Instructor: Profiling techniques. 2 2
When we talk about profiling techniques, 3 3
our goal here is to identify who works 4 4
at a particular company. 5 5
We can do this a lot of different ways 6 6
including gathering all those different emails 7 7
that are out there on the internet, 8 8
as well as looking at social media. 9 9
Let's first talk about emails. 10 10
Email harvesting is an open source intelligence 11 11
or OSINT technique that's used 12 12
to gather email addresses from a given domain. 13 13
So for example if I wanted 14 14
to find all the people who worked 15 15
at Dion Training, I can start finding email 16 16
addresses online by searching for @diontraining.com. 17 17
And based on those addresses, 18 18
I might be able to start gathering who else works 19 19
at that company and get information there 20 20
to build my list as I start trying 21 21
to profile the people at this organization. 22 22
For example, if I find jason@diontraining, 23 23
I can start figuring out a couple of things. 24 24
One, Jason works there, and two, 25 25
the format of those email addresses, 26 26
probably people's first name @diontraining. 27 27
Or what if I found one that was jdion@diontraining? 28 28
Well, that tells me they're probably using 29 29
a first letter of the first name 30 30
and then their last name as part of their email address. 31 31
And based on that I can start guessing 32 32
other people that work there. 33 33
Maybe I have one that's Jason.dion@diontraining. 34 34
That tells me it's first name dot last name 35 35
and again, I can start guessing those addresses 36 36
because if I know the CEO's name is John Smith, 37 37
then probably his email is john.smith@diontraining.com 38 38
and I can start attacking that person 39 39
with some kind of a social engineering campaign. 40 40
Now, some companies realize this 41 41
and they start making very confusing email addresses, 42 42
like jd1234@diontraining.com. 43 43
Based on that, it'd be very hard 44 44
for me to start guessing who works there. 45 45
I wouldn't know if the guy's name was John or Jason or Joey, 46 46
but I know it's JD, and that's probably some initials. 47 47
And then this number is just randomized, and so 48 48
that makes it very hard to figure out who it is. 49 49
Now, most companies aren't doing this though. 50 50
Why? 51 51
Because this makes it harder for their employees 52 52
to email each other too, 53 53
because they don't know each other's names then, right? 54 54
And so there is usually a standard convention 55 55
like a first name, a last name, 56 56
a first letter and a last name, 57 57
or a first name dot a last name, 58 58
or something of that nature. 59 59
Now, some other things you can look at when 60 60
you start looking at these different emails is 61 61
some other ways that they're done. 62 62
For instance, our company uses support@diontraining.com 63 63
and you know that's a valid address 64 64
that goes to lots of different people. 65 65
But if you emailed something like 66 66
operations@diontraining.com, that might work too 67 67
and it might get to my operations team. 68 68
Or you might have instructor@diontraining 69 69
and you guess things based on the person's position, 70 70
that might be something that's there. 71 71
Or if you have things like that, you might guess 72 72
that the COO or the CEO has their email address 73 73
of coo@diontraining.com for your chief operating officer. 74 74
And by guessing these things, you can start then 75 75
building up your campaigns and figuring things out. 76 76
Now, there are many different ways to gather email 77 77
addresses when you're doing this email harvesting, 78 78
besides just sitting there and guessing them 79 79
like I was just doing. 80 80
We can go and buy them from spammers 81 81
or legitimate sites as sales leads 82 82
and we would get a list of 10,000 emails for $20, 83 83
and then we could start going through those. 84 84
Or we might go to Google and we start searching 85 85
for things like I said before. 86 86
For example, you might search for a star@diontraining.com 87 87
on Google to see what comes back anywhere 88 88
that we have an @diontraining.com email address 89 89
listed on some website, some piece 90 90
of social media or something like that. 91 91
Or you can actually test these emails 92 92
by checking if they're going to bounce back 93 93
by going through and using an email dossier. 94 94
As I do pen tests, I love to use centralops.net. 95 95
I can put in an email address here 96 96
and it will actually test that email and tell me 97 97
if it's valid before I ever send an email to that server. 98 98
This way, I can prepare my attacks 99 99
as part of my reconnaissance phase 100 100
and weaponization before I move into delivery. 101 101
Now, once the attacker has this list created, 102 102
now they can start using that 103 103
in social engineering attempts, 104 104
and there's lots of different ways you can do this as well. 105 105
For example, I might take some of those email addresses 106 106
and use them to find you on social media. 107 107
Now that I have you on social media, 108 108
I can build up a friendship and trust 109 109
and then conduct additional 110 110
social engineering attempts against you there. 111 111
By using this information that I've gathered 112 112
from this email harvesting, it gives me a foothold 113 113
and a way into your organization to be able 114 114
to start finding out more details about you, 115 115
about the people you employ, 116 116
and what weaknesses you may have. 117 117
Now, another way we can do this is we can actually 118 118
start taking that information from the social media sites 119 119
and use OSINT software to collect it all for us 120 120
because this can be really time consuming otherwise, 121 121
and we want to have a way to aggregate 122 122
and process all that data 123 123
from all these different sites 124 124
to create this detailed picture 125 125
of the user's interests, their habits, 126 126
their geographic locations, and other things like that. 127 127
And just three of those sites 128 128
that are used by attackers are ones 129 129
like these, pipl.com, peeku.com, and echosec.net. 130 130
All of these are open source intelligent tools 131 131
that do this aggregation for you to find out 132 132
and build these profiles on those users for a given company. 133 133
Now, the last one I want to talk about is the harvester 134 134
and the harvester is one you'll actually talk 135 135
about and learn about inside pen test plus. 136 136
This is a command line tool used by penetration testers 137 137
to gather subdomain information 138 138
and email addresses across an organization 139 139
as they're trying to do their pen test 140 140
to gather information for a 141 141
follow on social engineering attack. 142 142
Now for the exam, everything I covered 143 143
in this lesson is not really going to be tested. 144 144
You're not going to get a lot of questions on them, 145 145
but you should be thinking about these 146 146
as you're building your profiles and your scenarios 147 147
as part of threat hunting and threat modeling, 148 148
because they are ways and attack vectors that could be used 149 149
by an attacker to target your organization.