 --> 00:15:58,980 Here it is. 463 463 00:15:58,980 --> 00:16:00,840 So we have those 12 entries 464 464 00:16:00,840 --> 00:16:03,390 going from row one all the way down to row 12. 465 465 00:16:03,390 --> 00:16:05,100 Now my screen is a little bit zoomed in 466 466 00:16:05,100 --> 00:16:07,080 to make it easier for you to read in the video. 467 467 00:16:07,080 --> 00:16:08,040 If I was zoomed out, 468 468 00:16:08,040 --> 00:16:10,080 it would all fit in one nice table. 469 469 00:16:10,080 --> 00:16:11,940 Here you could see that three columns, 470 470 00:16:11,940 --> 00:16:13,770 the phone, notes and module row, 471 471 00:16:13,770 --> 00:16:15,420 went to the second line. 472 472 00:16:15,420 --> 00:16:17,760 Now let's go ahead and read the first line. 473 473 00:16:17,760 --> 00:16:20,550 The first line we have is based on Udemy. 474 474 00:16:20,550 --> 00:16:23,250 You could see here that we found no first name, 475 475 00:16:23,250 --> 00:16:24,270 no middle name. 476 476 00:16:24,270 --> 00:16:26,340 The last name was Operations Architect. 477 477 00:16:26,340 --> 00:16:29,610 The email was netops+ARIN@udemy.com. 478 478 00:16:29,610 --> 00:16:31,500 The title was Whois contact, 479 479 00:16:31,500 --> 00:16:33,660 because that's the type of information we got. 480 480 00:16:33,660 --> 00:16:35,760 The region, San Francisco, California. 481 481 00:16:35,760 --> 00:16:37,590 The country, United States. 482 482 00:16:37,590 --> 00:16:40,980 And then phone, blank. Notes, blank. 483 483 00:16:40,980 --> 00:16:43,380 Module, whois pocs, 484 484 00:16:43,380 --> 00:16:45,930 which is the module we use to find this information. 485 485 00:16:45,930 --> 00:16:48,930 Now there's lots of modules in Recon-ng. 486 486 00:16:48,930 --> 00:16:51,600 You might be finding contacts by doing Twitter searches, 487 487 00:16:51,600 --> 00:16:54,240 LinkedIn searches, Google searches, whatever it is, 488 488 00:16:54,240 --> 00:16:55,860 All that will go into this database 489 489 00:16:55,860 --> 00:16:57,990 to create our table of people. 490 490 00:16:57,990 --> 00:17:00,870 But this tells us which module found that information 491 491 00:17:00,870 --> 00:17:02,760 and which type of information it was. 492 492 00:17:02,760 --> 00:17:04,890 In this case, a whois contact. 493 493 00:17:04,890 --> 00:17:06,990 Next, we have lines two through 12. 494 494 00:17:06,990 --> 00:17:08,790 And these are all based on Tesla. 495 495 00:17:08,790 --> 00:17:11,160 Now you'll notice Dion training didn't show up. 496 496 00:17:11,160 --> 00:17:13,530 The reason for that is we actually have our whois records 497 497 00:17:13,530 --> 00:17:14,940 set up with privacy, 498 498 00:17:14,940 --> 00:17:17,730 and so those are not going to be shared in the whois database. 499 499 00:17:17,730 --> 00:17:19,560 It just says this is a private record. 500 500 00:17:19,560 --> 00:17:21,180 So there was no way to grab that information 501 501 00:17:21,180 --> 00:17:22,560 and add it to the table. 502 502 00:17:22,560 --> 00:17:24,120 That's why we have the one for Udemy, 503 503 00:17:24,120 --> 00:17:25,110 which is a very common way 504 504 00:17:25,110 --> 00:17:26,850 of doing it for a large organization. 505 505 00:17:26,850 --> 00:17:28,860 They actually have a group email, 506 506 00:17:28,860 --> 00:17:30,150 not a person's email. 507 507 00:17:30,150 --> 00:17:31,320 But if we look at Tesla, 508 508 00:17:31,320 --> 00:17:32,820 they chose not to do that. 509 509 00:17:32,820 --> 00:17:35,520 Tesla actually has individual people's names. 510 510 00:17:35,520 --> 00:17:36,630 Now as I look at them, 511 511 00:17:36,630 --> 00:17:38,760 what is this information that's going to be useful? 512 512 00:17:38,760 --> 00:17:42,150 Well, for one, I have names of people and emails I can use. 513 513 00:17:42,150 --> 00:17:43,500 That's the obvious one. 514 514 00:17:43,500 --> 00:17:44,760 But in addition to that, 515 515 00:17:44,760 --> 00:17:46,800 I might be able to figure out what naming scheme 516 516 00:17:46,800 --> 00:17:48,150 that company uses. 517 517 00:17:48,150 --> 00:17:50,670 For example, maybe you can't find everybody's email 518 518 00:17:50,670 --> 00:17:52,410 when you're doing your open source research. 519 519 00:17:52,410 --> 00:17:54,900 But you found their first and last name on LinkedIn. 