1 1 00:00:00,240 --> 00:00:02,160 Harvesting Techniques. 2 2 00:00:02,160 --> 00:00:04,290 The last harvesting techniques I want to talk about 3 3 00:00:04,290 --> 00:00:07,260 are DNS and website harvesting techniques. 4 4 00:00:07,260 --> 00:00:09,690 First, let's start with DNS, and when we do that 5 5 00:00:09,690 --> 00:00:11,497 we need to talk about who is now whois. 6 6 00:00:11,497 --> 00:00:15,090 Now whois is a public listing of all the registered domains 7 7 00:00:15,090 --> 00:00:17,160 and all their registered administrators. 8 8 00:00:17,160 --> 00:00:19,620 This is a place we can go look up Diontraining.com 9 9 00:00:19,620 --> 00:00:22,500 and find out who owns that domain, what's their address, 10 10 00:00:22,500 --> 00:00:24,690 what's their phone number, and what's their email. 11 11 00:00:24,690 --> 00:00:26,160 We also can get other information 12 12 00:00:26,160 --> 00:00:28,770 about them from this public database. 13 13 00:00:28,770 --> 00:00:31,290 Now if you have a DNS service that's misconfigured 14 14 00:00:31,290 --> 00:00:32,250 within your network, 15 15 00:00:32,250 --> 00:00:35,280 you can have a DNS zone transfer that could be allowed. 16 16 00:00:35,280 --> 00:00:37,470 And this is another way that DNS information 17 17 00:00:37,470 --> 00:00:39,270 could be harvested from you. 18 18 00:00:39,270 --> 00:00:41,250 A DNS zone transfer is a method 19 19 00:00:41,250 --> 00:00:43,470 of replicating DNS database entries 20 20 00:00:43,470 --> 00:00:45,660 across a set of DNS servers. 21 21 00:00:45,660 --> 00:00:48,150 And this is usually used as a legitimate thing, 22 22 00:00:48,150 --> 00:00:49,650 but it can also be used 23 23 00:00:49,650 --> 00:00:52,380 as part of the reconnaissance phase of an attack. 24 24 00:00:52,380 --> 00:00:54,210 Now, there are two ways to do this, 25 25 00:00:54,210 --> 00:00:56,040 and you can see them here on your screen. 26 26 00:00:56,040 --> 00:00:57,870 On the top you'll see the Windows version, 27 27 00:00:57,870 --> 00:01:00,960 and on the bottom you'll see the Mac or Linux version. 28 28 00:01:00,960 --> 00:01:02,820 On the top, we're using Windows, 29 29 00:01:02,820 --> 00:01:05,310 and this is going to use the NS lookup command. 30 30 00:01:05,310 --> 00:01:06,960 You're going to enter the interactive mode 31 31 00:01:06,960 --> 00:01:08,760 to be able to attempt your zone transfer. 32 32 00:01:08,760 --> 00:01:12,090 You'll then type in set type=any 33 33 00:01:12,090 --> 00:01:14,040 which says tell me all the records you know 34 34 00:01:14,040 --> 00:01:15,510 on this DNS server, 35 35 00:01:15,510 --> 00:01:17,910 and then you'll type in ls-d 36 36 00:01:17,910 --> 00:01:21,300 and then the website you want to do the zone transfer from. 37 37 00:01:21,300 --> 00:01:23,100 If their server is misconfigured, 38 38 00:01:23,100 --> 00:01:25,470 you'll be able to download all their information 39 39 00:01:25,470 --> 00:01:27,840 from their DNS to your machine. 40 40 00:01:27,840 --> 00:01:30,360 Now if you try this on our server, it's going to fail. 41 41 00:01:30,360 --> 00:01:32,640 Why? Because we're not misconfigured. 42 42 00:01:32,640 --> 00:01:35,400 Now on the bottom you see that I'm doing this from a Mac. 43 43 00:01:35,400 --> 00:01:38,760 A Mac, Unix, or Linux machine uses the same command. 44 44 00:01:38,760 --> 00:01:40,110 It uses dig. 45 45 00:01:40,110 --> 00:01:42,700 Now dig is going to use dig axfr 46 46 00:01:44,190 --> 00:01:47,160 which is the command for a transfer, a zone transfer. 