Passive Research Section 2 11/29/2018

Outline Objective Tools used for Passive Research Example results 11/29/2018

Uses of Passive Research Gather information for social engineering Quietly probe network in a difficult to detect manner Identify what resources are most valuable/interesting 11/29/2018

Objective Obtain information from the public domain that could potentially be used to bypass security controls Determine all entities associated with the target Identify networks, domains, staff and configuration, if possible 11/29/2018

What are we looking for Personal information about users/staff Organisational structure Details to map/identify network devices System configuration 11/29/2018

Tools used for Passive Research All resources can be checked without sending ‘suspicious’ packets to the target. Whois DNS interrogation Target’s homepage, news sites, linking sites Newsgroup postings Public Internet databases 11/29/2018

Whois Section 2.1 11/29/2018

Whois The following useful information can be obtained from a whois query: Organisational branches and subdivisions Domain names Network address ranges IT staff names, phone numbers Email address format Registrant: HSBC Holdings plc (HSBC5-DOM) 10 Lower Thames Street London, London EC3R 6AE UK Domain Name: HSBC.COM Administrative Contact, Technical Contact: Internet Systems (IS3036-ORG) dns.hsbc@HSBC.COM HSBC Bank PLC Griffin House, 41 Silver Street Head Sheffield, - S1 3GG UNITED KINGDOM +44 (0)114 282 7427 Fax- +44 (0)114 282 7345 11/29/2018

Useful information found For one bank, found a network connected to the Internet which they didn’t know existed. Identified administrator names which were then used for web searches. 11/29/2018

Tools used for whois Command line whois clients available for many Unix/Linux packages Web based http://www.whois.org http://www.demon.net/external/ http://www.samspade.org/ http://www.nettitude.com/iptools.html GUI based for windows Samspade.org (free and very good) Geektools.com Solarwinds 11/29/2018

Unix Whois demo 11/29/2018

Lab Use whois from the Unix command line to investigate entries Time: 10 minutes 11/29/2018

Example of a windows based whois tool 11/29/2018

Passive research - Ripe $ whois -h whois.nic.uk. "loud-fat-bloke.co.uk" 11/29/2018

Passive research - Ripe My network range 11/29/2018

Whois web interfaces http://www.samspade.org http://www.geektools.com/cgi-bin/proxy.cgi http://www.internic.net/alpha.html http://www.allwhois.com http://www.demon.net/external List of whois servers: http://www.geektools.com/dist/whoislist.gz 11/29/2018

Passive research - Ripe Me & my address!!!!! 11/29/2018

Passive research - Netcraft 11/29/2018

Passive research – DNS/Geektools 11/29/2018

Lab Use web based whois to search for information about a particular domain. Time: 15 minutes 11/29/2018

Domain Name System Section 4.2 11/29/2018

DNS interrogation Tools: Dig, Nslookup First choice: Zone transfer MX records Reverse lookups 11/29/2018

Useful information found Identified over 200 hosts through a single zone transfer of internal and external servers and gateways. Identified the IP addresses of firewalls that otherwise couldn’t be seen. 11/29/2018

‘dig’ 11/29/2018

DNS 11/29/2018

Lab Use web based DNS tools to investigate a company’s DNS entries Time: 10 minutes 11/29/2018

Using the target homepage Section 2.3 11/29/2018

Target’s homepage Determine if site is hosted at ISP or at target Quantify number of sites which may be attacked Determine if there is any non-public information buried in HTML comment tags. Review pages to identify server type Other items of interest: Location Merger or acquisition news Phone numbers Contact names and e-mail addresses Links to other organisations 11/29/2018

Tools to speed up a web page review Copy the site locally using an automated tool Search using Nimrod or ‘grep’ for keywords Example tool on Unix wget (http://www.gnu.org/software/wget/wget.html) Nimrod www.loud-fat-bloke.co.uk/tools.html Example tool on Windows Babelweb (http://www.hsc.fr/ressources/outils/babelweb) 11/29/2018

Useful information found Administrator contact details File configuration details Comments from programmers concerning configuration 11/29/2018

Lab Examine several companies’ web sites to see if they contain any useful information. Time: 15 minutes 11/29/2018

Newsgroups and the web Section 2.4 11/29/2018

Newsgroup posting and web search Objective To obtain newsgroup postings about an organisations employees and resources Example of a web based tool http://groups.google.com 11/29/2018

Useful information found Client chairman is a ‘male escort for hire’ Detailed firewall configuration Threats against companies by hacktivists Identified information about system administrators and operating system variants 11/29/2018

Lab Use http://groups.google.com to search for useful information about the contacts of a particular company Time: 30 minutes 11/29/2018

Lab Use Internet search engines to identify useful information about an organisation. Time: 15 minutes 11/29/2018