1
00:00:03,770 --> 00:00:08,570
Okay, the line has trickled to a slow speed, so we're going to get started.

2
00:00:09,250 --> 00:00:11,750
One quick announcement to remind you all of.

3
00:00:12,050 --> 00:00:14,470
Photographs of the speakers are with their permissions.

4
00:00:14,570 --> 00:00:17,550
Photographs of the audience, not allowed.

5
00:00:17,550 --> 00:00:20,350
If we find you doing it, you will be removed.

6
00:00:20,770 --> 00:00:24,010
And with that, SensPost and Rulof.

7
00:00:35,280 --> 00:00:37,020
Hello, hello.

8
00:00:37,740 --> 00:00:39,200
Okay, let's see.

9
00:00:39,200 --> 00:00:43,540
Just a couple of things before we start.

10
00:00:43,980 --> 00:00:46,460
I'm going to try speaking to the mic the whole time.

11
00:00:46,640 --> 00:00:50,860
Kind of, you know, maybe do it like this.

12
00:00:52,320 --> 00:00:53,200
Like that.

13
00:00:53,200 --> 00:00:53,880
Okay.

14
00:00:53,900 --> 00:00:54,820
Let's see.

15
00:00:56,040 --> 00:01:01,420
Okay, before we begin, most of The stuff you can find at that url over there.

16
00:01:01,800 --> 00:01:15,640
That's just for, you know, if we don't get through all of this, i Think we would, because we've got a double session, so there Shouldn't be a problem, but if you want to write that down, That's where you can find the tool that we'll be showing Today.

17
00:01:16,200 --> 00:01:29,400
Then also at amsterdam, we Actually made a promise that we would release a web application Scanner that is also available for download at the url on the Screen.

18
00:01:30,180 --> 00:01:36,000
In terms of time considerations, There's a lot that we must cover.

19
00:01:37,020 --> 00:01:44,000
We're basically going to go Through the presentation, and then afterwards, we're going to Do a bit of a live demo.

20
00:01:44,540 --> 00:01:53,020
We're having issues with the Wireless at the moment, but hopefully by that time, it Should be sorted out, so then we can go through a bit of live Demo on this thing.

21
00:01:54,600 --> 00:02:01,380
Just something to start off With, you know, there's a lot of shows that you can go see here In vegas.

22
00:02:01,380 --> 00:02:12,320
I've heard that, you know, Humanity is quite good, and elton john, and dan Kaminsky.

23
00:02:12,600 --> 00:02:17,020
So this is a presentation.

24
00:02:17,020 --> 00:02:19,000
There won't be any drinking on the stage.

25
00:02:19,980 --> 00:02:22,080
And it's not a show.

26
00:02:23,520 --> 00:02:26,320
So basically, let me give you Introduction.

27
00:02:26,700 --> 00:02:30,520
Let me just quickly, like, Briefly tell you about sense post.

28
00:02:30,520 --> 00:02:33,680
We're a company of about 15 people in South africa.

29
00:02:33,880 --> 00:02:39,140
We do external, internal Assessments, color penetration testing.

30
00:02:39,460 --> 00:02:41,940
We've done it for the last five Years.

31
00:02:42,200 --> 00:02:47,660
We've been talking at black hat For the last four years in defcon.

32
00:02:49,040 --> 00:02:54,660
And in our work, what we basically do, amongst other Things, is we break into networks.

33
00:02:55,380 --> 00:02:57,080
We train as well.

34
00:02:57,080 --> 00:02:59,200
We do training at black hat.

35
00:02:59,780 --> 00:03:02,400
We've trained a record amount of People this year at black hat.

36
00:03:02,520 --> 00:03:12,460
And we train them using, basically Tell them about a methodology that we use to break into Networks from the internet.

37
00:03:12,460 --> 00:03:13,700
This is not for internal.

38
00:03:13,700 --> 00:03:15,120
It's from over the internet.

39
00:03:15,860 --> 00:03:21,160
And so we're pretty sure that our Methodology kind of works.

40
00:03:21,220 --> 00:03:22,480
It seems to be working.

41
00:03:22,480 --> 00:03:27,960
We've seen the insides of more internal networks than we kind of Care to see.

42
00:03:28,920 --> 00:03:37,140
So what we've done is we've Basically said this methodology that we have, let's see how much Of this can be automated.

43
00:03:37,800 --> 00:03:55,840
So the idea was to basically Take every step of the way and check if that step can be Automated and to what kind of level of accuracy it can be Automated so that by the end of the day, hopefully most of the Stuff that we have to do manually, we can now do Automatically.

44
00:03:56,740 --> 00:04:09,640
So the talk is really about the Methodology itself, which parts of the methodology can be Automated, where it really works well and where it really breaks Down badly.

45
00:04:10,780 --> 00:04:15,800
And when it breaks down badly, Why it actually breaks down badly.

46
00:04:16,400 --> 00:04:25,860
And at the end, we're going to quickly talk about some Implications that this tool will have for, you know, the more Mediocre pen testers out there.

47
00:04:26,500 --> 00:04:28,860
Because i guess there's a couple Of those.

48
00:04:31,100 --> 00:04:31,660
Okay.

49
00:04:31,660 --> 00:04:38,380
So in order to automate Something, if you want to automate something, you need to Code it, right?

50
00:04:38,380 --> 00:04:41,100
you need to be able to write it Down and code it.

51
00:04:41,180 --> 00:04:45,660
And to code it, you need to Have some kind of algorithm.

52
00:04:47,300 --> 00:04:53,340
And in order to have an Algorithm, you need to really, really understand what it is That you're trying to do.

53
00:04:53,340 --> 00:04:58,540
I find a lot of people that Starting to write code for something that they don't Understand yet.

54
00:04:58,540 --> 00:05:04,800
So the idea is never really that The coding should take a lot of the time.

55
00:05:04,800 --> 00:05:11,700
The idea would be that understanding the process that You're trying to do would be taking the time.

56
00:05:12,380 --> 00:05:20,220
And having done hundreds and hundreds of assessments, we kind Of know what it is that we want to do.

57
00:05:20,220 --> 00:05:22,280
It's not just a question of coding it.

58
00:05:24,440 --> 00:05:37,380
With anything that you automate, if you can write it Down on a piece of paper in a kind of a flow chart, and you Know exactly what it is that you're writing down, and the Flow chart works, then you can code it, right?

59
00:05:37,380 --> 00:05:42,580
Then it's just a question of saying we have to take this Stuff and then write it in code.

60
00:05:43,360 --> 00:05:46,880
The problem comes in with Automation is when there's exceptions.

61
00:05:46,880 --> 00:05:51,380
So the situation might be we can do this in this case.

62
00:05:51,620 --> 00:05:56,560
But, you know, one out of a thousand times, the result is Going to look a little bit different.

63
00:05:57,240 --> 00:06:02,360
And if you still want to automate it, you need to make Sure that you're catching that exception.

64
00:06:02,500 --> 00:06:22,140
So as soon as, and you will see this during the talk, as soon As there's exceptions and as soon as there's something that We don't really understand how it's working, or we have to Make, we have to see how many different exceptions there are And have to write a piece of code or a code path for all of Those different exceptions,

65
00:06:22,140 --> 00:06:25,080
it becomes very, very difficult to do.

66
00:06:25,220 --> 00:06:25,360
Okay?

67
00:06:25,360 --> 00:06:44,220
now, the trade-off there is that If you have something that works 99.9 of the time and it's Going to take you a year to code the code path for the Exception, then you kind of live with it and you say it's Okay, we can live with this exception, we know that it Occurs,

68
00:06:44,220 --> 00:06:48,900
and it's not necessarily a bad thing, we can Maybe fix it manually afterwards.

69
00:06:52,700 --> 00:07:04,640
So there's a couple of weird perceptions in the industry Today, and you will find it at this conference, it would be The best place to find that kind of weird perception.

70
00:07:05,400 --> 00:07:13,160
And if you talk to anyone, just about anyone in this Conference, they would tell you that unix is good and windows Is bad, right?

71
00:07:13,300 --> 00:07:23,420
and then afterwards, you should Make a kind of sheep noise, because, you know, if Everybody says windows is good, unix is good and windows is Bad, then it must be, right?

72
00:07:24,740 --> 00:07:43,760
you will also see that a lot of People say that the problem with windows is that we have this Gooey apps that are running on windows, and with gooey apps, You can't really do a thing, because, you know, it's kind of A black box, and you don't have the flexibility that you have With unix tools.

73
00:07:44,980 --> 00:07:57,800
What i'm saying is, it really Depends on who's writing that gooey application, because you Can still have a gooey application and still have Flexibility, the same kind of flexibility that you would have On a unix.

74
00:07:57,800 --> 00:08:03,100
I don't want to go into this Too much, because i'm thinking people are going to assault me After this.

75
00:08:03,920 --> 00:08:06,680
I can see angry faces in the Crowd.

76
00:08:07,220 --> 00:08:07,740
Okay?

77
00:08:07,840 --> 00:08:26,800
but there's really a Perception out there that says, if something has a gooey Application, and i guess that's the fault that a lot of people That write applications is doing, is saying, as soon as we Stick a gooey on top of this thing, we need to dumb the Application down,

78
00:08:26,800 --> 00:08:30,660
because we think that people that are using Gooey tools are stupid.

79
00:08:31,060 --> 00:08:38,780
And so because we're now Catering for a crowd of people that's stupid, we need to have Our gooey really point and click and go.

80
00:08:39,100 --> 00:08:40,620
And it's really not the case.

81
00:08:40,620 --> 00:08:51,000
You can still build a gooey that Is very flexible and that has lots of potential to play with, If you assume that your users are not stupid.

82
00:08:51,360 --> 00:08:55,780
And it's something that we've done in the tool that i'm going To show you.

83
00:08:56,700 --> 00:09:03,440
We've basically written the Tool in such a way that everything that's input and Output goes into a text box.

84
00:09:03,880 --> 00:09:15,640
So at any time, what you can do Is you can select the whole text box and copy it into your Unix system and do your whole grip and set and all the nice Things that we like about unix.

85
00:09:16,020 --> 00:09:24,260
You don't have to export it in Some kind of a weird format and try to convert it into text and Then you can work with it.

86
00:09:25,060 --> 00:09:33,840
The other thing is that the text Boxes are hot, which means if you make a change in that text Box, that's a change that you've made to your data set.

87
00:09:33,840 --> 00:09:42,020
You don't have to write some kind of a sql statement in order To update this stuff somewhere within a database.

88
00:09:42,120 --> 00:09:44,820
That's totally database-less.

89
00:09:45,560 --> 00:09:46,220
Right.

90
00:09:46,220 --> 00:09:52,080
Now, the tool's name is called bdblah, right?

91
00:09:52,640 --> 00:09:56,300
Yeah, bdblah, as in blah, blah, blah, bdblah.

92
00:09:57,020 --> 00:10:04,220
And the tool that we written is really used for doing large-scale Assessments.

93
00:10:04,220 --> 00:10:07,560
Now, just a quick note on Assessment.

94
00:10:07,640 --> 00:10:14,600
If you're putting your domain In this tool, then this tool is doing an assessment.

95
00:10:14,600 --> 00:10:20,000
If you're putting someone else's domain in this tool, then You're doing an attack.

96
00:10:20,560 --> 00:10:29,380
So an attack and assessment is Kind of, you know, it really, when i'm doing this at black Hat, i'm saying this is an assessment tool.

97
00:10:29,880 --> 00:10:34,840
And when i'm doing it at defcon, i can tell you that you can Also use it as an attack tool.

98
00:10:34,840 --> 00:10:35,320
Right.

99
00:10:36,360 --> 00:10:45,720
Now, it's built to actually look to do assessments, okay, on Very large networks.

100
00:10:47,220 --> 00:10:55,160
The problem for demoing this Thing at a conference like this is that sense post does not have A very large network.

101
00:10:56,200 --> 00:11:00,080
Our clients, they have large Networks.

102
00:11:00,520 --> 00:11:06,380
But they won't appreciate it if We start showing the data on the screen at defcon, right?

103
00:11:08,120 --> 00:11:14,820
So what we're doing here is we're going to do some passive Work, which is totally passive.

104
00:11:14,820 --> 00:11:16,940
We're not sending any packets to The network.

105
00:11:16,940 --> 00:11:18,240
Well, not a lot.

106
00:11:18,640 --> 00:11:21,020
It's not an attack at all.

107
00:11:21,220 --> 00:11:25,460
No, generally, it's not a, you Will see, it's not like we're attacking anything.

108
00:11:25,780 --> 00:11:40,660
But we're going to do some passive work against just the IBM dns space, and we're going to do some passive work against Playboy, just because i thought, you know, if we get any results, It might be interesting to verify it.

109
00:11:44,580 --> 00:11:53,760
And then when we go active, we're going to look at the Sense post network, even if it's small.

110
00:11:53,760 --> 00:11:56,320
Keep in mind that, you know, it's a small network.

111
00:11:56,320 --> 00:11:58,460
You can do the same thing on a large network.

112
00:11:58,460 --> 00:12:08,160
And when we really go into attacking boxes and owning them, We'll be having a vmware server that we look at.

113
00:12:09,220 --> 00:12:15,380
Now, the problem with this stuff is there's a lot of risk in Doing this live.

114
00:12:16,420 --> 00:12:16,920
Okay?

115
00:12:16,920 --> 00:12:27,980
Because networks change all the time, and there might just be a Situation that when we did the scan yesterday, everything was Cool , but today there's a vulnerability on the machine.

116
00:12:27,980 --> 00:12:29,380
So we're not going to do it.

117
00:12:29,380 --> 00:12:33,360
Well, we might afterwards do Some stuff live.

118
00:12:34,140 --> 00:12:37,420
We'll see how it goes in terms Of time as well.

119
00:12:38,540 --> 00:12:47,200
But when we do stuff live, you Will know that we either have permission of the owners of that Network, or it's on our own network, right?

120
00:12:47,300 --> 00:13:01,100
So if there's any press in this room, i don't know if there's Any press, please, after this talk, please don't write an Article that says on stage, sense post attacked ibm and own The network, because that is not the case.

121
00:13:01,540 --> 00:13:03,760
We're not going to even try to do that.

122
00:13:03,760 --> 00:13:04,820
Okay.

123
00:13:04,820 --> 00:13:17,740
So what we've done is in the Things that in the pieces of demo that we have here, we've Basically taken some video clips of that screen captures and put It into a video.

124
00:13:18,720 --> 00:13:23,500
All of it is exactly the way That it works, and there's no trickery involved.

125
00:13:23,500 --> 00:13:38,820
However, sometimes we've paused the actual screen capture, Because, you know, when you're doing a reverse scan on a class B, that's going to take a while, and i don't want you to Sit here and look at the screen for half an hour seeing how we're Doing a reverse scan on a class b.

126
00:13:39,400 --> 00:13:43,260
So for that stuff, we've paused it, and it's kind of time Lapsed.

127
00:13:43,260 --> 00:13:45,280
But the rest of the stuff is Absolutely real.

128
00:13:45,280 --> 00:13:48,180
There's no image manipulation Done anyway.

