1 00:00:06,540 --> 00:00:07,373 - [Instructor] In this segment, 2 00:00:07,373 --> 00:00:09,780 we're gonna focus on passive reconnaissance. 3 00:00:09,780 --> 00:00:12,930 Now, passive reconnaissance, also known as passive recon, 4 00:00:12,930 --> 00:00:16,410 is information gathering using publicly available resources 5 00:00:16,410 --> 00:00:19,560 while the target has no knowledge of the activity. 6 00:00:19,560 --> 00:00:22,350 Now the passive recon tool we're going to explore 7 00:00:22,350 --> 00:00:24,630 is Netcraft Site Report. 8 00:00:24,630 --> 00:00:29,490 The URL is sitereport.netcraft.com. 9 00:00:29,490 --> 00:00:31,230 Now, using this free service, 10 00:00:31,230 --> 00:00:33,960 our objective is to find out more information 11 00:00:33,960 --> 00:00:37,320 about a website and the backend technologies, 12 00:00:37,320 --> 00:00:39,810 again, without the website owner knowing 13 00:00:39,810 --> 00:00:41,010 that we're doing this. 14 00:00:41,010 --> 00:00:43,833 So let's take a look at cnn.com. 15 00:00:44,910 --> 00:00:48,000 So I'm just putting in the URL and clicking Look up, 16 00:00:48,000 --> 00:00:51,990 and it's gonna come back with a site report for cnn.com. 17 00:00:51,990 --> 00:00:55,380 It tells me that site was first seen in October, 1995. 18 00:00:55,380 --> 00:00:57,090 Primary language is English. 19 00:00:57,090 --> 00:00:58,320 I can learn about the network, 20 00:00:58,320 --> 00:01:02,490 including the IP version 4 and the IP version 6 address, 21 00:01:02,490 --> 00:01:06,120 as well as the Nameserver, the Domain registrar, 22 00:01:06,120 --> 00:01:08,010 and the DNS admin. 23 00:01:08,010 --> 00:01:10,290 I scroll down, I'll see IP delegation 24 00:01:10,290 --> 00:01:14,793 for IP address 4 and 6, IP geolocation. 25 00:01:16,110 --> 00:01:17,700 And then I get to the Hosting History 26 00:01:17,700 --> 00:01:19,560 and I get to the Netblock owner. 27 00:01:19,560 --> 00:01:23,820 I get the IP address, the operating system, the web server 28 00:01:23,820 --> 00:01:25,860 and the date that it was last seen. 29 00:01:25,860 --> 00:01:28,650 If I continue to scroll, I'm going to get other information 30 00:01:28,650 --> 00:01:32,010 about the server and client-side technologies. 31 00:01:32,010 --> 00:01:34,743 So I'm just gonna scroll down here a little bit. 32 00:01:38,970 --> 00:01:42,577 Well, you know, maybe if I am an adversary, I'm thinking, 33 00:01:42,577 --> 00:01:46,350 "You know, cnn.com might be really well-protected, 34 00:01:46,350 --> 00:01:50,760 but I wonder if they have any other websites or webpages 35 00:01:50,760 --> 00:01:54,210 that are connected that aren't as well protected, 36 00:01:54,210 --> 00:01:55,860 that I can use to pivot." 37 00:01:55,860 --> 00:01:59,190 So I'm gonna click right here on Domain cnn.com 38 00:01:59,190 --> 00:02:03,360 and it's going to bring me a list of associated websites 39 00:02:03,360 --> 00:02:07,140 that match the wildcard of cnn.com. 40 00:02:07,140 --> 00:02:08,640 And as I scroll through this, 41 00:02:08,640 --> 00:02:10,950 I get to see the different First seen dates, 42 00:02:10,950 --> 00:02:14,250 the Netblock who owns it, so it was fastly@cnn.com. 43 00:02:14,250 --> 00:02:17,940 But, you know, healthguides.cnn.com is hosted at Amazon 44 00:02:17,940 --> 00:02:21,720 and markets.money.cnn.com at Markit On Demand 45 00:02:21,720 --> 00:02:25,500 and e-newsletters.cnn.com is at e-Dialog. 