Instructor: Harvesting Techniques. 2 2
The last harvesting techniques I want to talk about 3 3
are DNS and website harvesting techniques. 4 4
First, let's start with DNS, and when we do that 5 5
we need to talk about who is now whois. 6 6
Now whois is a public listing of all the registered domains 7 7
and all their registered administrators. 8 8
This is a place we can go look up Diontraining.com 9 9
and find out who owns that domain, what's their address, 10 10
what's their phone number, and what's their email. 11 11
We also can get other information 12 12
about them from this public database. 13 13
Now if you have a DNS service that's misconfigured 14 14
within your network, 15 15
you can have a DNS zone transfer that could be allowed. 16 16
And this is another way that DNS information 17 17
could be harvested from you. 18 18
A DNS zone transfer is a method 19 19
of replicating DNS database entries 20 20
across a set of DNS servers. 21 21
And this is usually used as a legitimate thing, 22 22
but it can also be used 23 23
as part of the reconnaissance phase of an attack. 24 24
Now, there are two ways to do this, 25 25
and you can see them here on your screen. 26 26
On the top you'll see the Windows version, 27 27
and on the bottom you'll see the Mac or Linux version. 28 28
On the top, we're using Windows, 29 29
and this is going to use the NS lookup command. 30 30
You're going to enter the interactive mode 31 31
to be able to attempt your zone transfer. 32 32
You'll then type in set type=any 33 33
which says tell me all the records you know 34 34
on this DNS server, 35 35
and then you'll type in ls-d 36 36
and then the website you want to do the zone transfer from. 37 37
If their server is misconfigured, 38 38
you'll be able to download all their information 39 39
from their DNS to your machine. 40 40
Now if you try this on our server, it's going to fail. 41 41
Why? Because we're not misconfigured. 42 42
Now on the bottom you see that I'm doing this from a Mac. 43 43
A Mac, Unix, or Linux machine uses the same command. 44 44
It uses dig. 45 45
Now dig is going to use dig axfr 46 46
which is the command for a transfer, a zone transfer. 47 47
And then we're going to use the name server and the target. 48 48
So I want to go from ns.diontraning.com 49 49
to ns.attacker.com. 50 50
And if I was vulnerable to this attack, 51 51
it would copy all those DNS entries 52 52
over to my attackers names server, 53 53
so they can then go through it 54 54
and use that information to go through and attain things 55 55
like your IP addresses for your servers, your sub-domains, 56 56
and other information like that. 57 57
Now, when you do all of this, 58 58
this is known as DNS harvesting. 59 59
And DNS harvesting uses open-source intelligence 60 60
to gather information about a domain. 61 61
Things like your sub-domains, the hosting provider, 62 62
the administrative contacts, 63 63
and other information like that. 64 64
Now, another thing you can do is do web harvesting. 65 65
And when you do web harvesting, 66 66
you're going to do a website harvesting technique 67 67
that copies the source code of the website files, 68 68
so that way you can analyze it later 69 69
for information and vulnerabilities. 70 70
You can use a website copier or website ripper, 71 71
and this will allow you to actually download it 72 72
to your local machine and take your time offline 73 73
to go through and look at that application. 74 74
If you're going to be doing an analysis of an application, 75 75
like a static analysis, 76 76
you can actually use this to your benefit 77 77
to download all that code and then go through it. 78 78
As you're doing that, you'll find things 79 79
that might have old or forgotten pages, 80 80
things that have weak code, and things of that nature 81 81
that you can collect 82 82
as part of your reconnaissance efforts as well. 83 83
Now, again, a quick exam tip. 84 84
For the exam, you do not need to know 85 85
how to do this zone transfer, 86 86
but you need to know the concept of a zone transfer. 87 87
And the idea is a zone transfer can be used 88 88
to collect DNS information about your servers 89 89
and give it to an attacker so they can plan further attacks. 90 90
But you don't need to actually be able 91 91
to perform the zone transfer 92 92
and memorize the NS lookup commands 93 93
or the dig commands to perform them.