Okay, the line has trickled to a slow speed, so we're going to get started.
One quick announcement to remind you all of.
Photographs of the speakers are with their permissions.
Photographs of the audience, not allowed.
If we find you doing it, you will be removed.
And with that, SensPost and Rulof.
Hello, hello.
Okay, let's see.
Just a couple of things before we start.
I'm going to try speaking to the mic the whole time.
Kind of, you know, maybe do it like this.
Like that. Okay.
Let's see. Okay, before we begin, most of
The stuff you can find at that url over there.
That's just for, you know, if we don't get through all of this, i
Think we would, because we've got a double session, so there
Shouldn't be a problem, but if you want to write that down,
That's where you can find the tool that we'll be showing
Today. Then also at amsterdam, we
Actually made a promise that we would release a web application
Scanner that is also available for download at the url on the
Screen. In terms of time considerations,
There's a lot that we must cover. We're basically going to go
Through the presentation, and then afterwards, we're going to
Do a bit of a live demo. We're having issues with the
Wireless at the moment, but hopefully by that time, it
Should be sorted out, so then we can go through a bit of live
Demo on this thing. Just something to start off
With, you know, there's a lot of shows that you can go see here
In vegas. I've heard that, you know,
Humanity is quite good, and elton john, and dan
Kaminsky. So this is a presentation.
There won't be any drinking on the stage.
And it's not a show. So basically, let me give you
Introduction. Let me just quickly, like,
Briefly tell you about sense post. We're a company of about 15 people in
South africa. We do external, internal
Assessments, color penetration testing. We've done it for the last five
Years. We've been talking at black hat
For the last four years in defcon.
And in our work, what we basically do, amongst other
Things, is we break into networks. We train as well.
We do training at black hat. We've trained a record amount of
People this year at black hat. And we train them using, basically
Tell them about a methodology that we use to break into
Networks from the internet. This is not for internal.
It's from over the internet. And so we're pretty sure that our
Methodology kind of works. It seems to be working.
We've seen the insides of more internal networks than we kind of
Care to see. So what we've done is we've
Basically said this methodology that we have, let's see how much
Of this can be automated. So the idea was to basically
Take every step of the way and check if that step can be
Automated and to what kind of level of accuracy it can be
Automated so that by the end of the day, hopefully most of the
Stuff that we have to do manually, we can now do
Automatically. So the talk is really about the
Methodology itself, which parts of the methodology can be
Automated, where it really works well and where it really breaks
Down badly. And when it breaks down badly,
Why it actually breaks down badly.
And at the end, we're going to quickly talk about some
Implications that this tool will have for, you know, the more
Mediocre pen testers out there. Because i guess there's a couple
Of those. Okay. So in order to automate
Something, if you want to automate something, you need to
Code it, right? you need to be able to write it
Down and code it. And to code it, you need to
Have some kind of algorithm. And in order to have an
Algorithm, you need to really, really understand what it is
That you're trying to do. I find a lot of people that
Starting to write code for something that they don't
Understand yet. So the idea is never really that
The coding should take a lot of the time.
The idea would be that understanding the process that
You're trying to do would be taking the time.
And having done hundreds and hundreds of assessments, we kind
Of know what it is that we want to do.
It's not just a question of coding it.
With anything that you automate, if you can write it
Down on a piece of paper in a kind of a flow chart, and you
Know exactly what it is that you're writing down, and the
Flow chart works, then you can code it, right?
Then it's just a question of saying we have to take this
Stuff and then write it in code. The problem comes in with
Automation is when there's exceptions.
So the situation might be we can do this in this case.
But, you know, one out of a thousand times, the result is
Going to look a little bit different.
And if you still want to automate it, you need to make
Sure that you're catching that exception.
So as soon as, and you will see this during the talk, as soon
As there's exceptions and as soon as there's something that
We don't really understand how it's working, or we have to
Make, we have to see how many different exceptions there are
And have to write a piece of code or a code path for all of
Those different exceptions, it becomes very, very difficult to do.
Okay? now, the trade-off there is that
If you have something that works 99.9 of the time and it's
Going to take you a year to code the code path for the
Exception, then you kind of live with it and you say it's
Okay, we can live with this exception, we know that it
Occurs, and it's not necessarily a bad thing, we can
Maybe fix it manually afterwards.
So there's a couple of weird perceptions in the industry
Today, and you will find it at this conference, it would be
The best place to find that kind of weird perception.
And if you talk to anyone, just about anyone in this
Conference, they would tell you that unix is good and windows
Is bad, right? and then afterwards, you should
Make a kind of sheep noise, because, you know, if
Everybody says windows is good, unix is good and windows is
Bad, then it must be, right? you will also see that a lot of
People say that the problem with windows is that we have this
Gooey apps that are running on windows, and with gooey apps,
You can't really do a thing, because, you know, it's kind of
A black box, and you don't have the flexibility that you have
With unix tools. What i'm saying is, it really
Depends on who's writing that gooey application, because you
Can still have a gooey application and still have
Flexibility, the same kind of flexibility that you would have
On a unix. I don't want to go into this
Too much, because i'm thinking people are going to assault me
After this. I can see angry faces in the
Crowd. Okay? but there's really a
Perception out there that says, if something has a gooey
Application, and i guess that's the fault that a lot of people
That write applications is doing, is saying, as soon as we
Stick a gooey on top of this thing, we need to dumb the
Application down, because we think that people that are using
Gooey tools are stupid. And so because we're now
Catering for a crowd of people that's stupid, we need to have
Our gooey really point and click and go.
And it's really not the case. You can still build a gooey that
Is very flexible and that has lots of potential to play with,
If you assume that your users are not stupid.
And it's something that we've done in the tool that i'm going
To show you. We've basically written the
Tool in such a way that everything that's input and
Output goes into a text box. So at any time, what you can do
Is you can select the whole text box and copy it into your
Unix system and do your whole grip and set and all the nice
Things that we like about unix. You don't have to export it in
Some kind of a weird format and try to convert it into text and
Then you can work with it. The other thing is that the text
Boxes are hot, which means if you make a change in that text
Box, that's a change that you've made to your data set.
You don't have to write some kind of a sql statement in order
To update this stuff somewhere within a database.
That's totally database-less. Right.
Now, the tool's name is called bdblah, right?
Yeah, bdblah, as in blah, blah, blah, bdblah.
And the tool that we written is really used for doing large-scale
Assessments. Now, just a quick note on
Assessment. If you're putting your domain
In this tool, then this tool is doing an assessment.
If you're putting someone else's domain in this tool, then
You're doing an attack. So an attack and assessment is
Kind of, you know, it really, when i'm doing this at black
Hat, i'm saying this is an assessment tool.
And when i'm doing it at defcon, i can tell you that you can
Also use it as an attack tool. Right.
Now, it's built to actually look to do assessments, okay, on
Very large networks. The problem for demoing this
Thing at a conference like this is that sense post does not have
A very large network. Our clients, they have large
Networks. But they won't appreciate it if
We start showing the data on the screen at defcon, right?
So what we're doing here is we're going to do some passive
Work, which is totally passive. We're not sending any packets to
The network. Well, not a lot.