129
00:13:48,520 --> 00:13:49,100
Right.

130
00:13:49,100 --> 00:13:55,280
So with that out of the way, let's have a look and see what Our external methodology looks like.

131
00:13:55,280 --> 00:14:02,300
Now, the people, can i just see in the class here, who's been On any of our boot camp classes at black cat?

132
00:14:03,040 --> 00:14:03,960
Some hands.

133
00:14:04,080 --> 00:14:04,760
Okay.

134
00:14:05,020 --> 00:14:05,760
Okay.

135
00:14:05,760 --> 00:14:06,540
Great stuff.

136
00:14:06,540 --> 00:14:13,520
Now, if you're on the boot camp class at black cat, you will Know this methodology quite well.

137
00:14:13,520 --> 00:14:19,400
I'm not going to go into it too much, because, you know, that's What the classes are there for.

138
00:14:19,400 --> 00:14:20,900
But basically it boils down to This.

139
00:14:20,900 --> 00:14:23,060
We start doing a footprint.

140
00:14:23,960 --> 00:14:27,940
From the footprint, we go on to a fingerprint.

141
00:14:27,940 --> 00:14:31,800
From there, we do targeting of systems that we would like to Attack.

142
00:14:32,120 --> 00:14:34,180
We then do vulnerability Discovery.

143
00:14:34,940 --> 00:14:44,540
And the last step is we actually Exploit those vulnerabilities to do penetration testing on the Host, on the network itself.

144
00:14:44,940 --> 00:14:50,640
Now, these, all of these little Blocks now break down into a whole lot of other sets of Blocks.

145
00:14:50,640 --> 00:14:52,700
So we're going to start with The footprinting.

146
00:14:54,280 --> 00:14:58,880
The footprinting can be Broken down into six blocks.

147
00:14:59,040 --> 00:14:59,500
Okay.

148
00:14:59,500 --> 00:15:02,020
The first block is we find the domains.

149
00:15:02,020 --> 00:15:17,340
Now, it seems very silly, because you might think that if You, let's say, attack, let's say you attack ibm, okay, then The place to start is ibm.Com.

150
00:15:17,340 --> 00:15:17,740
Right.

151
00:15:17,740 --> 00:15:19,220
And it's as easy as that.

152
00:15:19,220 --> 00:15:26,180
What you might not know is that Large organizations can have up to 2,000, 3,000 different Domains.

153
00:15:26,180 --> 00:15:30,540
And those domains all carry Dns information that's pointing to ip addresses.

154
00:15:30,540 --> 00:15:33,880
And those ip addresses sit within net blocks.

155
00:15:33,980 --> 00:15:44,280
And those net blocks might contain machines that are Vulnerable and that has access to the internal network or, you Know, connected via vpn into the internal network.

156
00:15:44,320 --> 00:15:47,200
So the idea is that we find as many domains as we can.

157
00:15:47,200 --> 00:15:52,080
And then go to the next step, which is to find subdomains Within those domains.

158
00:15:52,340 --> 00:15:58,280
And, again, finding subdomains In a domain might seem at this stage very kind of silly.

159
00:15:58,280 --> 00:16:00,700
But you'll see that it's actually quite interesting.

160
00:16:01,240 --> 00:16:03,760
We then do forward dns entries.

161
00:16:03,760 --> 00:16:08,560
So we basically look for Anything we can find within the forward zone.

162
00:16:08,860 --> 00:16:09,800
We get net blocks.

163
00:16:09,800 --> 00:16:12,580
We start trimming those net Blocks down to size.

164
00:16:12,840 --> 00:16:16,440
We might add other net blocks Into those net blocks.

165
00:16:16,620 --> 00:16:25,660
Once we're done with our net Blocks, the first round of definition of our net blocks, We do a dns reverse scan of that particular block.

166
00:16:25,960 --> 00:16:27,860
And that might lead to two things.

167
00:16:27,860 --> 00:16:31,960
The first is we might find new domains coming out that we Didn't know about.

168
00:16:31,960 --> 00:16:33,680
It almost always happens.

169
00:16:34,800 --> 00:16:40,340
And we find that maybe our net blocks weren't defined so Nicely.

170
00:16:40,340 --> 00:16:44,940
So we can redefine our net Blocks at that stage if it needs to be redefined.

171
00:16:45,380 --> 00:16:52,260
Once we have our net blocks nicely tied down, we can go to The next step, which is vitality testing.

172
00:16:52,320 --> 00:16:54,640
Vitality testing or vitality scanning.

173
00:16:54,780 --> 00:16:56,920
The idea is you sit with a class b.

174
00:16:56,920 --> 00:16:59,460
You're going to run an s scan against a class b?

175
00:16:59,460 --> 00:17:01,000
I don't think so, right?

176
00:17:01,140 --> 00:17:15,220
The idea there is to find Machines that are alive within a big network space so that we Can do targeting on it in the next step and decide which of Those machines within that big piece of space is interesting To attack.

177
00:17:16,160 --> 00:17:25,760
Now, this footprinting Methodology, these six blocks that are here can now be broken Down into more blocks.

178
00:17:26,020 --> 00:17:26,420
Okay?

179
00:17:26,420 --> 00:17:29,380
It's like, you know, what is it, russian dolls?

180
00:17:29,840 --> 00:17:32,680
You keep taking out the dolls, it's the same thing over here.

181
00:17:35,760 --> 00:17:36,500
Okay.

182
00:17:36,500 --> 00:17:41,600
So just to give you an overview Of how this whole thing sits together, i've made this movie.

183
00:17:41,740 --> 00:17:45,160
I've made this movie using visual and word.

184
00:17:45,160 --> 00:17:49,480
So it's a little bit sucky, i know, but, you know.

185
00:17:51,280 --> 00:17:53,620
So we start with the main domain.

186
00:17:53,680 --> 00:17:56,280
From that domain we get subdomains.

187
00:17:56,940 --> 00:17:59,860
From the subdomains we start doing forward lookups.

188
00:17:59,860 --> 00:18:02,260
That's pointing to ip addresses, right?

189
00:18:02,260 --> 00:18:04,380
Those are the little arrows at the end.

190
00:18:04,900 --> 00:18:09,260
From that we start our first round of net block definitions.

191
00:18:09,260 --> 00:18:10,880
It might be one ip big.

192
00:18:11,140 --> 00:18:14,140
It might be, you know, class c.

193
00:18:14,140 --> 00:18:16,720
At this stage we actually don't know.

194
00:18:16,880 --> 00:18:18,760
We do reverse entries.

195
00:18:18,960 --> 00:18:20,180
Reverse dns entries.

196
00:18:20,180 --> 00:18:21,240
I'm just going to pause it over here.

197
00:18:21,240 --> 00:18:22,620
That's the red lines.

198
00:18:22,820 --> 00:18:28,060
And from the reverse we can get New domains, right, which might be related.

199
00:18:28,060 --> 00:18:30,280
Or that could be totally unrelated.

200
00:18:32,660 --> 00:18:37,020
This will help us to define our net blocks even nicer.

201
00:18:37,360 --> 00:18:40,300
Make the net block definition even tighter.

202
00:18:40,300 --> 00:18:45,460
As you can see here, we've now broken those net blocks into Smaller blocks.

203
00:18:46,100 --> 00:18:49,900
Once we're done with that, we're Going to go on and do vitality scanning.

204
00:18:49,900 --> 00:18:54,860
Those are the little dots you see over there in the x's for Closed ports.

205
00:18:55,320 --> 00:19:05,060
Once we have those machines Within those networks defined, we can do a port scan on those Machines to find out exactly what ports are open on each of Those ip addresses.

206
00:19:05,760 --> 00:19:11,360
And once we have that, we can Basically start doing vulnerability finding.

207
00:19:11,360 --> 00:19:22,860
So there, for instance, we have the apache 132 chunk encoding Problem that sits on one port, on one ip, within one network That was given to us by one domain.

208
00:19:23,280 --> 00:19:26,220
In this case, we're using one domain.

209
00:19:26,260 --> 00:19:28,100
You can use as many domains as you wish.

210
00:19:28,100 --> 00:19:32,960
Like i said, some of the big corporations have up to Thousands of domains.

211
00:19:33,600 --> 00:19:34,660
So this is the picture.

212
00:19:34,660 --> 00:19:36,400
This is the whole picture of the thing.

213
00:19:36,400 --> 00:19:38,200
Let's see how it actually works.

214
00:19:39,680 --> 00:19:44,560
So within the footprint, remember we went into this.

215
00:19:44,600 --> 00:19:47,080
This is now the first block finding the domains.

216
00:19:47,240 --> 00:19:48,760
I'm going to go into that.

217
00:19:49,640 --> 00:19:52,300
We haven't implemented this Within this tool.

218
00:19:53,240 --> 00:19:56,560
And i'll tell you later on why We haven't implemented this.

219
00:19:56,560 --> 00:20:01,420
It's one of those things where There's lots of exceptions and it's not that easy to implement.

220
00:20:01,420 --> 00:20:02,740
We started doing it.

221
00:20:03,240 --> 00:20:04,460
But it's not there yet.

222
00:20:04,460 --> 00:20:06,180
So you won't see it within this tool.

223
00:20:06,180 --> 00:20:14,660
For the subdomain mining, what we basically do is we start Off with a domain itself.

224
00:20:15,720 --> 00:20:17,340
Now, let me ask you this.

225
00:20:17,340 --> 00:20:21,780
If you google for ibm, let's take ibm as an example.

226
00:20:21,900 --> 00:20:24,320
And please, again, i've got nothing against them.

227
00:20:24,520 --> 00:20:28,800
If you google for ibm, yeah, i'm using an ibm notebook.

228
00:20:28,800 --> 00:20:29,800
Come on.

229
00:20:32,180 --> 00:20:44,020
If you google ibm, okay, you're Going to find a whole lot of hits, right, that points to Machines that's sitting on a domain ibm.Com.

230
00:20:44,080 --> 00:20:52,020
So, for instance, one of the links that you might get is Something coming off a site called tripwchess.Ibm.Com.

231
00:20:52,020 --> 00:20:53,440
Not chest, no.

232
00:20:53,440 --> 00:20:54,980
Chess, right?

233
00:20:55,000 --> 00:20:55,900
Okay.

234
00:20:56,380 --> 00:20:59,340
And what do we know from that?

235
00:20:59,640 --> 00:21:04,060
We know there's a subdomain called chess.Ibm.Com, right?

236
00:21:04,060 --> 00:21:18,060
And as we go along, we can google for different kind of Common words and look if it's related, if it is within the Ibm.Com domain, and using google, we can basically pull Out a whole list of subdomains.

237
00:21:18,160 --> 00:21:37,760
We can also pull out a whole Lot of domains itself, a whole lot of dns names itself, Because if something resides on tripwchess.Ibm.Com, then we Know that tripwchess.Ibm.Com exists, which gives us one Forward entry in our table of maybe lots of forward entries That we're going to pick up later.

238
00:21:37,800 --> 00:21:39,400
Everybody's cool with that, right?

239
00:21:39,480 --> 00:21:41,860
So let's see how it is actually done.

240
00:21:42,060 --> 00:21:46,200
Sorry, if you want to have More information about that, you should attend johnny long's Talk.

241
00:21:46,200 --> 00:21:48,840
He's doing a whole section on Subdomain mining.

242
00:21:49,520 --> 00:21:50,720
He's right there.

243
00:21:51,160 --> 00:21:51,800
Okay.

244
00:21:53,140 --> 00:21:55,260
So let's see how it works.

245
00:21:55,260 --> 00:22:07,260
Now, it normally takes about five minutes per domain to get Subdomains, and this is at the moment set to only look at the First three pages that google returns, right?

246
00:22:07,260 --> 00:22:17,700
So we can set it to return as many pages, but the kind of 80-20 Principles at work here, we find 80% of the hits within 20% of The time, okay?

247
00:22:17,700 --> 00:22:20,680
so doing three pages is just About okay.

248
00:22:20,920 --> 00:22:24,720
And we've got a couple of Keywords that we can combine the search with.

249
00:22:24,920 --> 00:22:26,940
So i don't know if you can see there at the back.

250
00:22:27,750 --> 00:22:31,120
What we're going to do is i'm going to start playing this Video.

251
00:22:31,980 --> 00:22:38,000
So we enter ibm.Com in there And we hit the start button.

252
00:22:38,860 --> 00:22:43,580
And now the tool is basically Through the google api querying google.

253
00:22:43,800 --> 00:22:45,700
We also get e-mail addresses.

254
00:22:45,840 --> 00:22:56,920
So, for instance, there you Have no one, no one at us.Ibm.Com, and from that, we Obviously know that there's a subdomain called usa.Ibm.Com.

255
00:22:58,300 --> 00:23:02,260
When this tool is done, this is obviously time lapsed.

256
00:23:02,280 --> 00:23:06,920
You'll see on the right-hand side, we have a whole list of Subdomains.

257
00:23:07,560 --> 00:23:09,700
Uk.Ibm.Com, us.

258
00:23:09,700 --> 00:23:13,420
Watson.Ibm.Chess and so forth and so on, okay?

259
00:23:14,180 --> 00:23:23,300
And while this might not look so interesting on ibm.Com, we Might afterwards show you an example that is more Interesting, okay?

260
00:23:23,520 --> 00:23:28,360
so basically what we have now Is we have the subdomains, right?

261
00:23:28,360 --> 00:23:30,560
We have the domains and we have the subdomains.

262
00:23:30,560 --> 00:23:35,880
And what we want to do is we want to find all the forward Entries that we can possibly find, right?

263
00:23:36,180 --> 00:23:37,600
So hang on a bit.

264
00:23:38,620 --> 00:23:45,520
What do you think would be The first step to check for when we're doing, when we're Finding forward dns entries?

265
00:23:45,520 --> 00:23:50,280
what would be the first thing That we would see if this is possible on the domain?

266
00:23:50,480 --> 00:23:51,220
Anyone?

267
00:23:51,640 --> 00:23:52,180
anyone?

268
00:23:52,180 --> 00:23:52,480
okay.

269
00:23:52,480 --> 00:23:53,380
Hang on a bit.

270
00:23:54,000 --> 00:23:55,240
Where's our t-shirts?

271
00:23:55,240 --> 00:23:57,100
Do we have t-shirts?

272
00:24:10,140 --> 00:24:11,440
let's see again.

273
00:24:13,540 --> 00:24:20,320
What would be the first thing that you do when you have a Domain and you want to find all the forward entries in the Domain ?

274
00:24:20,320 --> 00:24:20,920
yes, sir.

275
00:24:21,940 --> 00:24:22,540
Sorry?

276
00:24:24,080 --> 00:24:24,880
no.

277
00:24:25,760 --> 00:24:27,220
Who said zone transfer?

278
00:24:27,380 --> 00:24:28,160
there you go.

279
00:24:29,000 --> 00:24:29,560
Okay.

280
00:24:29,560 --> 00:24:34,320
So the first thing that we're Going to do is we're going to attempt to do a zone transfer, Right ?

281
00:24:34,500 --> 00:24:35,100
why?