520 520 00:17:54,900 --> 00:17:57,000 Well, if you know that the company uses 521 521 00:17:57,000 --> 00:18:01,050 first name dot last name, like elon.musk@tesla.com, 522 522 00:18:01,050 --> 00:18:02,010 then you could put that in 523 523 00:18:02,010 --> 00:18:03,840 for everybody you find on LinkedIn, 524 524 00:18:03,840 --> 00:18:05,550 and now you have their email. 525 525 00:18:05,550 --> 00:18:07,980 Conversely though, we actually don't see that here. 526 526 00:18:07,980 --> 00:18:11,310 With Tesla, I am seeing multiple different naming schemes. 527 527 00:18:11,310 --> 00:18:13,860 The first one, Anna, actually shows up as Ann, 528 528 00:18:13,860 --> 00:18:15,690 which is three letters from her first name 529 529 00:18:15,690 --> 00:18:19,020 and then her full last name, martinez@tesla.com. 530 530 00:18:19,020 --> 00:18:21,630 The next one is just an abbreviation for the name Cameron. 531 531 00:18:21,630 --> 00:18:24,270 And they called it cam@tesla.com. 532 532 00:18:24,270 --> 00:18:25,890 The next one is Cheri, 533 533 00:18:25,890 --> 00:18:28,320 but it's abbreviated down to C-H-E, 534 534 00:18:28,320 --> 00:18:29,790 the first three letters again, 535 535 00:18:29,790 --> 00:18:32,730 and then her last name, lewis@tesla.com. 536 536 00:18:32,730 --> 00:18:33,810 We get down to Elon Musk, 537 537 00:18:33,810 --> 00:18:35,580 it's first name dot last name. 538 538 00:18:35,580 --> 00:18:37,290 We get down to Jian Gu, 539 539 00:18:37,290 --> 00:18:40,200 we're seeing his full name slap together with no period, 540 540 00:18:40,200 --> 00:18:42,060 so it's another different convention. 541 541 00:18:42,060 --> 00:18:43,410 We go down to line nine, 542 542 00:18:43,410 --> 00:18:45,210 and we see mahdesai. 543 543 00:18:45,210 --> 00:18:46,770 And this is the first three letters 544 544 00:18:46,770 --> 00:18:49,140 and the last name@tesla.com. 545 545 00:18:49,140 --> 00:18:50,760 We get down to Paul Smicker, 546 546 00:18:50,760 --> 00:18:52,740 and we just see paul@tesla.com. 547 547 00:18:52,740 --> 00:18:54,090 We get down to Terry Chi, 548 548 00:18:54,090 --> 00:18:56,490 and we see tchi@tesla.com. 549 549 00:18:56,490 --> 00:18:59,280 So we're seeing a little bit of differentiation here. 550 550 00:18:59,280 --> 00:19:02,370 But several of them, I saw at least three, 551 551 00:19:02,370 --> 00:19:04,800 that had the first three letters and then the last name. 552 552 00:19:04,800 --> 00:19:06,960 So I'm thinking that might be the naming convention 553 553 00:19:06,960 --> 00:19:08,700 at Tesla for their employees. 554 554 00:19:08,700 --> 00:19:10,320 Now, if I wanted to validate that, 555 555 00:19:10,320 --> 00:19:13,170 I could take some people's names who I find on LinkedIn, 556 556 00:19:13,170 --> 00:19:15,180 and I know their first name and last name, 557 557 00:19:15,180 --> 00:19:16,200 put them into that format 558 558 00:19:16,200 --> 00:19:19,260 of the first three letters and their last name@tesla.com 559 559 00:19:19,260 --> 00:19:21,090 and then see is it a valid email 560 560 00:19:21,090 --> 00:19:24,030 by checking something like email dossier at CentralOps 561 561 00:19:24,030 --> 00:19:25,440 or other things like that. 562 562 00:19:25,440 --> 00:19:26,520 So hopefully, you can start seeing 563 563 00:19:26,520 --> 00:19:28,560 how we put all these different tools together 564 564 00:19:28,560 --> 00:19:31,350 and get information from different places, consolidate it, 565 565 00:19:31,350 --> 00:19:32,760 and then we can start doing things with it, 566 566 00:19:32,760 --> 00:19:35,190 like spearfishing campaigns or railing campaigns 567 567 00:19:35,190 --> 00:19:36,930 or social engineering in general. 568 568 00:19:36,930 --> 00:19:39,540 Lots of different ways to start using this information. 569 569 00:19:39,540 --> 00:19:40,800 Now, as I said at the beginning, 570 570 00:19:40,800 --> 00:19:43,287 there are a lot of different modules to Recon-ng. 571 571 00:19:43,287 --> 00:19:45,420 And I just wanted to show you the basic usage, 572 572 00:19:45,420 --> 00:19:48,300 because all the modules work the same way. 573 573 00:19:48,300 --> 00:19:51,060 As you go into a workspace and then as you go into a module, 574 574 00:19:51,060 --> 00:19:53,070 you're going to keep going through the directory structure 575 575 00:19:53,070 --> 00:19:57,360 like you saw here, recon-ng, Dion, whois pocs. 576 576 00:19:57,360 --> 00:19:58,770 Now, if I wanted to go back, 577 577 00:19:58,770 --> 00:20:00,270 I could just type in the word back, 578 578 00:20:00,270 --> 00:20:02,400 and it'll bring me up a level as well. 579 579 00:20:02,400 --> 00:20:04,980 And then I can go ahead and load a different workspace. 