It's not an attack at all. No, generally, it's not a, you
Will see, it's not like we're attacking anything.
But we're going to do some passive work against just the
IBM dns space, and we're going to do some passive work against
Playboy, just because i thought, you know, if we get any results,
It might be interesting to verify it.
And then when we go active, we're going to look at the
Sense post network, even if it's small.
Keep in mind that, you know, it's a small network.
You can do the same thing on a large network.
And when we really go into attacking boxes and owning them,
We'll be having a vmware server that we look at.
Now, the problem with this stuff is there's a lot of risk in
Doing this live. Okay?
Because networks change all the time, and there might just be a
Situation that when we did the scan yesterday, everything was
Cool, but today there's a vulnerability on the machine.
So we're not going to do it. Well, we might afterwards do
Some stuff live. We'll see how it goes in terms
Of time as well. But when we do stuff live, you
Will know that we either have permission of the owners of that
Network, or it's on our own network, right?
So if there's any press in this room, i don't know if there's
Any press, please, after this talk, please don't write an
Article that says on stage, sense post attacked ibm and own
The network, because that is not the case.
We're not going to even try to do that.
Okay. So what we've done is in the
Things that in the pieces of demo that we have here, we've
Basically taken some video clips of that screen captures and put
It into a video. All of it is exactly the way
That it works, and there's no trickery involved.
However, sometimes we've paused the actual screen capture,
Because, you know, when you're doing a reverse scan on a class
B, that's going to take a while, and i don't want you to
Sit here and look at the screen for half an hour seeing how we're
Doing a reverse scan on a class b.
So for that stuff, we've paused it, and it's kind of time
Lapsed. But the rest of the stuff is
Absolutely real. There's no image manipulation
Done anyway. Right.
So with that out of the way, let's have a look and see what
Our external methodology looks like.
Now, the people, can i just see in the class here, who's been
On any of our boot camp classes at black cat?
Some hands. Okay.
Okay. Great stuff.
Now, if you're on the boot camp class at black cat, you will
Know this methodology quite well.
I'm not going to go into it too much, because, you know, that's
What the classes are there for. But basically it boils down to
This. We start doing a footprint.
From the footprint, we go on to a fingerprint.
From there, we do targeting of systems that we would like to
Attack. We then do vulnerability
Discovery. And the last step is we actually
Exploit those vulnerabilities to do penetration testing on the
Host, on the network itself. Now, these, all of these little
Blocks now break down into a whole lot of other sets of
Blocks. So we're going to start with
The footprinting. The footprinting can be
Broken down into six blocks. Okay.
The first block is we find the domains.
Now, it seems very silly, because you might think that if
You, let's say, attack, let's say you attack ibm, okay, then
The place to start is ibm.Com. Right.
And it's as easy as that. What you might not know is that
Large organizations can have up to 2,000, 3,000 different
Domains. And those domains all carry
Dns information that's pointing to ip addresses.
And those ip addresses sit within net blocks.
And those net blocks might contain machines that are
Vulnerable and that has access to the internal network or, you
Know, connected via vpn into the internal network.
So the idea is that we find as many domains as we can.
And then go to the next step, which is to find subdomains
Within those domains. And, again, finding subdomains
In a domain might seem at this stage very kind of silly.
But you'll see that it's actually quite interesting.
We then do forward dns entries. So we basically look for
Anything we can find within the forward zone.
We get net blocks. We start trimming those net
Blocks down to size. We might add other net blocks
Into those net blocks. Once we're done with our net
Blocks, the first round of definition of our net blocks,
We do a dns reverse scan of that particular block.
And that might lead to two things.
The first is we might find new domains coming out that we
Didn't know about. It almost always happens.
And we find that maybe our net blocks weren't defined so
Nicely. So we can redefine our net
Blocks at that stage if it needs to be redefined.
Once we have our net blocks nicely tied down, we can go to
The next step, which is vitality testing.
Vitality testing or vitality scanning.
The idea is you sit with a class b.
You're going to run an s scan against a class b?
I don't think so, right? The idea there is to find
Machines that are alive within a big network space so that we
Can do targeting on it in the next step and decide which of
Those machines within that big piece of space is interesting
To attack. Now, this footprinting
Methodology, these six blocks that are here can now be broken
Down into more blocks. Okay?
It's like, you know, what is it, russian dolls?
You keep taking out the dolls, it's the same thing over here.
Okay. So just to give you an overview
Of how this whole thing sits together, i've made this movie.
I've made this movie using visual and word.
So it's a little bit sucky, i know, but, you know.
So we start with the main domain.
From that domain we get subdomains.
From the subdomains we start doing forward lookups.
That's pointing to ip addresses, right?
Those are the little arrows at the end.
From that we start our first round of net block definitions.
It might be one ip big. It might be, you know, class c.
At this stage we actually don't know.
We do reverse entries. Reverse dns entries.
I'm just going to pause it over here.
That's the red lines. And from the reverse we can get
New domains, right, which might be related.
Or that could be totally unrelated.
This will help us to define our net blocks even nicer.
Make the net block definition even tighter.
As you can see here, we've now broken those net blocks into
Smaller blocks. Once we're done with that, we're
Going to go on and do vitality scanning.
Those are the little dots you see over there in the x's for
Closed ports. Once we have those machines
Within those networks defined, we can do a port scan on those
Machines to find out exactly what ports are open on each of
Those ip addresses. And once we have that, we can
Basically start doing vulnerability finding.
So there, for instance, we have the apache 132 chunk encoding
Problem that sits on one port, on one ip, within one network
That was given to us by one domain.
In this case, we're using one domain.
You can use as many domains as you wish.
Like i said, some of the big corporations have up to
Thousands of domains. So this is the picture.
This is the whole picture of the thing.
Let's see how it actually works.
So within the footprint, remember we went into this.
This is now the first block finding the domains.
I'm going to go into that. We haven't implemented this
Within this tool. And i'll tell you later on why
We haven't implemented this. It's one of those things where
There's lots of exceptions and it's not that easy to implement.
We started doing it. But it's not there yet.
So you won't see it within this tool.
For the subdomain mining, what we basically do is we start
Off with a domain itself. Now, let me ask you this.
If you google for ibm, let's take ibm as an example.
And please, again, i've got nothing against them.
If you google for ibm, yeah, i'm using an ibm notebook.
Come on. If you google ibm, okay, you're
Going to find a whole lot of hits, right, that points to
Machines that's sitting on a domain ibm.Com.
So, for instance, one of the links that you might get is
Something coming off a site called tripwchess.Ibm.Com.
Not chest, no. Chess, right?
Okay. And what do we know from that?
We know there's a subdomain called chess.Ibm.Com, right?
And as we go along, we can google for different kind of
Common words and look if it's related, if it is within the
Ibm.Com domain, and using google, we can basically pull
Out a whole list of subdomains. We can also pull out a whole
Lot of domains itself, a whole lot of dns names itself,
Because if something resides on tripwchess.Ibm.Com, then we
Know that tripwchess.Ibm.Com exists, which gives us one
Forward entry in our table of maybe lots of forward entries
That we're going to pick up later. Everybody's cool with that, right?