282
00:24:35,100 --> 00:24:39,660
Because if we can transfer the zone, we get all the Information in the zone in one go.

283
00:24:39,980 --> 00:24:42,640
We don't have to mine for any dns data.

284
00:24:42,640 --> 00:24:44,640
We get the entire zone.

285
00:24:45,340 --> 00:24:54,640
So the first thing we're going To do is we're basically going to check for mx records and ns Records and then we're going to see if a zone transfer is Possible.

286
00:24:55,260 --> 00:24:58,500
Where's my handy laser pointer?

287
00:24:58,500 --> 00:25:04,560
If a zone transfer is possible, we immediately have all the Forwards within that list.

288
00:25:04,860 --> 00:25:12,900
The next thing we want to do if a Zone transfer is not possible, which is most likely the case, We're basically going to go through a hit list.

289
00:25:12,920 --> 00:25:14,940
I'll explain that just now.

290
00:25:14,980 --> 00:25:21,080
And from the hit list, we're Going to perform the forward and that's going to drop us into This container over there.

291
00:25:21,080 --> 00:25:23,560
Now, the hit list works like This, right?

292
00:25:23,560 --> 00:25:37,300
if you see that a machine Exists with the name of gandalf.Ibm.Com, what's the Chances that there will be a machine called frodo.Ibm.Com?

293
00:25:37,820 --> 00:25:39,560
Pretty good, right?

294
00:25:39,620 --> 00:25:56,060
so the idea what we're doing There is we're building a whole lot of lists, right, of things Like we have colors, we have animals, we have characters out Of lords of the rings, we have characters from hitchhiker's Guide to the galaxy, terry pratchett books,

295
00:25:56,060 --> 00:26:00,480
we have names Out of the bible and so forth and so on.

296
00:26:00,480 --> 00:26:07,620
And basically we test for four entries, it's configurable, but We test for four entries within that list.

297
00:26:07,620 --> 00:26:12,160
That list is sorted from the more popular names at the Beginning.

298
00:26:12,340 --> 00:26:18,460
And we basically check if one Of those names exists and if they do exist, we check the Whole list, okay?

299
00:26:18,980 --> 00:26:29,940
so it gives us a way of Finding out what kind of naming scheme these people are using, Using only four dns entries, dns queries, right?

300
00:26:30,840 --> 00:26:36,060
Because they're not going to have some kind of a weird name Out of lords of the rings and not have gandalf, right?

301
00:26:36,060 --> 00:26:38,060
They would have gandalf or frodo.

302
00:26:38,900 --> 00:26:40,340
So let's see how this works.

303
00:26:40,340 --> 00:26:44,760
Now, for this, we've done it on Playboy, okay?

304
00:26:44,820 --> 00:26:50,280
and we've now started with Doing the subdomains.

305
00:26:50,440 --> 00:26:57,740
In the case of playboy, we Only find two subdomains called casino.playboy.com and Playboynet.playboy.com.

306
00:26:58,900 --> 00:27:02,800
And what we're going to do is We're going to go on to the forwards, okay?

307
00:27:02,860 --> 00:27:08,740
When we click there, we can basically import the stuff from The previous section, okay?

308
00:27:08,740 --> 00:27:11,060
what you see there, sorry, i Missed this.

309
00:27:11,780 --> 00:27:13,400
Let's just pause it here.

310
00:27:14,040 --> 00:27:15,980
Can you see that at the back at all?

311
00:27:16,120 --> 00:27:17,480
probably not, right?

312
00:27:17,520 --> 00:27:21,140
Can you see at the back, people at the back, can you see the Actual lettering there?

313
00:27:22,060 --> 00:27:22,860
no?

314
00:27:23,280 --> 00:27:24,480
Dude, i'm sorry.

315
00:27:28,580 --> 00:27:31,360
No, i can't make it any larger.

316
00:27:32,200 --> 00:27:37,880
Okay, i can, but then, you know, that means rewriting the App for another font in that window there, okay?

317
00:27:37,880 --> 00:27:40,520
So basically what you see over there, just trust me on this, Okay?

318
00:27:40,520 --> 00:27:41,420
i'm not lying.

319
00:27:41,420 --> 00:27:43,080
And the people in front can verify.

320
00:27:43,260 --> 00:27:51,860
So what you're seeing there at that part of the screen over There is entries that we've already found with the google Search, right?

321
00:27:51,860 --> 00:27:56,100
those are already forward Entries that we found with the google search.

322
00:27:57,060 --> 00:27:58,140
So they exist.

323
00:27:58,760 --> 00:28:00,300
So now we're going to add to It.

324
00:28:00,380 --> 00:28:02,620
Let's just see if i can, okay?

325
00:28:02,720 --> 00:28:06,980
And i'm going to click on import, right?

326
00:28:07,380 --> 00:28:11,380
And we get our list over there of things that we have.

327
00:28:11,580 --> 00:28:15,720
Fruit, e-commerce, colors, names, music, all of that.

328
00:28:15,960 --> 00:28:19,520
And immediately when we do that, we start getting results.

329
00:28:19,520 --> 00:28:26,220
Now, those results there, i know you can't see it even if You're sitting in the front, those are the mx records and The ns records, okay?

330
00:28:26,220 --> 00:28:27,540
it's just in a different color.

331
00:28:27,980 --> 00:28:33,720
But we basically, here at the bottom, you'll see that we're Starting to check forward entries, right?

332
00:28:33,720 --> 00:28:39,780
And we already got ftp, we got content.playboy.com, which, You know, i don't know, it could be interesting.

333
00:28:42,360 --> 00:28:46,300
And at this stage, i've basically stopped it and let it Run through.

334
00:28:46,300 --> 00:28:47,560
The capture, i stopped the Capture.

335
00:28:47,560 --> 00:28:50,920
So you see there the end of The entire capture.

336
00:28:51,460 --> 00:29:00,020
You get machines like secure 2.Playboy.com, it's all kind of interesting.

337
00:29:00,120 --> 00:29:07,180
The other thing that we can do is we can add at the end of a Forward , we basically add some fuzzing strings, okay?

338
00:29:07,180 --> 00:29:16,840
So when we test, for instance, ftp, we also test for ftp1 and Ftp2 and ftp-1 and ftp-2.

339
00:29:17,320 --> 00:29:22,440
And you can have as many as you Want, right?

340
00:29:22,440 --> 00:29:26,780
at the moment we were just Testing dash 1, dash 2, 1 and 2, okay?

341
00:29:26,780 --> 00:29:29,800
But it's basically kind of fuzzing the dns out.

342
00:29:30,700 --> 00:29:43,360
So what we have after this is we can collect all of the dns Forward entries that we can possibly get from a domain, we Can collect them in that text field on the right-hand side.

343
00:29:43,360 --> 00:29:47,040
Ah, shit.

344
00:29:48,680 --> 00:29:49,460
Okay.

345
00:29:49,460 --> 00:29:56,800
So the next step that we want to do is we basically want to Look at net blocks, okay?

346
00:29:56,800 --> 00:30:02,100
now, the idea is the first thing We can do is we can take all of those ip addresses that we had, Right?

347
00:30:02,260 --> 00:30:10,680
and we can slice off the last Digit from them and assume they're all class c's and start Off with a class c definition, right?

348
00:30:10,680 --> 00:30:12,880
Okay, we're going to start doing that.

349
00:30:14,440 --> 00:30:15,240
Absolutely.

350
00:30:18,980 --> 00:30:20,260
You're absolutely correct.

351
00:30:20,760 --> 00:30:22,820
So we're going to start by that.

352
00:30:22,820 --> 00:30:24,060
We've got to start somewhere.

353
00:30:24,160 --> 00:30:25,380
You're absolutely correct.

354
00:30:25,380 --> 00:30:26,420
So you'll see.

355
00:30:26,880 --> 00:30:27,440
Okay.

356
00:30:27,700 --> 00:30:35,540
And what we're going to do is We're going to add into that, see what the who's definition is Of that block to see if we can get the net block out of there.

357
00:30:35,780 --> 00:30:43,220
We're going to look at additional blocks like from And all of those wonderful places.

358
00:30:44,140 --> 00:30:46,560
But you'll see how that is also difficult to do.

359
00:30:46,580 --> 00:30:53,920
We're going to look at reverse dns entries to find out if the Blocks are at the correct boundaries.

360
00:30:54,140 --> 00:31:08,120
And another technique that we were looking at is to basically Find the as number of the root connected to that particular ip Address, then put that as number back in and see what other Roots are within the same as.

361
00:31:08,640 --> 00:31:09,240
Okay?

362
00:31:10,140 --> 00:31:13,220
And we'll talk about what the challenges are in that.

363
00:31:13,680 --> 00:31:16,600
So let's just look what happened to playboy.

364
00:31:17,160 --> 00:31:19,980
I'm going to start playing this thing again.

365
00:31:20,580 --> 00:31:21,240
All right.

366
00:31:21,240 --> 00:31:23,260
So we go to the next step.

367
00:31:23,500 --> 00:31:26,600
We do import, right?

368
00:31:26,600 --> 00:31:38,040
and at this stage, the tool Will tell you this will import from the forwards and assume Class c blocks, it might be a dangerous assumption.

369
00:31:40,800 --> 00:31:41,900
All right.

370
00:31:42,760 --> 00:31:43,080
Okay.

371
00:31:43,080 --> 00:31:44,300
So that's a start.

372
00:31:44,680 --> 00:31:47,960
And we see all of those 216s in There.

373
00:31:48,340 --> 00:31:50,580
They kind of look as if they Belong together.

374
00:31:50,620 --> 00:31:55,060
When you click on it, you Basically get all the forwards that sit within that block.

375
00:31:56,400 --> 00:31:57,120
Okay.

376
00:31:57,120 --> 00:31:58,040
Let's see.

377
00:31:59,140 --> 00:31:59,500
Okay.

378
00:31:59,500 --> 00:32:02,600
So there's a lot of the playboy Stuff coming, ftp, help.

379
00:32:02,680 --> 00:32:07,540
And we can click on the who's Button and basically get the who's information for that Block.

380
00:32:07,640 --> 00:32:17,000
And we see that, okay, that is Actually not a class c, but it's a couple of them.

381
00:32:17,220 --> 00:32:20,200
I think it's about, what, 16 class c's.

382
00:32:20,540 --> 00:32:30,720
And then we can simply change our block definition over there And say, okay, it's not from 36, it's from 128 all the way up To 143.

383
00:32:31,120 --> 00:32:37,660
As soon as we do that, the Other blocks that was there got kind of sucked into that list Because they're, you know, inside of that network now.

384
00:32:38,880 --> 00:32:39,480
Okay.

385
00:32:39,480 --> 00:32:44,000
In this case, you will see this Machine is a name server, 244.

386
00:32:44,040 --> 00:32:47,280
And we can have our blocks even One ip big.

387
00:32:47,340 --> 00:32:50,820
You know, we can have one ip, We can have a class b, we can have a class a.

388
00:32:50,820 --> 00:32:51,800
It really doesn't matter.

389
00:32:51,880 --> 00:32:56,920
We just change it to say that That thing is now only one ip large.

390
00:33:01,800 --> 00:33:02,380
Right .

391
00:33:04,280 --> 00:33:05,440
Okay.

392
00:33:08,160 --> 00:33:19,260
What's interesting here is we did the forwards on, just want To check if it's the case, we did the forwards on IBM as well.

393
00:33:20,740 --> 00:33:24,840
So you can have a look and see what their net blocks look like.

394
00:33:24,840 --> 00:33:28,280
You know, they got some crazy class bs out there.

395
00:33:28,360 --> 00:33:29,920
Look at the size of that block.

396
00:33:29,920 --> 00:33:32,760
There's a couple of class bs in There.

397
00:33:33,460 --> 00:33:34,280
Okay.

398
00:33:34,280 --> 00:33:37,820
So the next thing we're going to do is we're going to do Reverse dns scans.

399
00:33:37,820 --> 00:33:41,640
And the reverse dns scan looks Kind of intimidating.

400
00:33:41,820 --> 00:33:43,560
It's actually quite easy.

401
00:33:44,020 --> 00:33:46,900
We're going to start with the net blocks that we have at this Stage.

402
00:33:46,900 --> 00:33:51,880
We're going to do a reverse Dns entry on each of them.

403
00:33:52,160 --> 00:34:00,840
And then we're going to apply Some filters and say if this thing is contained within that Filter, okay, we say it's the match entry.

404
00:34:00,960 --> 00:34:03,080
We can extract the domain from there.

405
00:34:03,340 --> 00:34:08,840
See if the domain is already found in our list of domains That we supplied.

406
00:34:08,860 --> 00:34:10,980
If it's not, we can add the Domain.

407
00:34:11,360 --> 00:34:18,720
And if it doesn't match the Filter, we say hang on a bit, here's a domain within that Block that does not match your filter.

408
00:34:18,720 --> 00:34:22,840
Maybe it's interesting to have a look and see what else is on That domain.

409
00:34:23,260 --> 00:34:24,940
So let's see how this works.

410
00:34:30,080 --> 00:34:30,580
Okay.

411
00:34:30,580 --> 00:34:31,400
There's the forwards.

412
00:34:31,400 --> 00:34:32,020
It's now i.P.

413
00:34:32,020 --> 00:34:32,760
Sorted.

414
00:34:33,660 --> 00:34:35,500
You can go to the net blocks.

415
00:34:35,600 --> 00:34:37,500
Those are the net blocks that we defined.

416
00:34:37,780 --> 00:34:45,700
When we start the reverse, you'll see that it Automatically puts in the filters a list of the domains Because that's probably what you want to filter on.

417
00:34:45,700 --> 00:34:52,140
In our case, we change it so that it only says playboy Because maybe there's another playboy domain, playboypix.

418
00:34:52,140 --> 00:34:55,200
And we want that filter to pick it up as well.

419
00:34:55,860 --> 00:34:57,500
We start at the reverse now.

420
00:34:57,500 --> 00:35:00,080
You can see these are all the Entries that we get back.

421
00:35:00,900 --> 00:35:02,600
These are domains.

422
00:35:02,600 --> 00:35:09,380
There's playboyenterprise.com, for instance, that match the Filter, but we don't have playboy enterprise as a domain.

423
00:35:09,380 --> 00:35:14,020
So it's an additional domain that's a match domain that we Want to put back into the system, right?

424
00:35:14,560 --> 00:35:17,260
Now, this is not the speed at which it ran.

425
00:35:17,420 --> 00:35:22,840
I kind of paused it a couple of times so you don't have to sit Here the whole time looking at the thing running.

426
00:35:23,160 --> 00:35:26,480
At the bottom, you see there's something called, what is it?

427
00:35:26,480 --> 00:35:27,960
No, go down.

428
00:35:29,460 --> 00:35:32,040
Spicetv.com, right?

429
00:35:32,400 --> 00:35:46,560
If we do a whois on spicetv.com, right, you will see that it is Sitting at spiceentertainmentinc, and it's Sitting somewhere in chicago.

430
00:35:46,560 --> 00:35:48,700
Note the address, okay?