47 47 00:01:47,160 --> 00:01:49,770 And then we're going to use the name server and the target. 48 48 00:01:49,770 --> 00:01:53,037 So I want to go from ns.diontraning.com 49 49 00:01:53,037 --> 00:01:54,990 to ns.attacker.com. 50 50 00:01:54,990 --> 00:01:57,060 And if I was vulnerable to this attack, 51 51 00:01:57,060 --> 00:01:59,010 it would copy all those DNS entries 52 52 00:01:59,010 --> 00:02:01,050 over to my attackers names server, 53 53 00:02:01,050 --> 00:02:02,250 so they can then go through it 54 54 00:02:02,250 --> 00:02:04,560 and use that information to go through and attain things 55 55 00:02:04,560 --> 00:02:07,500 like your IP addresses for your servers, your sub-domains, 56 56 00:02:07,500 --> 00:02:09,810 and other information like that. 57 57 00:02:09,810 --> 00:02:11,010 Now, when you do all of this, 58 58 00:02:11,010 --> 00:02:13,200 this is known as DNS harvesting. 59 59 00:02:13,200 --> 00:02:15,780 And DNS harvesting uses open-source intelligence 60 60 00:02:15,780 --> 00:02:18,090 to gather information about a domain. 61 61 00:02:18,090 --> 00:02:20,460 Things like your sub-domains, the hosting provider, 62 62 00:02:20,460 --> 00:02:21,660 the administrative contacts, 63 63 00:02:21,660 --> 00:02:23,760 and other information like that. 64 64 00:02:23,760 --> 00:02:26,310 Now, another thing you can do is do web harvesting. 65 65 00:02:26,310 --> 00:02:27,660 And when you do web harvesting, 66 66 00:02:27,660 --> 00:02:29,820 you're going to do a website harvesting technique 67 67 00:02:29,820 --> 00:02:32,580 that copies the source code of the website files, 68 68 00:02:32,580 --> 00:02:34,050 so that way you can analyze it later 69 69 00:02:34,050 --> 00:02:36,210 for information and vulnerabilities. 70 70 00:02:36,210 --> 00:02:39,060 You can use a website copier or website ripper, 71 71 00:02:39,060 --> 00:02:40,710 and this will allow you to actually download it 72 72 00:02:40,710 --> 00:02:43,050 to your local machine and take your time offline 73 73 00:02:43,050 --> 00:02:45,510 to go through and look at that application. 74 74 00:02:45,510 --> 00:02:48,240 If you're going to be doing an analysis of an application, 75 75 00:02:48,240 --> 00:02:49,590 like a static analysis, 76 76 00:02:49,590 --> 00:02:51,090 you can actually use this to your benefit 77 77 00:02:51,090 --> 00:02:53,730 to download all that code and then go through it. 78 78 00:02:53,730 --> 00:02:55,560 As you're doing that, you'll find things 79 79 00:02:55,560 --> 00:02:57,660 that might have old or forgotten pages, 80 80 00:02:57,660 --> 00:02:59,940 things that have weak code, and things of that nature 81 81 00:02:59,940 --> 00:03:00,773 that you can collect 82 82 00:03:00,773 --> 00:03:02,520 as part of your reconnaissance efforts as well. 83 83 00:03:02,520 --> 00:03:04,380 Now, again, a quick exam tip. 84 84 00:03:04,380 --> 00:03:06,330 For the exam, you do not need to know 85 85 00:03:06,330 --> 00:03:08,700 how to do this zone transfer, 86 86 00:03:08,700 --> 00:03:11,730 but you need to know the concept of a zone transfer. 87 87 00:03:11,730 --> 00:03:13,980 And the idea is a zone transfer can be used 88 88 00:03:13,980 --> 00:03:16,980 to collect DNS information about your servers 89 89 00:03:16,980 --> 00:03:19,860 and give it to an attacker so they can plan further attacks. 90 90 00:03:19,860 --> 00:03:21,180 But you don't need to actually be able 91 91 00:03:21,180 --> 00:03:22,650 to perform the zone transfer 92 92 00:03:22,650 --> 00:03:24,420 and memorize the NS lookup commands 93 93 00:03:24,420 --> 00:03:26,220 or the dig commands to perform them.