So let's see how it is actually done. Sorry, if you want to have
More information about that, you should attend johnny long's
Talk. He's doing a whole section on
Subdomain mining. He's right there.
Okay. So let's see how it works.
Now, it normally takes about five minutes per domain to get
Subdomains, and this is at the moment set to only look at the
First three pages that google returns, right?
So we can set it to return as many pages, but the kind of 80-20
Principles at work here, we find 80% of the hits within 20% of
The time, okay? so doing three pages is just
About okay. And we've got a couple of
Keywords that we can combine the search with.
So i don't know if you can see there at the back.
What we're going to do is i'm going to start playing this
Video. So we enter ibm.Com in there
And we hit the start button. And now the tool is basically
Through the google api querying google.
We also get e-mail addresses. So, for instance, there you
Have no one, no one at us.Ibm.Com, and from that, we
Obviously know that there's a subdomain called usa.Ibm.Com.
When this tool is done, this is obviously time lapsed.
You'll see on the right-hand side, we have a whole list of
Subdomains. Uk.Ibm.Com, us.
Watson.Ibm.Chess and so forth and so on, okay?
And while this might not look so interesting on ibm.Com, we
Might afterwards show you an example that is more
Interesting, okay? so basically what we have now
Is we have the subdomains, right?
We have the domains and we have the subdomains.
And what we want to do is we want to find all the forward
Entries that we can possibly find, right?
So hang on a bit. What do you think would be
The first step to check for when we're doing, when we're
Finding forward dns entries? what would be the first thing
That we would see if this is possible on the domain?
Anyone? anyone? okay.
Hang on a bit. Where's our t-shirts?
Do we have t-shirts? let's see again.
What would be the first thing that you do when you have a
Domain and you want to find all the forward entries in the
Domain? yes, sir.
Sorry? no.
Who said zone transfer? there you go.
Okay. So the first thing that we're
Going to do is we're going to attempt to do a zone transfer,
Right? why?
Because if we can transfer the zone, we get all the
Information in the zone in one go.
We don't have to mine for any dns data.
We get the entire zone. So the first thing we're going
To do is we're basically going to check for mx records and ns
Records and then we're going to see if a zone transfer is
Possible. Where's my handy laser pointer?
If a zone transfer is possible, we immediately have all the
Forwards within that list. The next thing we want to do if a
Zone transfer is not possible, which is most likely the case,
We're basically going to go through a hit list.
I'll explain that just now. And from the hit list, we're
Going to perform the forward and that's going to drop us into
This container over there. Now, the hit list works like
This, right? if you see that a machine
Exists with the name of gandalf.Ibm.Com, what's the
Chances that there will be a machine called frodo.Ibm.Com?
Pretty good, right? so the idea what we're doing
There is we're building a whole lot of lists, right, of things
Like we have colors, we have animals, we have characters out
Of lords of the rings, we have characters from hitchhiker's
Guide to the galaxy, terry pratchett books, we have names
Out of the bible and so forth and so on.
And basically we test for four entries, it's configurable, but
We test for four entries within that list.
That list is sorted from the more popular names at the
Beginning. And we basically check if one
Of those names exists and if they do exist, we check the
Whole list, okay? so it gives us a way of
Finding out what kind of naming scheme these people are using,
Using only four dns entries, dns queries, right?
Because they're not going to have some kind of a weird name
Out of lords of the rings and not have gandalf, right?
They would have gandalf or frodo.
So let's see how this works. Now, for this, we've done it on
Playboy, okay? and we've now started with
Doing the subdomains. In the case of playboy, we
Only find two subdomains called casino.playboy.com and
Playboynet.playboy.com. And what we're going to do is
We're going to go on to the forwards, okay?
When we click there, we can basically import the stuff from
The previous section, okay? what you see there, sorry, i
Missed this. Let's just pause it here.
Can you see that at the back at all? probably not, right?
Can you see at the back, people at the back, can you see the
Actual lettering there? no?
Dude, i'm sorry. No, i can't make it any larger.
Okay, i can, but then, you know, that means rewriting the
App for another font in that window there, okay?
So basically what you see over there, just trust me on this,
Okay? i'm not lying.
And the people in front can verify.
So what you're seeing there at that part of the screen over
There is entries that we've already found with the google
Search, right? those are already forward
Entries that we found with the google search.
So they exist. So now we're going to add to
It. Let's just see if i can, okay?
And i'm going to click on import, right?
And we get our list over there of things that we have.
Fruit, e-commerce, colors, names, music, all of that.
And immediately when we do that, we start getting results.
Now, those results there, i know you can't see it even if
You're sitting in the front, those are the mx records and
The ns records, okay? it's just in a different color.
But we basically, here at the bottom, you'll see that we're
Starting to check forward entries, right?
And we already got ftp, we got content.playboy.com, which,
You know, i don't know, it could be interesting.
And at this stage, i've basically stopped it and let it
Run through. The capture, i stopped the
Capture. So you see there the end of
The entire capture. You get machines like secure
2.Playboy.com, it's all kind of interesting.
The other thing that we can do is we can add at the end of a
Forward, we basically add some fuzzing strings, okay?
So when we test, for instance, ftp, we also test for ftp1 and
Ftp2 and ftp-1 and ftp-2. And you can have as many as you
Want, right? at the moment we were just
Testing dash 1, dash 2, 1 and 2, okay?
But it's basically kind of fuzzing the dns out.
So what we have after this is we can collect all of the dns
Forward entries that we can possibly get from a domain, we
Can collect them in that text field on the right-hand side.
Ah, shit. Okay.
So the next step that we want to do is we basically want to
Look at net blocks, okay? now, the idea is the first thing
We can do is we can take all of those ip addresses that we had,
Right? and we can slice off the last
Digit from them and assume they're all class c's and start
Off with a class c definition, right?
Okay, we're going to start doing that.
Absolutely. You're absolutely correct.
So we're going to start by that. We've got to start somewhere.
You're absolutely correct. So you'll see.
Okay. And what we're going to do is
We're going to add into that, see what the who's definition is
Of that block to see if we can get the net block out of there.
We're going to look at additional blocks like from
And all of those wonderful places.
But you'll see how that is also difficult to do.
We're going to look at reverse dns entries to find out if the
Blocks are at the correct boundaries.
And another technique that we were looking at is to basically
Find the as number of the root connected to that particular ip
Address, then put that as number back in and see what other
Roots are within the same as. Okay?
And we'll talk about what the challenges are in that.
So let's just look what happened to playboy.
I'm going to start playing this thing again.
All right. So we go to the next step.
We do import, right? and at this stage, the tool
Will tell you this will import from the forwards and assume
Class c blocks, it might be a dangerous assumption.
All right. Okay.
So that's a start. And we see all of those 216s in
There. They kind of look as if they
Belong together. When you click on it, you
Basically get all the forwards that sit within that block.
Okay. Let's see.
Okay. So there's a lot of the playboy
Stuff coming, ftp, help. And we can click on the who's
Button and basically get the who's information for that
Block. And we see that, okay, that is
Actually not a class c, but it's a couple of them.
I think it's about, what, 16 class c's.