431
00:35:48,700 --> 00:35:52,400
Lake shore drive, chicago, and there's a phone number there.

432
00:35:52,620 --> 00:35:53,820
So let's just have a look and see.

433
00:35:53,820 --> 00:35:59,400
If we do a whois on playboy.com, what the contact information Would be for them.

434
00:36:00,380 --> 00:36:01,940
And what do you know?

435
00:36:02,080 --> 00:36:04,280
It is the same address.

436
00:36:04,460 --> 00:36:09,640
So spicetv and playboy is Clearly related, right?

437
00:36:09,800 --> 00:36:11,340
they are the same company.

438
00:36:11,340 --> 00:36:26,000
So in terms of putting new domains within your system to Start scanning for more interesting domains and to Start finding more ip addresses and more net blocks, you should Be looking at spicetv.com as well.

439
00:36:26,040 --> 00:36:35,340
So we can take that stuff, take out the subs in there, sort Unique that, basically cut all of that stuff out.

440
00:36:35,600 --> 00:36:37,620
You would see there's a bug in the program at this stage.

441
00:36:37,620 --> 00:36:43,320
It's fixed in the release that we have now, whereby it didn't Check for uppercase, lowercase.

442
00:36:43,320 --> 00:36:46,920
So playboy.com uppercase was Still in the list of unmatched.

443
00:36:47,840 --> 00:36:50,100
That's just too lower.

444
00:36:51,480 --> 00:36:56,620
And we can take all of that Stuff and we can basically paste it back in here with the rest Of our domains.

445
00:36:56,820 --> 00:36:58,540
See there, i take it out nicely.

446
00:36:59,720 --> 00:37:01,080
Sort unique that.

447
00:37:01,180 --> 00:37:02,480
And we can start over again.

448
00:37:02,480 --> 00:37:06,500
And that's why we have this kind of cyclical thing between the Reverse and the forwards.

449
00:37:06,500 --> 00:37:10,760
Until those blocks that we Scanned come out completely clean at the other end.

450
00:37:11,680 --> 00:37:12,560
Okay.

451
00:37:13,980 --> 00:37:23,880
Now, the next step we want to Do, when we're happy with our net block definitions, is we're Going to find what machines are actually within those blocks That we can attack.

452
00:37:23,880 --> 00:37:24,420
Correct?

453
00:37:24,700 --> 00:37:31,480
Now, again, imagine that you're doing this on a very large Organization and you've got, let's say, ibm with lots of Class b's.

454
00:37:32,240 --> 00:37:35,980
You need to, well, they've got Multiple class b's.

455
00:37:35,980 --> 00:37:37,680
You need something that's Really fast, right?

456
00:37:37,680 --> 00:37:41,580
this is, it ain't going to work If you're not scanning it really quick.

457
00:37:42,280 --> 00:37:44,940
Now, there's three ways that we can find out if a machine is Alive.

458
00:37:44,940 --> 00:37:47,680
We can do your normal icmp Scan, of course.

459
00:37:48,180 --> 00:37:50,980
We can do udp scans, which is A little bit more trickier.

460
00:37:51,580 --> 00:37:53,580
And we can do tcp scans.

461
00:37:53,580 --> 00:37:56,140
And then we go for kind of a small list of ports.

462
00:37:56,300 --> 00:37:57,440
And we only check for that.

463
00:37:57,440 --> 00:37:59,880
And sure, we're going to miss Stuff, okay?

464
00:38:00,100 --> 00:38:04,820
but the more ports you test for, The more it becomes a port scan on the entire range.

465
00:38:06,320 --> 00:38:07,920
And the longer it's going to take.

466
00:38:07,920 --> 00:38:16,260
So depending on your time here, you can either scan all the Ports or you can scan for a very small subset and only find the Machines that's alive on those ports.

467
00:38:17,200 --> 00:38:23,020
Now, what we've done with the port scanning is basically Implement a asynchronous port scanner.

468
00:38:23,360 --> 00:38:25,040
And you've all seen this.

469
00:38:25,040 --> 00:38:28,780
It's been used now in many kind Of tools.

470
00:38:29,340 --> 00:38:30,780
It basically works like this.

471
00:38:30,780 --> 00:38:32,960
We send out a sin, right?

472
00:38:32,960 --> 00:38:34,800
we have a sniffer on the other End.

473
00:38:34,800 --> 00:38:36,980
We check for the source port Coming back.

474
00:38:37,240 --> 00:38:40,100
If it's a sinack, the port is Open.

475
00:38:40,240 --> 00:38:42,680
If it's a reset, the port is Closed.

476
00:38:42,800 --> 00:38:44,280
It's as easy as that.

477
00:38:45,460 --> 00:38:47,020
So let's see how it works.

478
00:38:47,920 --> 00:38:53,080
This thing, and i know some of The other scanners, i mean, check out the unicorn scan Thing as well.

479
00:38:53,180 --> 00:38:55,880
I think they were speaking Yesterday morning, right?

480
00:38:56,260 --> 00:38:58,940
they're doing the same thing, But they're doing it distributed.

481
00:38:59,580 --> 00:39:01,500
So it's even faster that way.

482
00:39:01,820 --> 00:39:06,920
But we can probably, you know, Do one port in a class b in two minutes.

483
00:39:07,700 --> 00:39:10,680
So if you're only scanning for one port, it's going to take You about two minutes.

484
00:39:11,220 --> 00:39:16,500
We limit this thing so it only Sends, you know, at the quickest it can send out packets Every two milliseconds.

485
00:39:17,280 --> 00:39:20,420
Obviously you can do it faster Than that if you implement it yourself.

486
00:39:22,640 --> 00:39:23,440
Oops.

487
00:39:25,720 --> 00:39:26,200
Okay.

488
00:39:26,200 --> 00:39:30,340
So let's just look at the whole process for sensepost.com Because it's really quick.

489
00:39:30,380 --> 00:39:32,680
We go there, we find the Forward entries.

490
00:39:33,000 --> 00:39:34,280
It's going really quick.

491
00:39:34,700 --> 00:39:35,180
Okay.

492
00:39:36,040 --> 00:39:37,380
We're almost done.

493
00:39:38,300 --> 00:39:39,100
Right.

494
00:39:39,260 --> 00:39:40,900
We take it into the net blocks.

495
00:39:41,880 --> 00:39:46,260
What you will find is there's a 10, 15, 10 in there.

496
00:39:47,220 --> 00:39:51,540
Which, i mean, it's not internal, but we use it for the Training.

497
00:39:51,720 --> 00:39:55,220
So i'm taking that out Because i'm not going to scan 10, 15, 10, right?

498
00:39:55,220 --> 00:39:56,480
That's a little bit silly.

499
00:39:58,000 --> 00:40:13,560
And the other thing that's Interesting here to note is, let me just pause this, is that With service pack 2, xp service pack 2, microsoft actually Disabled the use of raw socket sending, right?

500
00:40:14,700 --> 00:40:21,500
Because they went through all the tools that uses raw socket Sending and they were like bad, bad, bad, bad.

501
00:40:21,500 --> 00:40:22,620
Let's not check the rest.

502
00:40:22,620 --> 00:40:23,540
They're all bad.

503
00:40:23,580 --> 00:40:24,240
Okay.

504
00:40:24,300 --> 00:40:26,100
So they disabled it.

505
00:40:26,360 --> 00:40:28,480
Which is a pity.

506
00:40:28,500 --> 00:40:36,560
So for us to be able to do This on this level, we need to drop a level down and send Those packets out on an ethernet layer.

507
00:40:37,420 --> 00:40:40,480
And so there's a driver that actually that we use.

508
00:40:40,580 --> 00:40:43,000
You've got to bind the driver and send the packets out that way.

509
00:40:43,000 --> 00:40:46,640
It's a little bit more tricky, but it's not that much more Tricky.

510
00:40:48,280 --> 00:40:49,200
Okay.

511
00:40:49,360 --> 00:40:52,900
So basically these net blocks now come in from the previous Step.

512
00:40:52,900 --> 00:40:54,760
We select what ports we want to Scan.

513
00:40:54,760 --> 00:40:56,340
It's all configurable, of Course .

514
00:40:57,640 --> 00:41:02,120
In this case, we go with 22, 23, 25, and 443.

515
00:41:02,640 --> 00:41:05,500
And we basically just start it Up over here.

516
00:41:07,620 --> 00:41:11,700
The ports that are found open Is listed on that side.

517
00:41:11,700 --> 00:41:13,640
Showing an o for open port.

518
00:41:13,640 --> 00:41:15,660
Shows you the ip, shows you the port.

519
00:41:15,720 --> 00:41:21,740
And it also shows you the ttl, which gives you a kind of idea Of how far the machine is away from you.

520
00:41:21,740 --> 00:41:28,460
Although, you know, some stacks send their packets out with the Ttl of 128, others with other values.

521
00:41:28,460 --> 00:41:29,920
So it's not that useful.

522
00:41:29,920 --> 00:41:32,080
But, you know, we put it in there Now.

523
00:41:32,080 --> 00:41:40,520
You'll see as soon as we go into The 72 network, things start to go a little bit quicker in there Or we get more results coming back.

524
00:41:40,520 --> 00:41:41,400
There we go.

525
00:41:41,940 --> 00:41:42,640
Okay.

526
00:41:43,880 --> 00:41:47,540
Because there's lots of machines that's open on those ports.

527
00:41:47,540 --> 00:41:49,600
And you'll see we paused it there.

528
00:41:49,600 --> 00:41:50,700
So it's going to jump.

529
00:41:50,900 --> 00:41:51,340
Okay.

530
00:41:52,300 --> 00:41:54,420
And that's basically doing the port scan.

531
00:41:54,420 --> 00:41:54,780
Right ?

532
00:41:54,780 --> 00:42:01,040
basically doing the port scan On the net blocks and on the ports that we specified in the Previous section.

533
00:42:02,340 --> 00:42:03,220
Okay.

534
00:42:04,320 --> 00:42:05,360
All right.

535
00:42:05,920 --> 00:42:08,920
So if you look at the whole Footprinting thing, it looks like this.

536
00:42:09,340 --> 00:42:12,500
And you're not supposed to be able to read anything that's on The screen.

537
00:42:12,680 --> 00:42:18,420
It's just to give you some Idea of all the different steps and the complexity involved with This whole thing.

538
00:42:18,780 --> 00:42:18,860
Okay.

539
00:42:18,860 --> 00:42:20,740
We start off with a domain over there.

540
00:42:20,960 --> 00:42:24,340
We end up with a whole list of ip numbers on that side.

541
00:42:24,380 --> 00:42:27,380
We're doing whole lots of tricks in between to make it work.

542
00:42:28,800 --> 00:42:29,300
Okay.

543
00:42:29,300 --> 00:42:31,500
So footprinting, it's over.

544
00:42:31,540 --> 00:42:32,780
I know people don't like it.

545
00:42:32,780 --> 00:42:33,520
I dig it.

546
00:42:33,520 --> 00:42:34,900
But it's not over.

547
00:42:34,960 --> 00:42:35,520
Right?

548
00:42:35,680 --> 00:42:40,940
So within this thing, which steps are easy to automate and Which steps are really difficult to automate?

549
00:42:40,940 --> 00:42:45,380
The domain finding stuff is really difficult to automate.

550
00:42:45,400 --> 00:42:45,800
Okay .

551
00:42:45,800 --> 00:42:51,180
We wrote a paper on this two Years ago for black hat singapore.

552
00:42:51,400 --> 00:42:52,780
You can get it off the black hat site.

553
00:42:52,780 --> 00:42:54,760
You can see the methods that we use there.

554
00:42:55,320 --> 00:42:58,820
I know johnny is going to talk about some of those methods in His talk as well.

555
00:42:58,820 --> 00:42:59,720
But it's difficult.

556
00:42:59,720 --> 00:43:00,960
It's not nice.

557
00:43:00,960 --> 00:43:02,720
It's not a fun thing to do.

558
00:43:03,840 --> 00:43:06,080
And at the moment, we don't do it.

559
00:43:06,080 --> 00:43:10,480
You can learn a lot from the reverse entries like we found On spice tv.Com.

560
00:43:10,980 --> 00:43:12,480
But we don't do this.

561
00:43:12,680 --> 00:43:15,320
The subdomain finding, we got it.

562
00:43:15,320 --> 00:43:15,700
It's cool.

563
00:43:15,700 --> 00:43:17,360
Forwards, no problem.

564
00:43:17,400 --> 00:43:19,440
The net blocks, it's difficult.

565
00:43:19,560 --> 00:43:25,880
The as expansion technique that We have there don't always work on small networks.

566
00:43:25,880 --> 00:43:30,480
So , for instance, sense post has one class c.

567
00:43:30,620 --> 00:43:38,260
But if you do a whois, if you look at the as that's Basically attached to our net block, you would find that it Belongs to the isp.

568
00:43:38,260 --> 00:43:46,180
And if you look at all the Other routes within that as, you're going to get the net Blocks for the isp, which is not necessarily what you want To do, right?

569
00:43:47,600 --> 00:44:01,720
the other problem is that these Registrars like LACNIC and APNIC and those guys, RIPE and ARIN, don't have a way to search with a wild card for Names and get back net blocks.

570
00:44:01,720 --> 00:44:08,120
I mean, you can do it on ARIN And you can kind of do it on RIPE with a bit of trouble.

571
00:44:08,120 --> 00:44:13,060
But you can't do it on LACNIC and you can't do it on APNIC and you can't do it on any of the others.

572
00:44:13,060 --> 00:44:14,140
You just can't do it.

573
00:44:14,140 --> 00:44:17,120
So you can't get more net Block definitions from those guys.

574
00:44:18,040 --> 00:44:30,860
The reverse scans, oh, and the other thing is the whois Information is worthless on these small little networks, right, because they don't have the actual person that is The company that has that net block.

575
00:44:30,860 --> 00:44:34,000
They only have the isp or something like that in there.

576
00:44:34,000 --> 00:44:35,600
So that's useless as well.

577
00:44:35,700 --> 00:44:38,100
The reverse scans, that's Easy.

578
00:44:38,100 --> 00:44:38,720
We can do it.

579
00:44:38,720 --> 00:44:40,080
It's a no-brainer.

580
00:44:40,140 --> 00:44:42,040
The vitality stuff, easy.

581
00:44:42,240 --> 00:44:48,300
At the moment we only got the TCP stuff, but doing the rest Is really just an extension on that.

582
00:44:48,740 --> 00:44:51,220
So why do you care about footprinting?

583
00:44:52,420 --> 00:45:01,160
You know, because there's a difference between finding one Vulnerability on one machine versus finding one machine With one vulnerability.

584
00:45:01,840 --> 00:45:06,920
And I think actually Dan Kaminsky had this point that he made in his talk last night As well.

585
00:45:07,140 --> 00:45:13,280
It's easier finding one Vulnerability on a whole lot of machines than finding one Vulnerability on one machine.

586
00:45:14,300 --> 00:45:14,740
Okay.

587
00:45:14,740 --> 00:45:16,400
So we've done with that, right?

588
00:45:16,400 --> 00:45:17,660
we've done with that first Block.