580 580 00:20:04,980 --> 00:20:07,260 And then I can go ahead and do another assessment. 581 581 00:20:07,260 --> 00:20:09,660 Now remember, you can always use the show command 582 582 00:20:09,660 --> 00:20:11,580 to show anything you want. 583 583 00:20:11,580 --> 00:20:14,790 Just like I did show domains or show contacts, 584 584 00:20:14,790 --> 00:20:16,440 you can also show companies. 585 585 00:20:16,440 --> 00:20:17,730 You can show credentials. 586 586 00:20:17,730 --> 00:20:21,120 You can show hosts, leaks, locations, net blocks, 587 587 00:20:21,120 --> 00:20:25,590 ports, profile, pushpins, repositories and vulnerabilities, 588 588 00:20:25,590 --> 00:20:27,990 because all of those have tables in the database 589 589 00:20:27,990 --> 00:20:30,720 as you saw when we look at the database schema. 590 590 00:20:30,720 --> 00:20:33,420 Now, all of those get things from various modules 591 591 00:20:33,420 --> 00:20:34,890 that you may or may not install. 592 592 00:20:34,890 --> 00:20:36,930 So that's the important thing is to have the right module 593 593 00:20:36,930 --> 00:20:38,880 for the right thing you're trying to grab. 594 594 00:20:38,880 --> 00:20:41,250 In this demonstration, I only used one module, 595 595 00:20:41,250 --> 00:20:43,020 and I only searched for contacts, 596 596 00:20:43,020 --> 00:20:45,630 so that's why we saw things in the show contacts 597 597 00:20:45,630 --> 00:20:48,120 to display my findings as you see here on the screen. 598 598 00:20:48,120 --> 00:20:49,140 But the great thing 599 599 00:20:49,140 --> 00:20:51,330 is if I ran other searches from other modules, 600 600 00:20:51,330 --> 00:20:52,740 and they found contacts, 601 601 00:20:52,740 --> 00:20:54,090 they would also be in this table, 602 602 00:20:54,090 --> 00:20:56,250 and I could easily see those, too. 603 603 00:20:56,250 --> 00:20:57,810 Now hopefully, you're starting to see 604 604 00:20:57,810 --> 00:20:59,490 how all of this starts coming together. 605 605 00:20:59,490 --> 00:21:01,770 And you're going to play with it a little bit more on your own. 606 606 00:21:01,770 --> 00:21:03,840 As I said before, the thing that's going to make you 607 607 00:21:03,840 --> 00:21:07,110 a great cybersecurity analyst is hands on the keyboard, 608 608 00:21:07,110 --> 00:21:08,610 practicing with this stuff, 609 609 00:21:08,610 --> 00:21:10,770 doing different reconnaissance evolutions, 610 610 00:21:10,770 --> 00:21:12,900 trying to find information that's out there. 611 611 00:21:12,900 --> 00:21:15,000 Now, the great thing about open source intelligence 612 612 00:21:15,000 --> 00:21:16,380 and learning how to do this 613 613 00:21:16,380 --> 00:21:18,270 is that all the information is out there. 614 614 00:21:18,270 --> 00:21:20,730 You don't need permission from any of these companies 615 615 00:21:20,730 --> 00:21:22,050 to go look up this information, 616 616 00:21:22,050 --> 00:21:25,320 because it's all public information that's sitting online. 617 617 00:21:25,320 --> 00:21:26,250 And this is a great way for you 618 618 00:21:26,250 --> 00:21:27,690 to start building up your skills 619 619 00:21:27,690 --> 00:21:30,120 early on in the reconnaissance process. 620 620 00:21:30,120 --> 00:21:32,160 'Cause as long as you're doing passive reconnaissance, 621 621 00:21:32,160 --> 00:21:34,110 you're not touching that company servers, 622 622 00:21:34,110 --> 00:21:36,360 and you are not conducting any kind of hacking. 623 623 00:21:36,360 --> 00:21:37,950 You're just in the preparation phases. 624 624 00:21:37,950 --> 00:21:39,630 You're just learning information. 625 625 00:21:39,630 --> 00:21:41,700 And using these tools and getting better at them, 626 626 00:21:41,700 --> 00:21:43,650 it's going to make you a better analyst or pen tester 627 627 00:21:43,650 --> 00:21:44,483 in the long run.