And then we can simply change our block definition over there
And say, okay, it's not from 36, it's from 128 all the way up
To 143. As soon as we do that, the
Other blocks that was there got kind of sucked into that list
Because they're, you know, inside of that network now.
Okay. In this case, you will see this
Machine is a name server, 244. And we can have our blocks even
One ip big. You know, we can have one ip,
We can have a class b, we can have a class a.
It really doesn't matter. We just change it to say that
That thing is now only one ip large.
Right. Okay.
What's interesting here is we did the forwards on, just want
To check if it's the case, we did the forwards on IBM as well.
So you can have a look and see what their net blocks look like.
You know, they got some crazy class bs out there.
Look at the size of that block. There's a couple of class bs in
There. Okay.
So the next thing we're going to do is we're going to do
Reverse dns scans. And the reverse dns scan looks
Kind of intimidating. It's actually quite easy.
We're going to start with the net blocks that we have at this
Stage. We're going to do a reverse
Dns entry on each of them. And then we're going to apply
Some filters and say if this thing is contained within that
Filter, okay, we say it's the match entry.
We can extract the domain from there.
See if the domain is already found in our list of domains
That we supplied. If it's not, we can add the
Domain. And if it doesn't match the
Filter, we say hang on a bit, here's a domain within that
Block that does not match your filter.
Maybe it's interesting to have a look and see what else is on
That domain. So let's see how this works.
Okay. There's the forwards.
It's now i.P. Sorted. You can go to the net blocks.
Those are the net blocks that we defined.
When we start the reverse, you'll see that it
Automatically puts in the filters a list of the domains
Because that's probably what you want to filter on.
In our case, we change it so that it only says playboy
Because maybe there's another playboy domain, playboypix.
And we want that filter to pick it up as well.
We start at the reverse now. You can see these are all the
Entries that we get back. These are domains.
There's playboyenterprise.com, for instance, that match the
Filter, but we don't have playboy enterprise as a domain.
So it's an additional domain that's a match domain that we
Want to put back into the system, right?
Now, this is not the speed at which it ran.
I kind of paused it a couple of times so you don't have to sit
Here the whole time looking at the thing running.
At the bottom, you see there's something called, what is it?
No, go down. Spicetv.com, right?
If we do a whois on spicetv.com, right, you will see that it is
Sitting at spiceentertainmentinc, and it's
Sitting somewhere in chicago. Note the address, okay?
Lake shore drive, chicago, and there's a phone number there.
So let's just have a look and see.
If we do a whois on playboy.com, what the contact information
Would be for them. And what do you know?
It is the same address. So spicetv and playboy is
Clearly related, right? they are the same company.
So in terms of putting new domains within your system to
Start scanning for more interesting domains and to
Start finding more ip addresses and more net blocks, you should
Be looking at spicetv.com as well.
So we can take that stuff, take out the subs in there, sort
Unique that, basically cut all of that stuff out.
You would see there's a bug in the program at this stage.
It's fixed in the release that we have now, whereby it didn't
Check for uppercase, lowercase. So playboy.com uppercase was
Still in the list of unmatched.
That's just too lower. And we can take all of that
Stuff and we can basically paste it back in here with the rest
Of our domains. See there, i take it out nicely.
Sort unique that. And we can start over again.
And that's why we have this kind of cyclical thing between the
Reverse and the forwards. Until those blocks that we
Scanned come out completely clean at the other end.
Okay. Now, the next step we want to
Do, when we're happy with our net block definitions, is we're
Going to find what machines are actually within those blocks
That we can attack. Correct?
Now, again, imagine that you're doing this on a very large
Organization and you've got, let's say, ibm with lots of
Class b's. You need to, well, they've got
Multiple class b's. You need something that's
Really fast, right? this is, it ain't going to work
If you're not scanning it really quick.
Now, there's three ways that we can find out if a machine is
Alive. We can do your normal icmp
Scan, of course. We can do udp scans, which is
A little bit more trickier. And we can do tcp scans.
And then we go for kind of a small list of ports.
And we only check for that. And sure, we're going to miss
Stuff, okay? but the more ports you test for,
The more it becomes a port scan on the entire range.
And the longer it's going to take.
So depending on your time here, you can either scan all the
Ports or you can scan for a very small subset and only find the
Machines that's alive on those ports.
Now, what we've done with the port scanning is basically
Implement a asynchronous port scanner.
And you've all seen this. It's been used now in many kind
Of tools. It basically works like this.
We send out a sin, right? we have a sniffer on the other
End. We check for the source port
Coming back. If it's a sinack, the port is
Open. If it's a reset, the port is
Closed. It's as easy as that.
So let's see how it works. This thing, and i know some of
The other scanners, i mean, check out the unicorn scan
Thing as well. I think they were speaking
Yesterday morning, right? they're doing the same thing,
But they're doing it distributed.
So it's even faster that way. But we can probably, you know,
Do one port in a class b in two minutes.
So if you're only scanning for one port, it's going to take
You about two minutes. We limit this thing so it only
Sends, you know, at the quickest it can send out packets
Every two milliseconds. Obviously you can do it faster
Than that if you implement it yourself.
Oops. Okay.
So let's just look at the whole process for sensepost.com
Because it's really quick. We go there, we find the
Forward entries. It's going really quick.
Okay. We're almost done.
Right. We take it into the net blocks.
What you will find is there's a 10, 15, 10 in there.
Which, i mean, it's not internal, but we use it for the
Training. So i'm taking that out
Because i'm not going to scan 10, 15, 10, right?
That's a little bit silly. And the other thing that's
Interesting here to note is, let me just pause this, is that
With service pack 2, xp service pack 2, microsoft actually
Disabled the use of raw socket sending, right?
Because they went through all the tools that uses raw socket
Sending and they were like bad, bad, bad, bad.
Let's not check the rest. They're all bad.
Okay. So they disabled it.
Which is a pity. So for us to be able to do
This on this level, we need to drop a level down and send
Those packets out on an ethernet layer.
And so there's a driver that actually that we use.
You've got to bind the driver and send the packets out that way.
It's a little bit more tricky, but it's not that much more
Tricky. Okay.
So basically these net blocks now come in from the previous
Step. We select what ports we want to
Scan. It's all configurable, of
Course. In this case, we go with 22,
23, 25, and 443. And we basically just start it
Up over here. The ports that are found open
Is listed on that side. Showing an o for open port.
Shows you the ip, shows you the port.
And it also shows you the ttl, which gives you a kind of idea
Of how far the machine is away from you.
Although, you know, some stacks send their packets out with the
Ttl of 128, others with other values.
So it's not that useful. But, you know, we put it in there
Now. You'll see as soon as we go into
The 72 network, things start to go a little bit quicker in there
Or we get more results coming back.
There we go. Okay.
Because there's lots of machines that's open on those ports.
And you'll see we paused it there.
So it's going to jump. Okay.
And that's basically doing the port scan.
Right? basically doing the port scan
On the net blocks and on the ports that we specified in the
Previous section. Okay.
All right. So if you look at the whole
Footprinting thing, it looks like this.
And you're not supposed to be able to read anything that's on
The screen. It's just to give you some
Idea of all the different steps and the complexity involved with
This whole thing. Okay.