589
00:45:17,660 --> 00:45:19,400
We're going to move on to Fingerprinting.

590
00:45:19,600 --> 00:45:23,420
Now, fingerprinting, we Actually want to do os detection, right?

591
00:45:23,420 --> 00:45:31,180
We want to be able to see, say, that is a windows machine Running windows 2000, service pack 3, whatever.

592
00:45:31,200 --> 00:45:36,380
It's really difficult to do this from the internet on a Machine that is tightly firewalled.

593
00:45:36,720 --> 00:45:37,280
Why?

594
00:45:37,280 --> 00:45:39,360
It's not technically difficult.

595
00:45:39,360 --> 00:45:43,280
It's not only technically Difficult, but it's conceptually difficult as well.

596
00:45:43,460 --> 00:46:03,420
So if you have an apache machine, all right, that's Protected with the firewall 1 running on windows, microsoft Windows, with one-to-one net back to that apache box, that Thing is going to report itself on a network level as a Windows machine, right?

597
00:46:03,420 --> 00:46:05,460
because you're talking to the Windows stack.

598
00:46:05,840 --> 00:46:12,020
But on application level, it's Going to return itself back as a apache machine.

599
00:46:12,340 --> 00:46:18,160
So not just is it difficult to find that stuff, it's also Difficult to kind of decide which one will it be.

600
00:46:18,740 --> 00:46:21,760
So with bdblah, we don't try to do os detection.

601
00:46:21,760 --> 00:46:23,280
We don't even try to.

602
00:46:23,280 --> 00:46:25,200
What we do is we do banner Scanning.

603
00:46:25,200 --> 00:46:31,800
And i know, i know, everybody Tells me you can change the banner, but how many people Actually is changing their banners?

604
00:46:31,800 --> 00:46:34,220
not a whole lot of People are changing their banners, right?

605
00:46:34,300 --> 00:46:35,820
So we're saying, okay, that's fine.

606
00:46:35,820 --> 00:46:38,860
Let's just do banner scanning, let's see what we get.

607
00:46:39,600 --> 00:46:42,280
And we do it asynchronously again.

608
00:46:42,280 --> 00:46:45,020
And the asynchronous banner scanning stuff is quite cool.

609
00:46:45,780 --> 00:46:49,340
You can do asynchronous banner scanning for any kind of Banner.

610
00:46:49,900 --> 00:46:57,940
But the more complex it Becomes in terms of negotiation, like ssl, for instance, the More tricky it becomes to do it asynchronously.

611
00:46:57,940 --> 00:47:02,080
So we've done it with the ssl stuff.

612
00:47:02,080 --> 00:47:03,460
We've done it multithreaded.

613
00:47:03,520 --> 00:47:07,920
And with the rest of the stuff, We did it with the other ports, we've done it asynchronously.

614
00:47:07,920 --> 00:47:09,020
How does it work?

615
00:47:09,400 --> 00:47:09,980
okay.

616
00:47:10,060 --> 00:47:17,580
Basically, the same way that we had a asynchronous port Scanner, it works in the same way.

617
00:47:18,820 --> 00:47:20,440
So we got a sniffer.

618
00:47:20,440 --> 00:47:22,400
We're sending sins on this Sound.

619
00:47:22,400 --> 00:47:24,920
We have a sniffer that checks The source port, right?

620
00:47:25,220 --> 00:47:30,860
normally, if the port is open, It's going to come back with a sin.

621
00:47:33,560 --> 00:47:35,720
So normally it's going to go into this thing.

622
00:47:35,720 --> 00:47:36,460
It's going to get a sin.

623
00:47:37,000 --> 00:47:39,040
We've got to act that packet Back.

624
00:47:39,200 --> 00:47:40,340
So we send an act.

625
00:47:42,340 --> 00:47:45,120
We check if it's port 80 that we're testing.

626
00:47:45,300 --> 00:47:46,760
It could be other ports as well.

627
00:47:49,620 --> 00:47:54,540
And if it is, we send back a get Http1.0.

628
00:47:55,120 --> 00:47:59,280
Now we're going to get an act Back into this tree.

629
00:47:59,420 --> 00:48:02,720
If it's port 80, we extract it From the http header.

630
00:48:03,220 --> 00:48:06,180
If it's not port 80, we simply Extract the banner.

631
00:48:06,180 --> 00:48:09,460
Then it's a 25 or a 21 or any Of those, right?

632
00:48:10,600 --> 00:48:16,980
and we have to close the Session because otherwise our web servers are going to keep On sending the stuff back.

633
00:48:17,080 --> 00:48:18,680
So we have to send a fin.

634
00:48:19,660 --> 00:48:22,340
If there's a fin, we have to fin act that.

635
00:48:22,920 --> 00:48:26,260
Now, who can tell me for a t-shirt,

636
00:48:34,820 --> 00:48:37,900
what is the thing That's going to bite us?

637
00:48:38,020 --> 00:48:43,840
this works, but we have to do Something else to make this work.

638
00:48:44,320 --> 00:48:45,980
Who can tell me what the Problem is here?

639
00:48:46,700 --> 00:48:47,380
yes, sir?

640
00:48:50,580 --> 00:48:51,300
Yeah.

641
00:48:58,720 --> 00:49:02,820
I think you're right, but we Haven't seen a lot of that.

642
00:49:05,580 --> 00:49:07,680
No, no, no, no, no, no.

643
00:49:07,680 --> 00:49:09,300
That's not the problem either.

644
00:49:09,500 --> 00:49:11,220
Look, i mean, think about this.

645
00:49:11,220 --> 00:49:14,800
This stuff happens, right, on User level.

646
00:49:14,800 --> 00:49:16,400
Doesn't happen through the Kernel.

647
00:49:16,900 --> 00:49:18,720
Doesn't happen through the stack.

648
00:49:19,280 --> 00:49:21,820
The stack doesn't know about this happening.

649
00:49:22,320 --> 00:49:25,160
So we're sending out a fin, right?

650
00:49:25,160 --> 00:49:25,920
No problem.

651
00:49:25,920 --> 00:49:27,420
Our stack can send it out.

652
00:49:28,500 --> 00:49:29,220
Okay?

653
00:49:29,440 --> 00:49:32,800
so we get back a fin act.

654
00:49:32,800 --> 00:49:33,360
Right?

655
00:49:35,460 --> 00:49:37,660
and now, what's my stack going to Do?

656
00:49:37,720 --> 00:49:39,420
in comes a fin act packet.

657
00:49:40,760 --> 00:49:42,020
Who said reset?

658
00:49:42,020 --> 00:49:42,980
thank you, sir.

659
00:49:44,840 --> 00:49:46,620
So that's exactly the problem.

660
00:49:46,660 --> 00:49:48,860
Now, our fin act packet is Coming back into our stack.

661
00:49:48,860 --> 00:49:51,880
Our stack says, hey, i don't Know what you did.

662
00:49:54,800 --> 00:49:59,120
So the stack says, hey, hang on A bit, here's a fin act coming back to me.

663
00:49:59,120 --> 00:50:00,600
I never send out the fin.

664
00:50:01,000 --> 00:50:03,940
It doesn't know about that, so It's going to reply with a reset.

665
00:50:04,360 --> 00:50:06,880
So we've got to cut those resets off somewhere.

666
00:50:07,260 --> 00:50:10,440
In this case, you can do it in an upstream firewall.

667
00:50:11,060 --> 00:50:15,140
What we usually do is we, you know, we have a personal Firewall on the machine.

668
00:50:15,140 --> 00:50:16,900
We cut the resets off there.

669
00:50:16,900 --> 00:50:19,160
So there's no reset that your machine can send out.

670
00:50:19,160 --> 00:50:20,420
Not reset coming back.

671
00:50:20,420 --> 00:50:21,800
Reset's going out.

672
00:50:22,680 --> 00:50:23,280
Okay?

673
00:50:23,300 --> 00:50:28,820
this thing, this asynchronous Banners, a grabber can really work very fast.

674
00:50:29,180 --> 00:50:34,640
So we can do about 2,000 banners in three minutes that we can grab.

675
00:50:36,000 --> 00:50:39,520
What i want to show you is how it actually works.

676
00:50:39,520 --> 00:50:50,460
When we start out, we do the, we first do multi-threaded Work on the hdps to get that, because we can do it Asynchronously, but, hey, it's a lot of work.

677
00:50:50,460 --> 00:50:54,520
So let's go on and see.

678
00:50:54,520 --> 00:50:56,280
So those are the port scans.

679
00:50:56,720 --> 00:50:58,120
You go to the banners.

680
00:50:58,220 --> 00:51:00,620
You basically import that Stuff in there.

681
00:51:02,300 --> 00:51:03,340
Okay.

682
00:51:03,680 --> 00:51:05,460
Select the interface.

683
00:51:06,180 --> 00:51:07,120
Right.

684
00:51:09,460 --> 00:51:11,540
We start, it's starting there at the bottom.

685
00:51:11,540 --> 00:51:13,880
You can see it's starting on the ssl.

686
00:51:13,880 --> 00:51:18,500
It's doing 15 threads at the same time to find the banners For the ssl stuff.

687
00:51:18,500 --> 00:51:19,960
So that's not really fast.

688
00:51:21,620 --> 00:51:22,500
Right.

689
00:51:23,240 --> 00:51:26,420
And you will see there's a delay In there.

690
00:51:26,420 --> 00:51:30,980
The moment we're sending it out At 302 milliseconds delay between packets.

691
00:51:30,980 --> 00:51:34,900
But you can actually drop it off as, hang on, hang on, hang On.

692
00:51:34,900 --> 00:51:35,440
Hang on.

693
00:51:35,440 --> 00:51:35,960
Okay.

694
00:51:35,960 --> 00:51:38,840
You can drop it off as low as You want to.

695
00:51:38,840 --> 00:51:39,400
Right.

696
00:51:39,400 --> 00:51:41,500
You'll see there's additional weight in there.

697
00:51:41,500 --> 00:51:47,720
That's basically, you know, those smtp servers when you Connect to it, it doesn't do anything.

698
00:51:47,840 --> 00:51:49,540
And it waits and waits and waits.

699
00:51:49,540 --> 00:51:52,100
And then finally you get the Banner coming back.

700
00:51:52,100 --> 00:51:55,600
That's the time that we've got To wait for those stuff coming back.

701
00:51:55,640 --> 00:52:01,560
Now, what you will see here is i'm going to drop that delay There down to 2 milliseconds.

702
00:52:02,000 --> 00:52:08,640
And what's interesting is note The scroll bar on the right-hand side as i drop it.

703
00:52:13,900 --> 00:52:14,620
Okay.

704
00:52:14,860 --> 00:52:15,580
Zip.

705
00:52:17,820 --> 00:52:18,260
Okay.

706
00:52:18,260 --> 00:52:20,240
And those are all the banners That we could get there.

707
00:52:21,160 --> 00:52:23,340
So it's kind of fast.

708
00:52:23,780 --> 00:52:24,060
Okay.

709
00:52:24,060 --> 00:52:27,220
And now we're just waiting for Other banners to come in if there's anything.

710
00:52:28,840 --> 00:52:29,200
Okay.

711
00:52:29,200 --> 00:52:29,500
Cool.

712
00:52:29,500 --> 00:52:30,480
I'm going to go on.

713
00:52:31,860 --> 00:52:32,300
Right.

714
00:52:32,300 --> 00:52:34,120
So this is what we do for Banner scanning.

715
00:52:34,700 --> 00:52:35,560
What's the next step?

716
00:52:35,560 --> 00:52:37,140
We want to be able to do targeting.

717
00:52:37,740 --> 00:52:51,440
Now, the thing there is if you have a lot and lots and lots of Potential targets, you want something that can easily say, Oh, well, i want to identify everything that's running on Port 22 and i want to only test against those.

718
00:52:51,440 --> 00:52:57,060
Or i want to have only machines that have open ports within a Certain net block and i want to test those.

719
00:52:57,260 --> 00:52:59,700
Or you get the idea, right?

720
00:53:00,160 --> 00:53:03,360
so this is what the targeting Stuff looks like.

721
00:53:03,960 --> 00:53:06,840
We basically have the banners Now for everything.

722
00:53:06,980 --> 00:53:11,880
We can click on targeting and We basically get our net blocks definitions in there.

723
00:53:11,880 --> 00:53:15,740
We can drop down to those, see the machines that are in there.

724
00:53:15,740 --> 00:53:27,300
The machines in there has either a dns name or reverse or Forward or it's the mx record or it's the ns record for a domain Or it has an open port.

725
00:53:27,400 --> 00:53:32,100
Once it's got an open port, That's something that we would want to see in there, right?

726
00:53:32,100 --> 00:53:37,020
A machine that's totally dead with no forward or reverse Entries are kind of boring to us.

727
00:53:37,400 --> 00:53:43,960
Machines with dns information or open ports are interesting to Us and we can get the banners in there as well.

728
00:53:44,560 --> 00:53:49,960
What's interesting about the banner scanning is if you get a Reset coming from the host, what do you know?

729
00:53:50,380 --> 00:53:51,760
You know that it's wrapped, right?

730
00:53:51,760 --> 00:53:53,280
It's a tcp wrapped port.

731
00:53:53,280 --> 00:54:01,520
So it actually accepted the Entire conversation and then it sent back a reset to close the Connection afterwards.

732
00:54:02,040 --> 00:54:13,980
So we can do a search for Instance for open ssl and we're going to get all the machines That has a banner that contains the word open ssl in the banner.

733
00:54:14,780 --> 00:54:17,660
And then we can just simply say, okay, make those targets.

734
00:54:17,660 --> 00:54:23,460
I want to attack those machines with open ssl and immediately Goes off to the target section.

735
00:54:24,040 --> 00:54:25,040
Okay, cool.

736
00:54:26,480 --> 00:54:30,120
There we're doing a scan for machines on tcp 22.

737
00:54:30,120 --> 00:54:31,680
Anything that's open on 22?

738
00:54:34,520 --> 00:54:35,380
all right.

739
00:54:35,380 --> 00:54:40,780
So you see all the banners coming back there and i can Again just say make those machines targets.

740
00:54:40,780 --> 00:54:42,580
I want to attack it in the next stage.

741
00:54:46,270 --> 00:54:47,070
Okay.

742
00:54:47,350 --> 00:54:48,710
I think we get the idea.

743
00:54:49,430 --> 00:54:49,870
Right.

744
00:54:49,870 --> 00:54:53,130
So now we have our targets Defined.

745
00:54:53,410 --> 00:54:55,470
Remember we went through the Whole thing.

746
00:54:55,470 --> 00:54:56,550
We went through the whole thing.

747
00:54:56,550 --> 00:55:00,650
At this stage we have the machines that we're going to Attack.

748
00:55:00,850 --> 00:55:01,210
Okay.

749
00:55:01,210 --> 00:55:03,230
We went through the targeting, all of that.

750
00:55:03,230 --> 00:55:04,750
We have the machines that we want to attack.

751
00:55:04,970 --> 00:55:05,850
Right.

752
00:55:05,890 --> 00:55:07,530
So what's the next step?