46 00:02:25,500 --> 00:02:27,990 I can also see the variety of operating systems, 47 00:02:27,990 --> 00:02:32,583 whether it's Linux or BIG-IP or Citrix NetScaler. 48 00:02:33,600 --> 00:02:35,310 I'm just gonna scroll to the next page 49 00:02:35,310 --> 00:02:37,160 'cause there's another page of these. 50 00:02:40,140 --> 00:02:41,760 Continue to look at the dates 51 00:02:41,760 --> 00:02:44,040 and the netblock and the operating system. 52 00:02:44,040 --> 00:02:46,770 Again, if I'm the adversary, maybe there are things I know 53 00:02:46,770 --> 00:02:49,890 about a particular operating system 54 00:02:49,890 --> 00:02:52,950 or I know about a particular vendor, a vulnerability, 55 00:02:52,950 --> 00:02:54,480 or some inside information 56 00:02:54,480 --> 00:02:56,913 that may make that a more attractive target. 57 00:02:58,500 --> 00:03:00,210 And I get down to the end and look at, you know, 58 00:03:00,210 --> 00:03:02,580 there's a couple of sites from July of 2010, 59 00:03:02,580 --> 00:03:04,170 that's quite a while ago. 60 00:03:04,170 --> 00:03:07,380 Maybe they're not paying a lot of attention to it anymore. 61 00:03:07,380 --> 00:03:09,210 I can see it's hosted by Automatic 62 00:03:09,210 --> 00:03:11,670 and Linux is the operating system. 63 00:03:11,670 --> 00:03:13,383 So let's pull up a site report. 64 00:03:14,910 --> 00:03:18,330 Again, first seen in July, 2010. 65 00:03:18,330 --> 00:03:20,790 Same thing here, IP version 4 address, 66 00:03:20,790 --> 00:03:22,890 I don't see a version 6 address. 67 00:03:22,890 --> 00:03:26,913 Nameserver, Domain registration, DNS admin, delegation. 68 00:03:27,990 --> 00:03:30,000 I see that it's Automatic that's hosting it. 69 00:03:30,000 --> 00:03:32,760 I can see the IP address, Linux operating system 70 00:03:32,760 --> 00:03:35,100 and an Nginx web server. 71 00:03:35,100 --> 00:03:37,230 But the last time it was looked at, 72 00:03:37,230 --> 00:03:40,500 oh, I looked at it today, it was in 2020, 73 00:03:40,500 --> 00:03:42,933 but before that it was in 2016. 74 00:03:43,830 --> 00:03:45,510 Again, scroll down, I'll get more information 75 00:03:45,510 --> 00:03:46,830 about Web Trackers, 76 00:03:46,830 --> 00:03:51,150 Client-Side and Server-Side technologies. 77 00:03:51,150 --> 00:03:53,227 So I may decide, if I'm the adversary that, 78 00:03:53,227 --> 00:03:55,050 "You know, I'm gonna kind of try to play 79 00:03:55,050 --> 00:03:56,910 with this system first 80 00:03:56,910 --> 00:04:00,150 and pivot to any one of the other systems." 81 00:04:00,150 --> 00:04:03,480 So I'm gonna come back here, couple of screens, 82 00:04:03,480 --> 00:04:07,233 and get back to CNN to the home screen, here we go. 83 00:04:08,640 --> 00:04:10,200 You know, I think it's really important 84 00:04:10,200 --> 00:04:13,290 that an organization is aware of what information about them 85 00:04:13,290 --> 00:04:15,240 is publicly available. 86 00:04:15,240 --> 00:04:18,270 So I would urge you to take advantage of OSINT, 87 00:04:18,270 --> 00:04:19,860 that's open-source intelligence, 88 00:04:19,860 --> 00:04:23,610 and services such as Netcraft Site Report 89 00:04:23,610 --> 00:04:27,690 to look at your assets through the eyes of an attacker. 90 00:04:27,690 --> 00:04:29,943 And that, my friend, is a closer look.