We start off with a domain over there.
We end up with a whole list of ip numbers on that side.
We're doing whole lots of tricks in between to make it work.
Okay. So footprinting, it's over.
I know people don't like it. I dig it.
But it's not over. Right?
So within this thing, which steps are easy to automate and
Which steps are really difficult to automate?
The domain finding stuff is really difficult to automate.
Okay. We wrote a paper on this two
Years ago for black hat singapore. You can get it off the black hat site.
You can see the methods that we use there.
I know johnny is going to talk about some of those methods in
His talk as well. But it's difficult.
It's not nice. It's not a fun thing to do.
And at the moment, we don't do it.
You can learn a lot from the reverse entries like we found
On spice tv.Com. But we don't do this.
The subdomain finding, we got it.
It's cool. Forwards, no problem.
The net blocks, it's difficult. The as expansion technique that
We have there don't always work on small networks.
So, for instance, sense post has one class c.
But if you do a whois, if you look at the as that's
Basically attached to our net block, you would find that it
Belongs to the isp. And if you look at all the
Other routes within that as, you're going to get the net
Blocks for the isp, which is not necessarily what you want
To do, right? the other problem is that these
Registrars like LACNIC and APNIC and those guys, RIPE and
ARIN, don't have a way to search with a wild card for
Names and get back net blocks. I mean, you can do it on ARIN
And you can kind of do it on RIPE with a bit of trouble.
But you can't do it on LACNIC and you can't do it on
APNIC and you can't do it on any of the others.
You just can't do it. So you can't get more net
Block definitions from those guys.
The reverse scans, oh, and the other thing is the whois
Information is worthless on these small little networks,
right, because they don't have the actual person that is
The company that has that net block.
They only have the isp or something like that in there.
So that's useless as well. The reverse scans, that's
Easy. We can do it.
It's a no-brainer. The vitality stuff, easy.
At the moment we only got the TCP stuff, but doing the rest
Is really just an extension on that.
So why do you care about footprinting?
You know, because there's a difference between finding one
Vulnerability on one machine versus finding one machine
With one vulnerability. And I think actually Dan
Kaminsky had this point that he made in his talk last night
As well. It's easier finding one
Vulnerability on a whole lot of machines than finding one
Vulnerability on one machine. Okay.
So we've done with that, right? we've done with that first
Block. We're going to move on to
Fingerprinting. Now, fingerprinting, we
Actually want to do os detection, right?
We want to be able to see, say, that is a windows machine
Running windows 2000, service pack 3, whatever.
It's really difficult to do this from the internet on a
Machine that is tightly firewalled. Why?
It's not technically difficult. It's not only technically
Difficult, but it's conceptually difficult as well.
So if you have an apache machine, all right, that's
Protected with the firewall 1 running on windows, microsoft
Windows, with one-to-one net back to that apache box, that
Thing is going to report itself on a network level as a
Windows machine, right? because you're talking to the
Windows stack. But on application level, it's
Going to return itself back as a apache machine.
So not just is it difficult to find that stuff, it's also
Difficult to kind of decide which one will it be.
So with bdblah, we don't try to do os detection.
We don't even try to. What we do is we do banner
Scanning. And i know, i know, everybody
Tells me you can change the banner, but how many people
Actually is changing their banners? not a whole lot of
People are changing their banners, right?
So we're saying, okay, that's fine.
Let's just do banner scanning, let's see what we get.
And we do it asynchronously again.
And the asynchronous banner scanning stuff is quite cool.
You can do asynchronous banner scanning for any kind of
Banner. But the more complex it
Becomes in terms of negotiation, like ssl, for instance, the
More tricky it becomes to do it asynchronously.
So we've done it with the ssl stuff.
We've done it multithreaded. And with the rest of the stuff,
We did it with the other ports, we've done it asynchronously.
How does it work? okay.
Basically, the same way that we had a asynchronous port
Scanner, it works in the same way.
So we got a sniffer. We're sending sins on this
Sound. We have a sniffer that checks
The source port, right? normally, if the port is open,
It's going to come back with a sin.
So normally it's going to go into this thing.
It's going to get a sin. We've got to act that packet
Back. So we send an act.
We check if it's port 80 that we're testing.
It could be other ports as well.
And if it is, we send back a get
Http1.0. Now we're going to get an act
Back into this tree. If it's port 80, we extract it
From the http header. If it's not port 80, we simply
Extract the banner. Then it's a 25 or a 21 or any
Of those, right? and we have to close the
Session because otherwise our web servers are going to keep
On sending the stuff back. So we have to send a fin.
If there's a fin, we have to fin act that.
Now, who can tell me for a t-shirt, what is the thing
That's going to bite us? this works, but we have to do
Something else to make this work. Who can tell me what the
Problem is here? yes, sir?
Yeah. I think you're right, but we
Haven't seen a lot of that.
No, no, no, no, no, no. That's not the problem either.
Look, i mean, think about this. This stuff happens, right, on
User level. Doesn't happen through the
Kernel. Doesn't happen through the stack.
The stack doesn't know about this happening.
So we're sending out a fin, right?
No problem. Our stack can send it out.
Okay? so we get back a fin act.
Right? and now, what's my stack going to
Do? in comes a fin act packet.
Who said reset? thank you, sir.
So that's exactly the problem. Now, our fin act packet is
Coming back into our stack. Our stack says, hey, i don't
Know what you did. So the stack says, hey, hang on
A bit, here's a fin act coming back to me.
I never send out the fin. It doesn't know about that, so
It's going to reply with a reset.
So we've got to cut those resets off somewhere.
In this case, you can do it in an upstream firewall.
What we usually do is we, you know, we have a personal
Firewall on the machine. We cut the resets off there.
So there's no reset that your machine can send out.
Not reset coming back. Reset's going out.
Okay? this thing, this asynchronous
Banners, a grabber can really work very fast.
So we can do about 2,000 banners in three minutes that we can grab.
What i want to show you is how it actually works.
When we start out, we do the, we first do multi-threaded
Work on the hdps to get that, because we can do it
Asynchronously, but, hey, it's a lot of work.
So let's go on and see. So those are the port scans.
You go to the banners. You basically import that
Stuff in there. Okay.
Select the interface. Right.
We start, it's starting there at the bottom.
You can see it's starting on the ssl.
It's doing 15 threads at the same time to find the banners
For the ssl stuff. So that's not really fast.
Right. And you will see there's a delay
In there. The moment we're sending it out
At 302 milliseconds delay between packets.
But you can actually drop it off as, hang on, hang on, hang
On. Hang on.
Okay. You can drop it off as low as
You want to. Right.
You'll see there's additional weight in there.
That's basically, you know, those smtp servers when you
Connect to it, it doesn't do anything.
And it waits and waits and waits. And then finally you get the
Banner coming back. That's the time that we've got
To wait for those stuff coming back.
Now, what you will see here is i'm going to drop that delay
There down to 2 milliseconds. And what's interesting is note
The scroll bar on the right-hand side as i drop it.
Okay. Zip.
Okay. And those are all the banners
That we could get there. So it's kind of fast.
Okay. And now we're just waiting for
Other banners to come in if there's anything.