753
00:55:07,530 --> 00:55:09,250
We want to do vulnerability discovery.

754
00:55:09,270 --> 00:55:12,430
We're going to find what vulnerabilities are on these Machines.

755
00:55:12,930 --> 00:55:19,570
So we're not going to write a Vulnerability scanner because there's a lot of people that Wrote vulnerability scanners.

756
00:55:19,570 --> 00:55:26,330
We're going to use something That's really solid, we hope, and widely used, and that is Nessus .

757
00:55:26,330 --> 00:55:29,950
So what we need to do is we Need to write a nessus client.

758
00:55:31,630 --> 00:55:32,190
Okay.

759
00:55:32,190 --> 00:55:33,790
We need to write a nessus client.

760
00:55:33,930 --> 00:55:43,730
And what we want to do is we want to give the user the Ability to select the plug-ins that he wants to use just as a Normal nessus client and say, well, i want to test this Particular bug.

761
00:55:44,330 --> 00:55:44,650
Okay.

762
00:55:44,650 --> 00:55:46,450
Remember what i said previously.

763
00:55:46,450 --> 00:55:52,090
It's easier to find a single Bug on a whole lot of machines than finding the one bug on one Machine.

764
00:55:52,270 --> 00:56:06,790
So, for instance, if we want to Check which machines on an entire class b has snmp Community strings enabled, you know, we put one plug-in into Nessus and we scan it across the whole class a and we find the Stuff really quick.

765
00:56:07,070 --> 00:56:07,770
Okay.

766
00:56:10,350 --> 00:56:14,710
So this is basically what we use for plug-in selection.

767
00:56:17,650 --> 00:56:19,290
It's really easy.

768
00:56:19,290 --> 00:56:21,310
You can decide which plug-ins You want to use.

769
00:56:21,330 --> 00:56:27,290
You can move them from the one End to the other end and you can save that information afterwards.

770
00:56:27,390 --> 00:56:29,150
It actually just saves the plug-in i.D.

771
00:56:29,150 --> 00:56:34,830
So you can have Your list of plug-in i.D.s wherever you want to have it.

772
00:56:34,830 --> 00:56:43,850
You can put it in a text file and you can use whatever kind of Selector you want to basically select these plug-ins.

773
00:56:43,850 --> 00:56:47,270
It's just a list of nessus plug-ins, right, i.D.s.

774
00:56:48,270 --> 00:56:52,670
Afterwards we're going to save that and i can give it a name.

775
00:56:52,670 --> 00:56:57,070
Those are the plug-in i.D.s on the left-hand side and i can call That thing whatever i want.

776
00:56:57,090 --> 00:57:00,610
I'm going to call it black hat Demo.PLG.

777
00:57:01,090 --> 00:57:02,390
That's a plug-in set.

778
00:57:02,390 --> 00:57:04,330
You're going to see i'm going to use it later on.

779
00:57:06,810 --> 00:57:11,550
So in the next step we actually want to now run vulnerability Scans, right?

780
00:57:11,550 --> 00:57:15,930
we're going to run the nessus Scan against our target on a particular plug-in set.

781
00:57:18,890 --> 00:57:20,910
So there's the sense for stuff.

782
00:57:20,910 --> 00:57:22,210
There's the net blocks.

783
00:57:22,750 --> 00:57:24,730
There's all the reverse entries.

784
00:57:25,090 --> 00:57:25,810
Click.

785
00:57:26,290 --> 00:57:27,070
Yeah.

786
00:57:27,630 --> 00:57:29,410
There's the port scan.

787
00:57:30,210 --> 00:57:31,530
The banners.

788
00:57:32,230 --> 00:57:36,330
And what we want to do now is Run a nessus scan against those machines.

789
00:57:36,970 --> 00:57:38,930
But we have to target them first.

790
00:57:38,930 --> 00:57:43,910
So i'm going to click on Targeting and i'm going to say that first, you see that first Class c over there?

791
00:57:44,130 --> 00:57:45,710
there's a couple of machines in There.

792
00:57:45,710 --> 00:57:50,210
It's in our lab situation that We want to scan, right?

793
00:57:51,350 --> 00:58:00,950
i can right-click on any of those And say select it as a target or what i can do is i can Simply say anything that's in that block that's got an open Port, make it a target.

794
00:58:01,350 --> 00:58:03,950
So immediately i get a list of Machines there.

795
00:58:03,990 --> 00:58:07,190
Those machines are now my Because they're live, right?

796
00:58:07,190 --> 00:58:09,630
they responded to any of those scans.

797
00:58:10,370 --> 00:58:16,010
And i go to the nessus tab over there and i basically import Those by just clicking on the import button.

798
00:58:16,550 --> 00:58:16,830
Okay.

799
00:58:16,830 --> 00:58:18,910
I select the set that i want to Use.

800
00:58:20,970 --> 00:58:24,250
And i click on start.

801
00:58:25,010 --> 00:58:25,650
Right.

802
00:58:25,650 --> 00:58:30,450
Now, with ntp, the nessus Protocol, you have to get all the plug-ins.

803
00:58:30,550 --> 00:58:33,010
You have to load the plug-ins before you can actually run the Scan.

804
00:58:33,010 --> 00:58:33,750
It's kind of weird.

805
00:58:33,750 --> 00:58:41,230
Even if you know exactly what plug-ins you want to use, you Have to select, you have to get all the plug-in information Coming back.

806
00:58:41,670 --> 00:58:43,430
Now, there you can see the Scan is now running.

807
00:58:43,430 --> 00:58:47,010
It started with the port scan As per normal on all those ip addresses.

808
00:58:47,490 --> 00:58:56,150
You can set your nessus server up as you want to, to, you know, Scan more machines at a time or more threads at a time or any of That stuff at a time.

809
00:58:56,310 --> 00:59:00,970
It really depends on your nessus Server how fast that scan is going to happen.

810
00:59:00,970 --> 00:59:08,790
At any time, we can just click on the update tree button and we Can see how far the scan has gone and what we've done there And, you know, get the output back.

811
00:59:08,790 --> 00:59:11,190
It's, you know, the same old, same old.

812
00:59:11,190 --> 00:59:12,610
We've all seen this before.

813
00:59:13,190 --> 00:59:17,630
It's just a different flavor, Different interface, but it's not doing anything else.

814
00:59:19,510 --> 00:59:21,830
And it will tell you when the scan is done.

815
00:59:22,150 --> 00:59:25,150
You can see there's still a bug there at the bottom as well.

816
00:59:25,150 --> 00:59:26,730
We sorted that out as well.

817
00:59:27,070 --> 00:59:33,870
But i thought, you know, let me Rather have the bug in there and you can see that it's really Running and not a video recording somewhere.

818
00:59:34,850 --> 00:59:38,030
It also now shows you the actual issues.

819
00:59:39,110 --> 00:59:39,670
Right .

820
00:59:40,050 --> 00:59:40,990
Okay.

821
00:59:40,990 --> 00:59:45,210
So let's move on.

822
00:59:45,890 --> 00:59:47,850
We've done the vulnerability discovery.

823
00:59:47,850 --> 00:59:52,310
The only thing that's left to do is basically exploit those Vulnerabilities, right?

824
00:59:52,830 --> 00:59:56,990
now, again, we don't want to Reinvent the wheel here.

825
00:59:58,310 --> 01:00:04,290
So we have this thing talk to a Nice exploitation framework, which is metasploit.

826
01:00:04,310 --> 01:00:05,910
There's a couple of others as well.

827
01:00:05,970 --> 01:00:07,830
But metasploit is quite neat.

828
01:00:08,650 --> 01:00:09,710
So what do we have to do?

829
01:00:09,710 --> 01:00:12,130
We write a metasploit client.

830
01:00:13,190 --> 01:00:19,830
Now, the problem with Metasploit, it's actually not a problem with metasploit, it's a Problem with us, okay, is that it's very operating

831
01:00:23,650 --> 01:00:32,070
Specific, which is this exploit will work against, you know, Windows 2k service pack 2.

832
01:00:33,810 --> 01:00:35,850
We don't have that information, Right?

833
01:00:35,850 --> 01:00:38,610
we don't have that kind of Level of information about our targets.

834
01:00:38,610 --> 01:00:41,790
If we were internal to the network, we can do funky stuff.

835
01:00:41,870 --> 01:00:42,630
But we're not.

836
01:00:42,630 --> 01:00:43,630
We're external.

837
01:00:43,690 --> 01:00:44,830
So we don't have the information.

838
01:00:44,830 --> 01:00:49,230
So what do we do is we select The target number zero and we hope for the best.

839
01:00:49,250 --> 01:00:52,290
Because a lot of the metasploit plug-ins actually does a brute Force.

840
01:00:52,290 --> 01:00:53,990
So we don't have to supply it.

841
01:00:54,370 --> 01:00:56,830
What else is it that we have to supply to metasploit?

842
01:00:56,830 --> 01:00:59,590
We have to supply the remote port, right?

843
01:00:59,850 --> 01:01:02,750
But the remote port we can pick up from the nasus scan.

844
01:01:03,250 --> 01:01:08,770
Because let's say your server was running on, your web server Was running on port 27, right?

845
01:01:09,630 --> 01:01:12,330
the nasus would pick it up as on Port 27.

846
01:01:12,330 --> 01:01:14,070
And we have that port, right?

847
01:01:14,070 --> 01:01:16,630
We know when stuff is ssl as well.

848
01:01:16,870 --> 01:01:20,770
So we can specify in metasploit if it's got to use ssl or not.

849
01:01:22,190 --> 01:01:25,590
And we have the local ip address as well.

850
01:01:25,590 --> 01:01:28,990
If we have, if we're doing, for instance, a reverse shell.

851
01:01:28,990 --> 01:01:30,910
Because that's our ip address.

852
01:01:31,310 --> 01:01:33,110
So most of the stuff we have.

853
01:01:33,130 --> 01:01:43,210
The only thing that we don't have is we don't have a way to Tie up a metasploit exploit with the nasus id, right?

854
01:01:43,210 --> 01:01:48,450
So basically saying we use nasus to identify the weakness.

855
01:01:48,950 --> 01:01:51,030
And we use metasploit to exploit it.

856
01:01:51,030 --> 01:01:52,830
But how do you tie the two together?

857
01:01:53,490 --> 01:01:55,350
So what we've done, where's gareth?

858
01:01:56,230 --> 01:02:10,570
What gareth has done there, gareth phillips, right in front Of the camera, he's been a week basically, you know, tying these Two things up, saying here's a metasploit exploit, okay?

859
01:02:10,570 --> 01:02:14,590
Is there a nasus plug-in that will identify this particular Problem?

860
01:02:14,850 --> 01:02:18,930
and if he can find it, he Basically writes it down in a little list.

861
01:02:18,930 --> 01:02:21,110
Says this exploit, that plug-in.

862
01:02:21,210 --> 01:02:26,090
And if there's multiple plug-ins For a specific exploit, he's got them listed there.

863
01:02:26,090 --> 01:02:35,290
And if there's no nasus plug-in for the metasploit exploit, That's, a, scary, right?

864
01:02:37,050 --> 01:02:39,450
and so, b, he would write some Of them.

865
01:02:39,450 --> 01:02:40,650
So how many did we write?

866
01:02:40,910 --> 01:02:43,030
We write about four, five.

867
01:02:43,630 --> 01:02:51,910
And i think at the moment, in Terms of tying the stuff together, we need another 13 of The 70, how many, 70?

868
01:02:52,410 --> 01:02:53,050
78.

869
01:02:53,270 --> 01:02:54,450
78 exploits.

870
01:02:54,450 --> 01:02:57,270
That was, you know, the Adding to it the whole time.

871
01:02:57,350 --> 01:03:00,350
The rest of the stuff is pretty Much mapped, okay?

872
01:03:00,350 --> 01:03:11,130
and what we're hoping to do, And i'll beg hd for this, is to see if we can get it so That when they write new exploits for metasploit, they Include a nasus id in there.

873
01:03:11,150 --> 01:03:15,030
And if there's no nasus id, Then they basically write a nasus check for it.

874
01:03:15,870 --> 01:03:21,610
Because then we can just query, you know, the framework and get The ids out of it dynamically, and we don't have to keep this List.

875
01:03:21,610 --> 01:03:23,630
And we're not going to keep This list current, okay?

876
01:03:23,630 --> 01:03:25,030
that's not what we do.

877
01:03:25,750 --> 01:03:26,210
Okay.

878
01:03:26,210 --> 01:03:28,470
So let's see, let's see how it works.

879
01:03:29,630 --> 01:03:30,090
Okay.

880
01:03:30,090 --> 01:03:33,850
So for this instance, we're Looking at a vmware server, right?

881
01:03:33,850 --> 01:03:37,090
We're not, this is just a vmware server.

882
01:03:38,770 --> 01:03:46,190
Now, what's interesting here is, when we now do our nasus Scan, right, why do we have to check for all the nasus ids?

883
01:03:47,010 --> 01:03:53,130
We only check for the ones that's got related metasploit Exploits, right?

884
01:03:53,250 --> 01:03:59,210
we check for those 72 minus 13 nasus ids that we already got.

885
01:03:59,230 --> 01:04:13,470
So what i'm doing here is i'm basically running a nasus scan Against the ip address and only using the, i'm only using the List of nasus ids with related metasploit plug-ins.

886
01:04:13,910 --> 01:04:16,330
And you can see it, it can do it rather quickly.

887
01:04:16,910 --> 01:04:18,490
So there, it's done.

888
01:04:18,490 --> 01:04:20,530
And we found three issues.

889
01:04:21,190 --> 01:04:24,930
You click on it, you'll basically see, it should be all Red, right?

890
01:04:24,930 --> 01:04:27,050
the last one, i don't know, It's a bug.

891
01:04:27,950 --> 01:04:31,830
Basically tells you these are The three heavy issues that we found on this machine.

892
01:04:31,830 --> 01:04:33,090
You can look at them.

893
01:04:34,730 --> 01:04:42,430
And when you go to metasploit, What you do is you click on that little button over there, And that loads the definitions in.

894
01:04:42,430 --> 01:04:43,130
Hang on.

895
01:04:44,470 --> 01:04:50,590
That basically loads the Definitions in that says this is the nasus id that matches with This metasploit id.

896
01:04:50,650 --> 01:04:55,350
Once we have that, we can Simply click on a thing that says find the matching target.

897
01:04:55,530 --> 01:04:58,970
So now it will go through the entire nasus scan, right?

898
01:04:58,970 --> 01:05:09,010
Of all the machines that we want to scan, and it's going to Pick out the ones that has related metasploit ids and say These are potential targets.

899
01:05:09,010 --> 01:05:13,210
If you run the metasploit exploit Against this, you have a good chance that it's going to work.

900
01:05:14,610 --> 01:05:18,070
And those are, that's obviously the same machine, right?

901
01:05:18,070 --> 01:05:19,610
It's all the same machine.

902
01:05:19,710 --> 01:05:25,130
And there's identified four Problems, four possible exploits that we can run against that machine.

903
01:05:25,130 --> 01:05:28,810
We now have to configure our exploits.