Okay. Cool. I'm going to go on.
Right. So this is what we do for
Banner scanning. What's the next step?
We want to be able to do targeting.
Now, the thing there is if you have a lot and lots and lots of
Potential targets, you want something that can easily say,
Oh, well, i want to identify everything that's running on
Port 22 and i want to only test against those.
Or i want to have only machines that have open ports within a
Certain net block and i want to test those.
Or you get the idea, right? so this is what the targeting
Stuff looks like. We basically have the banners
Now for everything. We can click on targeting and
We basically get our net blocks definitions in there.
We can drop down to those, see the machines that are in there.
The machines in there has either a dns name or reverse or
Forward or it's the mx record or it's the ns record for a domain
Or it has an open port. Once it's got an open port,
That's something that we would want to see in there, right?
A machine that's totally dead with no forward or reverse
Entries are kind of boring to us.
Machines with dns information or open ports are interesting to
Us and we can get the banners in there as well.
What's interesting about the banner scanning is if you get a
Reset coming from the host, what do you know?
You know that it's wrapped, right?
It's a tcp wrapped port. So it actually accepted the
Entire conversation and then it sent back a reset to close the
Connection afterwards. So we can do a search for
Instance for open ssl and we're going to get all the machines
That has a banner that contains the word open ssl in the banner.
And then we can just simply say, okay, make those targets.
I want to attack those machines with open ssl and immediately
Goes off to the target section. Okay, cool.
There we're doing a scan for machines on tcp 22.
Anything that's open on 22? all right.
So you see all the banners coming back there and i can
Again just say make those machines targets.
I want to attack it in the next stage.
Okay. I think we get the idea.
Right. So now we have our targets
Defined. Remember we went through the
Whole thing. We went through the whole thing.
At this stage we have the machines that we're going to
Attack. Okay.
We went through the targeting, all of that.
We have the machines that we want to attack.
Right. So what's the next step?
We want to do vulnerability discovery.
We're going to find what vulnerabilities are on these
Machines. So we're not going to write a
Vulnerability scanner because there's a lot of people that
Wrote vulnerability scanners. We're going to use something
That's really solid, we hope, and widely used, and that is
Nessus. So what we need to do is we
Need to write a nessus client. Okay.
We need to write a nessus client.
And what we want to do is we want to give the user the
Ability to select the plug-ins that he wants to use just as a
Normal nessus client and say, well, i want to test this
Particular bug. Okay.
Remember what i said previously. It's easier to find a single
Bug on a whole lot of machines than finding the one bug on one
Machine. So, for instance, if we want to
Check which machines on an entire class b has snmp
Community strings enabled, you know, we put one plug-in into
Nessus and we scan it across the whole class a and we find the
Stuff really quick. Okay.
So this is basically what we use for plug-in selection.
It's really easy. You can decide which plug-ins
You want to use. You can move them from the one
End to the other end and you can save that information afterwards.
It actually just saves the plug-in i.D. So you can have
Your list of plug-in i.D.s wherever you want to have it.
You can put it in a text file and you can use whatever kind of
Selector you want to basically select these plug-ins.
It's just a list of nessus plug-ins, right, i.D.s.
Afterwards we're going to save that and i can give it a name.
Those are the plug-in i.D.s on the left-hand side and i can call
That thing whatever i want. I'm going to call it black hat
Demo.PLG. That's a plug-in set.
You're going to see i'm going to use it later on.
So in the next step we actually want to now run vulnerability
Scans, right? we're going to run the nessus
Scan against our target on a particular plug-in set.
So there's the sense for stuff. There's the net blocks.
There's all the reverse entries. Click.
Yeah. There's the port scan.
The banners. And what we want to do now is
Run a nessus scan against those machines.
But we have to target them first. So i'm going to click on
Targeting and i'm going to say that first, you see that first
Class c over there? there's a couple of machines in
There. It's in our lab situation that
We want to scan, right? i can right-click on any of those
And say select it as a target or what i can do is i can
Simply say anything that's in that block that's got an open
Port, make it a target. So immediately i get a list of
Machines there. Those machines are now my
Because they're live, right? they responded to any of those scans.
And i go to the nessus tab over there and i basically import
Those by just clicking on the import button.
Okay. I select the set that i want to
Use. And i click on start.
Right. Now, with ntp, the nessus
Protocol, you have to get all the plug-ins.
You have to load the plug-ins before you can actually run the
Scan. It's kind of weird.
Even if you know exactly what plug-ins you want to use, you
Have to select, you have to get all the plug-in information
Coming back. Now, there you can see the
Scan is now running. It started with the port scan
As per normal on all those ip addresses.
You can set your nessus server up as you want to, to, you know,
Scan more machines at a time or more threads at a time or any of
That stuff at a time. It really depends on your nessus
Server how fast that scan is going to happen.
At any time, we can just click on the update tree button and we
Can see how far the scan has gone and what we've done there
And, you know, get the output back.
It's, you know, the same old, same old.
We've all seen this before. It's just a different flavor,
Different interface, but it's not doing anything else.
And it will tell you when the scan is done.
You can see there's still a bug there at the bottom as well.
We sorted that out as well. But i thought, you know, let me
Rather have the bug in there and you can see that it's really
Running and not a video recording somewhere.
It also now shows you the actual issues.
Right. Okay.
So let's move on. We've done the vulnerability discovery.
The only thing that's left to do is basically exploit those
Vulnerabilities, right? now, again, we don't want to
Reinvent the wheel here. So we have this thing talk to a
Nice exploitation framework, which is metasploit.
There's a couple of others as well.
But metasploit is quite neat. So what do we have to do?
We write a metasploit client. Now, the problem with
Metasploit, it's actually not a problem with metasploit, it's a
Problem with us, okay, is that it's very operating
Specific, which is this exploit will work against, you know,
Windows 2k service pack 2. We don't have that information,
Right? we don't have that kind of
Level of information about our targets.
If we were internal to the network, we can do funky stuff.
But we're not. We're external.
So we don't have the information. So what do we do is we select
The target number zero and we hope for the best.
Because a lot of the metasploit plug-ins actually does a brute
Force. So we don't have to supply it.
What else is it that we have to supply to metasploit?
We have to supply the remote port, right?
But the remote port we can pick up from the nasus scan.
Because let's say your server was running on, your web server
Was running on port 27, right? the nasus would pick it up as on
Port 27. And we have that port, right?
We know when stuff is ssl as well.
So we can specify in metasploit if it's got to use ssl or not.
And we have the local ip address as well.
If we have, if we're doing, for instance, a reverse shell.
Because that's our ip address. So most of the stuff we have.
The only thing that we don't have is we don't have a way to
Tie up a metasploit exploit with the nasus id, right?
So basically saying we use nasus to identify the weakness.
And we use metasploit to exploit it.
But how do you tie the two together?
So what we've done, where's gareth?
What gareth has done there, gareth phillips, right in front
Of the camera, he's been a week basically, you know, tying these
Two things up, saying here's a metasploit exploit, okay?
Is there a nasus plug-in that will identify this particular
Problem? and if he can find it, he
Basically writes it down in a little list.
Says this exploit, that plug-in. And if there's multiple plug-ins
For a specific exploit, he's got them listed there.
And if there's no nasus plug-in for the metasploit exploit,
That's, a, scary, right? and so, b, he would write some
Of them. So how many did we write?
We write about four, five. And i think at the moment, in
Terms of tying the stuff together, we need another 13 of
The 70, how many, 70? 78.
78 exploits. That was, you know, the
Adding to it the whole time. The rest of the stuff is pretty
Much mapped, okay? and what we're hoping to do,
And i'll beg hd for this, is to see if we can get it so
That when they write new exploits for metasploit, they
Include a nasus id in there. And if there's no nasus id,
Then they basically write a nasus check for it.
Because then we can just query, you know, the framework and get
The ids out of it dynamically, and we don't have to keep this
List. And we're not going to keep
This list current, okay? that's not what we do.
Okay. So let's see, let's see how it works.
Okay. So for this instance, we're
Looking at a vmware server, right?
We're not, this is just a vmware server.
Now, what's interesting here is, when we now do our nasus
Scan, right, why do we have to check for all the nasus ids?
We only check for the ones that's got related metasploit
Exploits, right? we check for those 72 minus
13 nasus ids that we already got.
So what i'm doing here is i'm basically running a nasus scan
Against the ip address and only using the, i'm only using the
List of nasus ids with related metasploit plug-ins.
And you can see it, it can do it rather quickly.
So there, it's done. And we found three issues.
You click on it, you'll basically see, it should be all
Red, right? the last one, i don't know,
It's a bug. Basically tells you these are
The three heavy issues that we found on this machine.
You can look at them. And when you go to metasploit,
What you do is you click on that little button over there,
And that loads the definitions in.
Hang on. That basically loads the
Definitions in that says this is the nasus id that matches with
This metasploit id. Once we have that, we can
Simply click on a thing that says find the matching target.
So now it will go through the entire nasus scan, right?
Of all the machines that we want to scan, and it's going to
Pick out the ones that has related metasploit ids and say
These are potential targets. If you run the metasploit exploit
Against this, you have a good chance that it's going to work.
And those are, that's obviously the same machine, right?
It's all the same machine. And there's identified four
Problems, four possible exploits that we can run against that machine.
We now have to configure our exploits.
So we're going to go for, which one is it, the decom one?
No. Yes.
It will tell you what the exploit is all about.
Now you've got to select what you want to do with that thing.
So you configure the exploit. Click.
And it basically dynamically queries the framework and tells
You for that exploit, these are the different payloads that you
Can have, right? that's the reverse.
And the stuff that you have to fill out, okay, the stuff that
You have to fill out, you can fill out, right?
The rest of the stuff is automatically populated with all
The information that we know at this stage.
Okay. So i'm going to bring up the
Vmware machine. There we go.
I've configured the rest of the exploits as well, but i didn't
Want to go through that. And you can save it as well.
And i start the metasploit framework on this side.
It could be sitting on any box, right, at this stage it's just
Sitting on your local machine. But you can have it speak to a
Metasploit framework on a remote machine as well.
And that's it. We click on start.
And now it's basically running those exploits against the machines.
Remember, those machines could be a whole lot of machines.
If you're scanning a large organization, again, you know,
Through the whole thing. Okay.
And when it's done, what we expect is that in the framework
We're going to have those shells.
And lo and behold, if you click on sessions, hey, there you go.
There's your shells. Okay.
And, you know, i think you all know what this looks like, right?
If you don't know, we're going to click on a session there just
So that you also see it's not bullshit.
Okay. You can do it.
All right. That's this metasploit.
Okay. Now, think about a large network.
Okay. Let's say you're even sitting
Internal on a network. Let me show you something.
This was done on an internal network.
I can't tell you who's network there.
I'm going to just load that data set in.
That's the one that says can't say who.
It's all text files. It saves it in text files.
Okay. This is the net blocks.
You check all the ten dot somethings in there.
And if we go to nesis, you'll find that there's lots of
Issues with these machines. A lot of them have the same
Issue, right? but some have some interesting
Issues in there, like dot printer and those kind of
Overflows. In metasploit, look at this.
Okay. If you click on matching
Targets, it's kind of funny.
That's worm territory, man. Okay.
So in a perfect world, sorry, yes.
Okay. Can we take this offline
Afterwards? okay.
So but i will speak to you. So are we done?
In a perfect world, we're done. In a perfect world, we're done.
And we, you know, we've done our assessment and this.
But if you're doing assessments, can i just see in this room
Here who actually has to write reports?
Aha. I thought so much.
So in a perfect world, you have to write reports.
You don't have to write reports. In a perfect world, there's no
False positives. Nowhere.
Nesis never makes a mistake. Well, guess what?
It does, right? and sometimes the stuff that
It gives you is just not relevant.
So what we've done is we have this thing.
To start off with, you know, within the nesis scan, you can
Mark something as a false positive, right?
If you really want to. And you can basically say mark
This as a false positive across the entire range of scans that
You've done. And you can comment on the
Stuff. And what's nice about this is
That when you go back to your targeting section, you can
Basically then go and say, well, let's find wherever i put that
Comment in. Or you can basically say, let's
Search all the machines that nesis croaked about on, i don't
Know, usable name server, for instance, right?
And i want to find those machines because those are the
Machines i need to attack or defend.
I need to patch these machines or i need to attack these
Machines, right? so you can very easily do
That kind of advanced targeting.
Supposed to be one. Okay?
And what's nice about this thing as well is the last tag on this
Thing basically does a lot of the reporting work for you,
Okay? so you have to write these
Things out for your boss. You have to give it out to a
Client. It would go a long, long way
To basically help you not to have to write that report.
The reason why we do this, the reason why we use this tool and
Develop this tool was that we use it internally, right?
And we want to spend our time doing interesting stuff.
Okay? we want to do the more
Interesting work of an assessment.
We don't want to spend time writing reports and basically
Having to copy and paste from a nesis report into a real report.
You know, that stuff, we want to play with the interesting stuff.
And that's why we have this particular, it's just going on
There, but i can't forward the video, actually.
There we go. There's the reporting.
I'm just doing the host tables now.
So basically we have all the information, right?
We have the forwards. We have the reverse.
We have the domains. We have the banners.
We have the open ports. We have the issues.
We have the severity of the issues. We have all of these things.
So we can basically take one host and build up a kind of a
Host table that says this is the entire machine.
This is what the machine looks like, right?
It's an mx record. It has this ip address.
It has these ports open. It has these banners.
Okay? and it has these nesis ids with
Whatever impact. And that happens all
Automatically because we don't want to do it.
All the comments that we put in there, if there's a comment that
We wanted to put in there, then that comment is also retained.
So you can see there it says analyst comment.
That's a comment that we put in there in the past.
It's really nice for banners as well.
So if you do banner scanning and then you sort by banner, you can
See immediately these are all my is5 machines or this is the
Target's is5 machines. This is the target's this.
All of those things come out quite neatly.
Okay. So what's the bottom line?
The bottom line is this tool is basically doing 80 of the work
In 20 of the time that it takes us to do.
Which leaves us with 80 of the time that we can play with more
Interesting things. Okay?