904
01:05:30,170 --> 01:05:34,110
So we're going to go for, which one is it, the decom one?

905
01:05:34,110 --> 01:05:34,650
No.

906
01:05:35,090 --> 01:05:35,790
Yes.

907
01:05:35,790 --> 01:05:37,810
It will tell you what the exploit is all about.

908
01:05:37,870 --> 01:05:40,290
Now you've got to select what you want to do with that thing.

909
01:05:40,550 --> 01:05:42,490
So you configure the exploit.

910
01:05:42,610 --> 01:05:43,290
Click.

911
01:05:44,590 --> 01:05:53,050
And it basically dynamically queries the framework and tells You for that exploit, these are the different payloads that you Can have, right?

912
01:05:53,410 --> 01:05:54,810
that's the reverse.

913
01:05:54,810 --> 01:06:03,990
And the stuff that you have to fill out, okay, the stuff that You have to fill out, you can fill out, right?

914
01:06:03,990 --> 01:06:09,050
The rest of the stuff is automatically populated with all The information that we know at this stage.

915
01:06:09,750 --> 01:06:10,230
Okay.

916
01:06:10,230 --> 01:06:14,390
So i'm going to bring up the Vmware machine.

917
01:06:14,590 --> 01:06:15,370
There we go.

918
01:06:15,370 --> 01:06:20,570
I've configured the rest of the exploits as well, but i didn't Want to go through that.

919
01:06:20,610 --> 01:06:21,910
And you can save it as well.

920
01:06:22,150 --> 01:06:24,850
And i start the metasploit framework on this side.

921
01:06:24,850 --> 01:06:29,530
It could be sitting on any box, right, at this stage it's just Sitting on your local machine.

922
01:06:29,690 --> 01:06:33,530
But you can have it speak to a Metasploit framework on a remote machine as well.

923
01:06:34,170 --> 01:06:35,530
And that's it .

924
01:06:35,530 --> 01:06:36,690
We click on start.

925
01:06:37,530 --> 01:06:40,370
And now it's basically running those exploits against the machines.

926
01:06:41,250 --> 01:06:44,610
Remember, those machines could be a whole lot of machines.

927
01:06:45,030 --> 01:06:50,490
If you're scanning a large organization, again, you know, Through the whole thing .

928
01:06:51,090 --> 01:06:51,530
Okay.

929
01:06:51,530 --> 01:06:56,230
And when it's done, what we expect is that in the framework We're going to have those shells.

930
01:06:57,550 --> 01:07:03,190
And lo and behold, if you click on sessions, hey, there you go.

931
01:07:03,190 --> 01:07:04,390
There's your shells.

932
01:07:05,270 --> 01:07:05,810
Okay.

933
01:07:05,810 --> 01:07:09,530
And, you know, i think you all know what this looks like, right?

934
01:07:09,730 --> 01:07:14,270
If you don't know, we're going to click on a session there just So that you also see it's not bullshit.

935
01:07:20,320 --> 01:07:21,160
Okay.

936
01:07:21,800 --> 01:07:23,100
You can do it.

937
01:07:24,100 --> 01:07:24,680
All right.

938
01:07:24,680 --> 01:07:25,960
That's this metasploit.

939
01:07:25,960 --> 01:07:26,420
Okay .

940
01:07:26,420 --> 01:07:30,540
Now, think about a large network.

941
01:07:30,540 --> 01:07:31,100
Okay .

942
01:07:31,860 --> 01:07:36,280
Let's say you're even sitting Internal on a network.

943
01:07:38,440 --> 01:07:40,180
Let me show you something.

944
01:07:40,500 --> 01:07:42,720
This was done on an internal network.

945
01:07:43,080 --> 01:07:46,740
I can't tell you who's network there.

946
01:07:48,320 --> 01:07:51,100
I'm going to just load that data set in.

947
01:07:54,000 --> 01:07:56,100
That's the one that says can't say who.

948
01:07:56,100 --> 01:07:57,460
It's all text files.

949
01:07:57,460 --> 01:07:58,900
It saves it in text files.

950
01:07:59,760 --> 01:08:00,340
Okay.

951
01:08:00,500 --> 01:08:01,640
This is the net blocks.

952
01:08:01,640 --> 01:08:03,960
You check all the ten dot somethings in there.

953
01:08:04,220 --> 01:08:10,160
And if we go to nesis, you'll find that there's lots of Issues with these machines.

954
01:08:11,260 --> 01:08:13,680
A lot of them have the same Issue, right?

955
01:08:14,280 --> 01:08:19,740
but some have some interesting Issues in there, like dot printer and those kind of Overflows.

956
01:08:19,900 --> 01:08:21,760
In metasploit, look at this.

957
01:08:21,860 --> 01:08:22,340
Okay.

958
01:08:22,340 --> 01:08:28,340
If you click on matching Targets, it's kind of funny.

959
01:08:29,760 --> 01:08:32,020
That's worm territory, man.

960
01:08:32,900 --> 01:08:33,380
Okay.

961
01:08:33,920 --> 01:08:39,040
So in a perfect world, sorry, yes.

962
01:09:10,570 --> 01:09:11,310
Okay.

963
01:09:11,310 --> 01:09:13,770
Can we take this offline Afterwards?

964
01:09:13,990 --> 01:09:14,670
okay.

965
01:09:15,930 --> 01:09:18,170
So but i will speak to you.

966
01:09:18,270 --> 01:09:19,390
So are we done?

967
01:09:19,390 --> 01:09:20,610
In a perfect world, we're done.

968
01:09:20,610 --> 01:09:22,450
In a perfect world, we're done.

969
01:09:22,450 --> 01:09:25,350
And we, you know, we've done our assessment and this.

970
01:09:25,350 --> 01:09:31,310
But if you're doing assessments, can i just see in this room Here who actually has to write reports?

971
01:09:32,270 --> 01:09:32,970
Aha.

972
01:09:33,070 --> 01:09:34,690
I thought so much.

973
01:09:34,910 --> 01:09:37,550
So in a perfect world, you have to write reports.

974
01:09:37,630 --> 01:09:39,130
You don't have to write reports.

975
01:09:39,130 --> 01:09:42,210
In a perfect world, there's no False positives.

976
01:09:42,470 --> 01:09:43,270
Nowhere.

977
01:09:43,390 --> 01:09:45,010
Nesis never makes a mistake.

978
01:09:46,270 --> 01:09:47,270
Well, guess what?

979
01:09:47,270 --> 01:09:48,330
It does, right?

980
01:09:48,330 --> 01:09:51,090
and sometimes the stuff that It gives you is just not relevant.

981
01:09:51,090 --> 01:09:55,450
So what we've done is we have this thing.

982
01:09:56,410 --> 01:10:05,270
To start off with, you know, within the nesis scan, you can Mark something as a false positive, right?

983
01:10:05,590 --> 01:10:07,190
If you really want to.

984
01:10:09,190 --> 01:10:16,650
And you can basically say mark This as a false positive across the entire range of scans that You've done.

985
01:10:17,130 --> 01:10:19,270
And you can comment on the Stuff.

986
01:10:19,670 --> 01:10:28,970
And what's nice about this is That when you go back to your targeting section, you can Basically then go and say, well, let's find wherever i put that Comment in.

987
01:10:29,090 --> 01:10:38,090
Or you can basically say, let's Search all the machines that nesis croaked about on, i don't Know, usable name server, for instance, right?

988
01:10:38,090 --> 01:10:44,170
And i want to find those machines because those are the Machines i need to attack or defend.

989
01:10:44,170 --> 01:10:47,650
I need to patch these machines or i need to attack these Machines, right?

990
01:10:47,770 --> 01:10:53,090
so you can very easily do That kind of advanced targeting.

991
01:10:55,050 --> 01:10:57,330
Supposed to be one.

992
01:10:57,670 --> 01:10:58,110
Okay?

993
01:10:59,170 --> 01:11:07,890
And what's nice about this thing as well is the last tag on this Thing basically does a lot of the reporting work for you, Okay?

994
01:11:07,890 --> 01:11:10,530
so you have to write these Things out for your boss.

995
01:11:10,690 --> 01:11:12,650
You have to give it out to a Client .

996
01:11:13,750 --> 01:11:20,750
It would go a long, long way To basically help you not to have to write that report.

997
01:11:20,910 --> 01:11:26,710
The reason why we do this, the reason why we use this tool and Develop this tool was that we use it internally, right?

998
01:11:26,710 --> 01:11:29,750
And we want to spend our time doing interesting stuff.

999
01:11:29,750 --> 01:11:29,950
Okay?

1000
01:11:29,950 --> 01:11:33,210
we want to do the more Interesting work of an assessment.

1001
01:11:33,210 --> 01:11:41,610
We don't want to spend time writing reports and basically Having to copy and paste from a nesis report into a real report.

1002
01:11:41,610 --> 01:11:45,570
You know, that stuff, we want to play with the interesting stuff.

1003
01:11:45,570 --> 01:11:52,410
And that's why we have this particular, it's just going on There, but i can't forward the video, actually.

1004
01:11:53,530 --> 01:11:53,950
There we go.

1005
01:11:53,950 --> 01:11:54,950
There's the reporting.

1006
01:11:58,370 --> 01:12:00,270
I'm just doing the host tables now.

1007
01:12:00,370 --> 01:12:02,070
So basically we have all the information, right?

1008
01:12:02,070 --> 01:12:02,830
We have the forwards.

1009
01:12:02,830 --> 01:12:03,710
We have the reverse.

1010
01:12:03,830 --> 01:12:04,870
We have the domains.

1011
01:12:04,950 --> 01:12:05,690
We have the banners.

1012
01:12:05,690 --> 01:12:06,530
We have the open ports.

1013
01:12:06,530 --> 01:12:07,490
We have the issues.

1014
01:12:07,490 --> 01:12:08,850
We have the severity of the issues.

1015
01:12:08,850 --> 01:12:10,150
We have all of these things.

1016
01:12:10,370 --> 01:12:17,010
So we can basically take one host and build up a kind of a Host table that says this is the entire machine.

1017
01:12:17,010 --> 01:12:19,130
This is what the machine looks like, right?

1018
01:12:20,290 --> 01:12:21,470
It's an mx record.

1019
01:12:21,950 --> 01:12:23,730
It has this ip address.

1020
01:12:23,730 --> 01:12:24,870
It has these ports open.

1021
01:12:24,870 --> 01:12:26,210
It has these banners.

1022
01:12:27,610 --> 01:12:28,390
Okay?

1023
01:12:28,390 --> 01:12:31,810
and it has these nesis ids with Whatever impact.

1024
01:12:32,270 --> 01:12:35,470
And that happens all Automatically because we don't want to do it.

1025
01:12:35,470 --> 01:12:41,630
All the comments that we put in there, if there's a comment that We wanted to put in there, then that comment is also retained.

1026
01:12:42,150 --> 01:12:44,810
So you can see there it says analyst comment.

1027
01:12:45,390 --> 01:12:48,530
That's a comment that we put in there in the past.

1028
01:12:48,530 --> 01:12:51,530
It's really nice for banners as well.

1029
01:12:51,530 --> 01:13:01,090
So if you do banner scanning and then you sort by banner, you can See immediately these are all my is5 machines or this is the Target's is5 machines.

1030
01:13:01,270 --> 01:13:02,330
This is the target's this.

1031
01:13:02,330 --> 01:13:04,730
All of those things come out quite neatly.

1032
01:13:05,190 --> 01:13:05,570
Okay.

1033
01:13:05,570 --> 01:13:07,010
So what's the bottom line?

1034
01:13:07,390 --> 01:13:14,490
The bottom line is this tool is basically doing 80 of the work In 20 of the time that it takes us to do.

1035
01:13:14,570 --> 01:13:20,710
Which leaves us with 80 of the time that we can play with more Interesting things.

1036
01:13:20,850 --> 01:13:21,370
Okay?

1037
01:13:22,450 --> 01:13:26,250
Some of the steps of the methodology is really hard to Automate.

1038
01:13:26,430 --> 01:13:28,930
And it's usually where there's Exceptions.

1039
01:13:28,930 --> 01:13:30,770
You know, there's exception to The rule.

1040
01:13:30,770 --> 01:13:32,450
Makes it very hard to automate.

1041
01:13:33,550 --> 01:13:38,850
Hopefully it will also raise the bar on people that, you know, Do penetration.

1042
01:13:38,850 --> 01:13:41,890
I'm a penetration testing Specialist kind of dude.

1043
01:13:42,790 --> 01:13:52,770
Because these things, i mean, The report that you get out of this is just about the same Report as these people are doing in a long, long, long time and Charging a lot of money for it.

1044
01:13:53,830 --> 01:13:56,270
So that's hopefully what we're Going to get out of it.

1045
01:13:56,630 --> 01:14:03,250
In terms of release of this Tool, there's always a problem here, right?

1046
01:14:03,370 --> 01:14:08,510
We've got the gentleman in front that's going to tell me, you're Not going to release this, right?

1047
01:14:08,550 --> 01:14:13,610
I mean, this is point and click, you know, weapons of mass Destruction.

1048
01:14:15,290 --> 01:14:17,330
You're not going to release it, Right?

1049
01:14:17,750 --> 01:14:22,090
and then we've got the other Side, which i guess is the rest of the class.

1050
01:14:22,950 --> 01:14:25,650
That's saying, okay, where do we download it?

1051
01:14:27,170 --> 01:14:31,470
So we build this version, which is a cripple version.

1052
01:14:31,470 --> 01:14:33,710
It's only crippled in two ways.

1053
01:14:33,710 --> 01:14:34,190
Okay?

1054
01:14:34,190 --> 01:14:37,650
It runs for 20 minutes, and you can't save your data.

1055
01:14:37,650 --> 01:14:40,150
The rest of the stuff is exactly the same.

1056
01:14:40,670 --> 01:14:41,070
Okay ?

1057
01:14:41,950 --> 01:14:46,750
i just want to see, harun, are We do we have time left?

1058
01:14:46,910 --> 01:14:48,450
how much time do we have left?

1059
01:14:48,950 --> 01:14:49,890
30 minutes?

1060
01:14:49,890 --> 01:14:56,770
okay, what we're going to do Now is we're going to play with it a bit and see how it works in Real life, okay?

1061
01:14:57,030 --> 01:15:07,950
keep in mind, we're doing it Via the wireless, and the wireless is kind of, you know, Flaky because of the fact that we kind of ride next door to The wi-fi shootout room.

1062
01:15:09,070 --> 01:15:16,570
So if it's not handling itself Well, then you know why.

1063
01:15:17,130 --> 01:15:17,870
Okay.

1064
01:15:20,700 --> 01:15:23,340
So this is what the tool looks like.

1065
01:15:25,800 --> 01:15:26,540
All right.

1066
01:15:26,540 --> 01:15:32,820
It's a, the new release is a Little bit more friendlier and so forth and so on.

1067
01:15:32,820 --> 01:15:34,080
Okay.

1068
01:15:34,960 --> 01:15:36,060
So are we good?

1069
01:15:36,380 --> 01:15:36,600
Okay.

1070
01:15:36,600 --> 01:15:38,840
Let's just see if i can get out To the net.

1071
01:15:40,440 --> 01:15:40,940
Okay.

1072
01:15:40,940 --> 01:15:48,040
As you can see, it's kind of, you know, yeah.

1073
01:15:48,100 --> 01:15:48,880
Okay.

1074
01:15:48,920 --> 01:15:49,580
Okay.

1075
01:15:49,580 --> 01:15:50,740
So but let's give it a go.

1076
01:15:50,740 --> 01:15:50,980
Okay.

1077
01:15:50,980 --> 01:15:58,440
So for subdomains, remember i told you subdomains, Subdomains, but it actually gets really interesting.

1078
01:15:58,440 --> 01:16:00,840
So i want to put a domain in there.

1079
01:16:00,840 --> 01:16:05,700
So if you're from this organization, keep in mind that We're only mining subdomains.

1080
01:16:05,700 --> 01:16:07,200
We're not attacking your Network.

1081
01:16:07,680 --> 01:16:09,900
We're not going to go further Than subdomains.

1082
01:16:10,560 --> 01:16:11,040
Okay.

1083
01:16:11,440 --> 01:16:13,500
So i'm going to put in there a domain.

1084
01:16:16,630 --> 01:16:17,170
Right.

1085
01:16:17,170 --> 01:16:18,730
I don't know if you can see That.

1086
01:16:25,210 --> 01:16:31,680
If you can't, remember, it's Only subdomain mining.

1087
01:16:31,680 --> 01:16:33,320
It's not anything else.

1088
01:16:33,320 --> 01:16:34,420
We're not attacking the network.

1089
01:16:34,420 --> 01:16:36,660
We're not sending a single Packet to that network.

1090
01:16:37,300 --> 01:16:38,000
Okay.

1091
01:16:38,000 --> 01:16:43,160
And you can see that it's basically pulling down a whole Lot of subdomains there.

1092
01:16:44,020 --> 01:16:44,580
Okay.

1093
01:16:45,960 --> 01:16:46,920
Right.

1094
01:16:48,400 --> 01:16:57,320
We got some interesting things In there and e-mail addresses that we can mine as well if we Want to use it for later use.

1095
01:16:57,900 --> 01:16:58,500
Okay.

1096
01:16:58,500 --> 01:17:00,280
I'm going to stop this now.

1097
01:17:01,840 --> 01:17:04,500
So let me just find the stop Button.

1098
01:17:04,880 --> 01:17:10,860
And then, of course, you can Go to the forwards and you can simply input that and start Doing all the forwards on that, which i'm not going to do.

1099
01:17:10,960 --> 01:17:11,400
Right .

1100
01:17:12,180 --> 01:17:21,260
We actually have the permission To look at some of the other network, good friends at Electronic arts.

1101
01:17:21,740 --> 01:17:22,640
Is frank here?

1102
01:17:22,640 --> 01:17:23,400
Frank?

1103
01:17:23,760 --> 01:17:24,620
frank?

1104
01:17:25,540 --> 01:17:26,980
Frank is not here.

1105
01:17:27,260 --> 01:17:34,180
But he said to us it's okay if We show some of the stuff that we've done on there.

1106
01:17:34,180 --> 01:17:35,500
So i'm going to put in the ea.

1107
01:17:35,500 --> 01:17:36,940
You know ea, ea sports.

1108
01:17:36,940 --> 01:17:38,100
It's in the game.

1109
01:17:42,680 --> 01:17:43,380
Okay.

1110
01:17:43,380 --> 01:17:47,960
We're going to quickly go through there, see how that Works.

1111
01:17:48,740 --> 01:17:51,420
It's actually works quite nice.

1112
01:17:55,590 --> 01:17:56,170
Okay.

1113
01:17:56,170 --> 01:18:03,490
So there you can see some Burnout3.Ea and earth and beyond.Ea.Com.

1114
01:18:03,650 --> 01:18:07,490
And freedomfighters.Ea.Com.

1115
01:18:07,490 --> 01:18:10,030
Those are all subdomains that Actually belong to them.

1116
01:18:10,150 --> 01:18:12,570
And it's just adding to the list As we go along.

1117
01:18:12,670 --> 01:18:17,510
It's actually a uefa Championsleaguegame.Ea.Com.

1118
01:18:18,010 --> 01:18:20,890
Once we have this stuff, i'm Not going to go through all of this.

1119
01:18:21,170 --> 01:18:23,810
It's going to take a while to finish this up.

1120
01:18:23,810 --> 01:18:26,310
Takes about five minutes to run through one of these domains.

1121
01:18:26,770 --> 01:18:27,350
Okay.

1122
01:18:27,390 --> 01:18:29,070
We can go to the forwards.

1123
01:18:30,190 --> 01:18:35,170
And basically just do this mouse is not working on this.

1124
01:18:35,170 --> 01:18:39,370
Come back here to import, right?

1125
01:18:39,770 --> 01:18:44,230
and then we're going to start Looking at the dns information at the forwards, right?

1126
01:18:44,230 --> 01:18:45,750
So those are what you see there.

1127
01:18:45,750 --> 01:18:47,150
You can't see them, right?

1128
01:18:47,150 --> 01:18:52,010
Let me just um... those are the mx records and The ns records.

1129
01:18:52,690 --> 01:19:01,810
And as we go through there, we Basically find trip w, obviously, ftp1, ftp, mail.

1130
01:19:03,270 --> 01:19:04,770
No, no, no, no, no, no.

1131
01:19:06,530 --> 01:19:06,970
Okay.

1132
01:19:06,970 --> 01:19:09,770
Next one we find, i'm going to move over to the next tab.

1133
01:19:12,450 --> 01:19:16,370
Testing for cisco e-commerce.

1134
01:19:16,650 --> 01:19:17,190
There we go.

1135
01:19:17,190 --> 01:19:19,070
Corporate.Ea.Com.

1136
01:19:19,850 --> 01:19:22,170
And it's actually got two ip Addresses.

1137
01:19:22,710 --> 01:19:24,270
So i'm going to stop it over There .

1138
01:19:25,410 --> 01:19:28,470
I'm going to go to the net Blocks, import the net blocks there.

1139
01:19:29,210 --> 01:19:32,210
I'm not going to spend a whole lot of time on the net block Definitions.

1140
01:19:32,450 --> 01:19:35,350
You can see they've got a class b Network, right?

1141
01:19:35,670 --> 01:19:38,810
if i get the who's information On this, it will tell me so.

1142
01:19:44,370 --> 01:19:46,610
And, of course, you can do this For any domain, right?

1143
01:19:46,610 --> 01:19:47,110
there we go.

1144
01:19:47,150 --> 01:19:48,170
Electronic arts.

1145
01:19:48,770 --> 01:19:49,990
You can see that it's a class b.

1146
01:19:49,990 --> 01:19:51,770
I'm not going to make it a class b now.

1147
01:19:51,890 --> 01:19:53,190
I'm just going to keep it there.

1148
01:19:54,010 --> 01:19:55,430
Import it there.

1149
01:19:55,430 --> 01:19:57,490
Here's our matching filters That we've got.

1150
01:19:57,790 --> 01:20:01,590
I want to change all of those Matching filters just to be ea.Com.

1151
01:20:04,460 --> 01:20:05,160
Okay.

1152
01:20:05,160 --> 01:20:08,420
And we're doing multi-threaded, 25 Threads at a time.

1153
01:20:09,020 --> 01:20:10,120
Reverse scan.

1154
01:20:10,120 --> 01:20:20,400
There we've got smtp-eu1.Ea.Com, which is your, i Think it's the european smtp gateway.

1155
01:20:21,080 --> 01:20:22,100
Okay.

1156
01:20:23,160 --> 01:20:24,720
You get the idea, right?

1157
01:20:24,720 --> 01:20:34,480
With them, it's really interesting when you start Looking at the reverses because in the reverse of some of these Blocks, you would find that they have a whole lot of domains.

1158
01:20:35,340 --> 01:20:38,540
For just about every game that they make, they have a domain For it.

1159
01:20:38,900 --> 01:20:45,040
And they have reverse dns Entries that points to those ip address, from those ip Addresses that point outwards.

1160
01:20:45,240 --> 01:20:46,560
So you can get a whole lot of Domains.

1161
01:20:46,560 --> 01:20:48,780
I've collected all of the Information earlier.

1162
01:20:49,040 --> 01:20:53,340
I'll show you the full, you Know, the complete, what the complete thing looks like.

1163
01:20:53,340 --> 01:20:54,280
Okay.

1164
01:20:54,280 --> 01:20:56,560
So let's just stop this here.

1165
01:20:57,100 --> 01:20:58,580
We go to the port scanner.

1166
01:20:58,660 --> 01:21:00,820
Basically import that stuff Straight in there.

1167
01:21:00,820 --> 01:21:01,800
Those are the blocks.

1168
01:21:01,860 --> 01:21:05,980
I promise you there's more blocks, but, you know, let's Keep it sweet and short for now.

1169
01:21:06,540 --> 01:21:07,900
I'm going to bind my driver.

1170
01:21:09,140 --> 01:21:11,140
I'm going to say use that interface.

1171
01:21:12,400 --> 01:21:14,660
And let's see what ports do you want to scan.

1172
01:21:14,660 --> 01:21:16,480
I'm not going to scan a whole lot of ports.

1173
01:21:16,620 --> 01:21:20,200
Let's just do 443, 80 and 25.

1174
01:21:20,860 --> 01:21:21,840
See how it works.

1175
01:21:21,840 --> 01:21:23,440
Hopefully it will be good.

1176
01:21:23,660 --> 01:21:24,140
Okay.

1177
01:21:24,520 --> 01:21:28,260
You can see at the bottom the speed at which this thing is Scanning.

1178
01:21:29,180 --> 01:21:30,680
It's quite fast.

1179
01:21:38,080 --> 01:21:41,280
And those are the machines that's basically coming back to it.

1180
01:21:41,420 --> 01:21:43,300
You'll see there's some duplicates in there.

1181
01:21:43,560 --> 01:21:47,400
What happens is the machine, that fin that i'm sending out, i Was just kidding.

1182
01:21:47,400 --> 01:21:48,700
I'm not sending the fin.

1183
01:21:49,200 --> 01:21:51,580
So the machines respond a couple of times.

1184
01:21:51,980 --> 01:21:55,440
It's just something i still need to sort out.

1185
01:21:56,520 --> 01:21:57,300
Okay.

1186
01:21:57,300 --> 01:21:59,020
So there's a couple of 25s in There.

1187
01:21:59,020 --> 01:22:00,240
There's a 443.

1188
01:22:04,020 --> 01:22:07,960
And we're almost a third of the way in the port scan.

1189
01:22:09,880 --> 01:22:13,780
I'm not going to take your time looking at a progress bar.

1190
01:22:13,780 --> 01:22:14,840
So let's move on to the next one.

1191
01:22:14,840 --> 01:22:15,800
You get the idea.

1192
01:22:15,860 --> 01:22:18,480
You can go through all of these machines.

1193
01:22:18,480 --> 01:22:20,120
There's a couple of nice ones.

1194
01:22:20,960 --> 01:22:21,740
Okay.

1195
01:22:21,740 --> 01:22:23,200
There we go.

1196
01:22:23,200 --> 01:22:23,900
Okay.

1197
01:22:23,900 --> 01:22:26,300
That starts looking better and better.

1198
01:22:26,760 --> 01:22:27,040
Okay .

1199
01:22:27,040 --> 01:22:31,080
Let's just keep it running for a Little bit longer.

1200
01:22:32,520 --> 01:22:33,420
Okay.

1201
01:22:33,420 --> 01:22:34,980
And i'm going to stop it over there.

1202
01:22:34,980 --> 01:22:35,720
All right.

1203
01:22:35,720 --> 01:22:38,000
So let's pull it in from the Banners .

1204
01:22:38,440 --> 01:22:40,080
Basically do this.

1205
01:22:40,760 --> 01:22:43,060
We bind our driver again.

1206
01:22:43,080 --> 01:22:46,080
And we go to this one.

1207
01:22:46,580 --> 01:22:48,740
And let's do a scan.

1208
01:22:48,780 --> 01:22:51,320
And there you can see the Banners coming back in.

1209
01:22:51,880 --> 01:22:53,340
Kind of quick, right?

1210
01:22:54,540 --> 01:22:55,280
Okay.

1211
01:22:57,240 --> 01:22:58,960
We've already sent out the Packets.

1212
01:22:58,960 --> 01:23:01,300
These are just packets coming Back at this stage.

1213
01:23:03,980 --> 01:23:06,840
Got a 25-second wait for this Thing.

1214
01:23:08,780 --> 01:23:12,280
And there's not a lot more Coming back at this stage, right?

1215
01:23:12,640 --> 01:23:16,300
So already at this stage what i can do is i can go to the Targeting.

1216
01:23:16,380 --> 01:23:17,940
I can update the tree.

1217
01:23:17,940 --> 01:23:20,720
I can say, well, i want to find apache boxes.

1218
01:23:21,540 --> 01:23:22,040
Okay.

1219
01:23:22,040 --> 01:23:23,120
Search the tree.

1220
01:23:24,100 --> 01:23:25,760
And make those targets.

1221
01:23:25,760 --> 01:23:29,080
Those are the apache boxes in That range that we scanned, right?

1222
01:23:29,080 --> 01:23:29,880
Not a lot.

1223
01:23:30,800 --> 01:23:33,240
I wonder if there's any Microsoft boxes in there.

1224
01:23:33,240 --> 01:23:34,320
Clear the selection.

1225
01:23:38,560 --> 01:23:41,280
It says microsoft is in the banner, right?

1226
01:23:41,880 --> 01:23:43,380
I think so, yeah.

1227
01:23:43,680 --> 01:23:44,600
Clear the selection.

1228
01:23:44,600 --> 01:23:45,220
Search.

1229
01:23:45,220 --> 01:23:46,400
We've got some.

1230
01:23:46,760 --> 01:23:47,980
Make them targets.

1231
01:23:47,980 --> 01:23:48,460
There we go.

1232
01:23:48,460 --> 01:23:51,040
Those are the microsoft boxes in that network.

1233
01:23:51,360 --> 01:23:53,660
How long did it take me to get that information?

1234
01:23:53,860 --> 01:23:55,000
What, three minutes?

1235
01:23:55,380 --> 01:23:56,060
okay.

1236
01:23:56,200 --> 01:23:58,140
We can go into the nasa scan.

1237
01:24:04,420 --> 01:24:05,500
Maybe not.

1238
01:24:05,500 --> 01:24:07,440
Maybe some other day.

1239
01:24:10,280 --> 01:24:11,080
No.

1240
01:24:11,360 --> 01:24:12,200
No, no, no, no.

1241
01:24:12,200 --> 01:24:13,600
It's not all in the game.

1242
01:24:16,580 --> 01:24:17,120
Okay.

1243
01:24:17,120 --> 01:24:18,220
I thank you very much.

1244
01:24:18,220 --> 01:24:20,240
And you've still got 20 minutes to catch the next talk.

1245
01:24:20,240 --> 01:24:20,700
Thanks.