Some of the steps of the methodology is really hard to
Automate. And it's usually where there's
Exceptions. You know, there's exception to
The rule. Makes it very hard to automate.
Hopefully it will also raise the bar on people that, you know,
Do penetration. I'm a penetration testing
Specialist kind of dude. Because these things, i mean,
The report that you get out of this is just about the same
Report as these people are doing in a long, long, long time and
Charging a lot of money for it. So that's hopefully what we're
Going to get out of it. In terms of release of this
Tool, there's always a problem here, right?
We've got the gentleman in front that's going to tell me, you're
Not going to release this, right?
I mean, this is point and click, you know, weapons of mass
Destruction. You're not going to release it,
Right? and then we've got the other
Side, which i guess is the rest of the class.
That's saying, okay, where do we download it?
So we build this version, which is a cripple version.
It's only crippled in two ways. Okay?
It runs for 20 minutes, and you can't save your data.
The rest of the stuff is exactly the same.
Okay? i just want to see, harun, are
We do we have time left? how much time do we have left?
30 minutes? okay, what we're going to do
Now is we're going to play with it a bit and see how it works in
Real life, okay? keep in mind, we're doing it
Via the wireless, and the wireless is kind of, you know,
Flaky because of the fact that we kind of ride next door to
The wi-fi shootout room. So if it's not handling itself
Well, then you know why. Okay.
So this is what the tool looks like.
All right. It's a, the new release is a
Little bit more friendlier and so forth and so on.
Okay. So are we good?
Okay. Let's just see if i can get out
To the net. Okay.
As you can see, it's kind of, you know, yeah.
Okay. Okay.
So but let's give it a go. Okay.
So for subdomains, remember i told you subdomains,
Subdomains, but it actually gets really interesting.
So i want to put a domain in there.
So if you're from this organization, keep in mind that
We're only mining subdomains. We're not attacking your
Network. We're not going to go further
Than subdomains. Okay.
So i'm going to put in there a domain.
Right. I don't know if you can see
That. If you can't, remember, it's
Only subdomain mining. It's not anything else.
We're not attacking the network. We're not sending a single
Packet to that network. Okay.
And you can see that it's basically pulling down a whole
Lot of subdomains there. Okay.
Right. We got some interesting things
In there and e-mail addresses that we can mine as well if we
Want to use it for later use. Okay.
I'm going to stop this now. So let me just find the stop
Button. And then, of course, you can
Go to the forwards and you can simply input that and start
Doing all the forwards on that, which i'm not going to do.
Right. We actually have the permission
To look at some of the other network, good friends at
Electronic arts. Is frank here?
Frank? frank?
Frank is not here. But he said to us it's okay if
We show some of the stuff that we've done on there.
So i'm going to put in the ea. You know ea, ea sports.
It's in the game. Okay.
We're going to quickly go through there, see how that
Works. It's actually works quite nice.
Okay. So there you can see some
Burnout3.Ea and earth and beyond.Ea.Com.
And freedomfighters.Ea.Com. Those are all subdomains that
Actually belong to them. And it's just adding to the list
As we go along. It's actually a uefa
Championsleaguegame.Ea.Com. Once we have this stuff, i'm
Not going to go through all of this.
It's going to take a while to finish this up.
Takes about five minutes to run through one of these domains.
Okay. We can go to the forwards.
And basically just do this mouse is not working on this.
Come back here to import, right? and then we're going to start
Looking at the dns information at the forwards, right?
So those are what you see there. You can't see them, right?
Let me just um... those are the mx records and
The ns records. And as we go through there, we
Basically find trip w, obviously, ftp1, ftp, mail.
No, no, no, no, no, no. Okay.
Next one we find, i'm going to move over to the next tab.
Testing for cisco e-commerce. There we go.
Corporate.Ea.Com. And it's actually got two ip
Addresses. So i'm going to stop it over
There. I'm going to go to the net
Blocks, import the net blocks there.
I'm not going to spend a whole lot of time on the net block
Definitions. You can see they've got a class b
Network, right? if i get the who's information
On this, it will tell me so. And, of course, you can do this
For any domain, right? there we go.
Electronic arts. You can see that it's a class b.
I'm not going to make it a class b now.
I'm just going to keep it there.
Import it there. Here's our matching filters
That we've got. I want to change all of those
Matching filters just to be ea.Com.
Okay. And we're doing multi-threaded, 25
Threads at a time. Reverse scan.
There we've got smtp-eu1.Ea.Com, which is your, i
Think it's the european smtp gateway.
Okay. You get the idea, right?
With them, it's really interesting when you start
Looking at the reverses because in the reverse of some of these
Blocks, you would find that they have a whole lot of domains.
For just about every game that they make, they have a domain
For it. And they have reverse dns
Entries that points to those ip address, from those ip
Addresses that point outwards. So you can get a whole lot of
Domains. I've collected all of the
Information earlier. I'll show you the full, you
Know, the complete, what the complete thing looks like.
Okay. So let's just stop this here.
We go to the port scanner. Basically import that stuff
Straight in there. Those are the blocks.
I promise you there's more blocks, but, you know, let's
Keep it sweet and short for now. I'm going to bind my driver.
I'm going to say use that interface.
And let's see what ports do you want to scan.
I'm not going to scan a whole lot of ports.
Let's just do 443, 80 and 25. See how it works.
Hopefully it will be good. Okay.
You can see at the bottom the speed at which this thing is
Scanning. It's quite fast.
And those are the machines that's basically coming back to it.
You'll see there's some duplicates in there.
What happens is the machine, that fin that i'm sending out, i
Was just kidding. I'm not sending the fin.
So the machines respond a couple of times.
It's just something i still need to sort out.
Okay. So there's a couple of 25s in
There. There's a 443.
And we're almost a third of the way in the port scan.
I'm not going to take your time looking at a progress bar.
So let's move on to the next one. You get the idea.
You can go through all of these machines.
There's a couple of nice ones. Okay.
There we go. Okay.
That starts looking better and better.
Okay. Let's just keep it running for a
Little bit longer. Okay.
And i'm going to stop it over there.
All right. So let's pull it in from the
Banners. Basically do this.
We bind our driver again. And we go to this one.
And let's do a scan. And there you can see the
Banners coming back in. Kind of quick, right?
Okay. We've already sent out the
Packets. These are just packets coming
Back at this stage. Got a 25-second wait for this
Thing. And there's not a lot more
Coming back at this stage, right?
So already at this stage what i can do is i can go to the
Targeting. I can update the tree.
I can say, well, i want to find apache boxes.
Okay. Search the tree.
And make those targets. Those are the apache boxes in
That range that we scanned, right?
Not a lot. I wonder if there's any
Microsoft boxes in there. Clear the selection.
It says microsoft is in the banner, right?
I think so, yeah. Clear the selection.
Search. We've got some.
Make them targets. There we go.
Those are the microsoft boxes in that network.
How long did it take me to get that information?
What, three minutes? okay.
We can go into the nasa scan. Maybe not.
Maybe some other day. No.
No, no, no, no. It's not all in the game.
Okay. I thank you very much.
And you've still got 20 minutes to catch the next talk.
Thanks.