start	end	text
3770	8570	Okay, the line has trickled to a slow speed, so we're going to get started.
9250	11750	One quick announcement to remind you all of.
12050	14470	Photographs of the speakers are with their permissions.
14570	17550	Photographs of the audience, not allowed.
17550	20350	If we find you doing it, you will be removed.
20770	24010	And with that, SensPost and Rulof.
35280	37020	Hello, hello.
37740	39200	Okay, let's see.
39200	43540	Just a couple of things before we start.
43980	46460	I'm going to try speaking to the mic the whole time.
46640	50860	Kind of, you know, maybe do it like this.
52320	53880	Like that. Okay.
53900	58480	Let's see. Okay, before we begin, most of
58480	61420	The stuff you can find at that url over there.
61800	65740	That's just for, you know, if we don't get through all of this, i
65740	69540	Think we would, because we've got a double session, so there
69540	71780	Shouldn't be a problem, but if you want to write that down,
72500	74760	That's where you can find the tool that we'll be showing
74760	79060	Today. Then also at amsterdam, we
79060	83620	Actually made a promise that we would release a web application
83620	88720	Scanner that is also available for download at the url on the
88720	93100	Screen. In terms of time considerations,
93100	98120	There's a lot that we must cover. We're basically going to go
98120	102480	Through the presentation, and then afterwards, we're going to
102480	105520	Do a bit of a live demo. We're having issues with the
105520	107680	Wireless at the moment, but hopefully by that time, it
107680	111200	Should be sorted out, so then we can go through a bit of live
111200	116240	Demo on this thing. Just something to start off
116240	120580	With, you know, there's a lot of shows that you can go see here
120580	123420	In vegas. I've heard that, you know,
123420	129600	Humanity is quite good, and elton john, and dan
131280	137020	Kaminsky. So this is a presentation.
137020	139000	There won't be any drinking on the stage.
139980	145160	And it's not a show. So basically, let me give you
145160	149040	Introduction. Let me just quickly, like,
149040	152680	Briefly tell you about sense post. We're a company of about 15 people in
152680	155680	South africa. We do external, internal
156700	161180	Assessments, color penetration testing. We've done it for the last five
161180	165080	Years. We've been talking at black hat
165080	167660	For the last four years in defcon.
169040	172340	And in our work, what we basically do, amongst other
172340	177080	Things, is we break into networks. We train as well.
177080	180780	We do training at black hat. We've trained a record amount of
180780	186080	People this year at black hat. And we train them using, basically
186080	190500	Tell them about a methodology that we use to break into
190500	193700	Networks from the internet. This is not for internal.
193700	198900	It's from over the internet. And so we're pretty sure that our
198900	202480	Methodology kind of works. It seems to be working.
202480	206800	We've seen the insides of more internal networks than we kind of
206800	211380	Care to see. So what we've done is we've
211380	215440	Basically said this methodology that we have, let's see how much
215440	220140	Of this can be automated. So the idea was to basically
220140	225020	Take every step of the way and check if that step can be
225020	227740	Automated and to what kind of level of accuracy it can be
227740	231920	Automated so that by the end of the day, hopefully most of the
231920	234660	Stuff that we have to do manually, we can now do
234660	238860	Automatically. So the talk is really about the
239260	244200	Methodology itself, which parts of the methodology can be
244200	248160	Automated, where it really works well and where it really breaks
248160	252440	Down badly. And when it breaks down badly,
252440	255800	Why it actually breaks down badly.
256400	259180	And at the end, we're going to quickly talk about some
259180	263780	Implications that this tool will have for, you know, the more
263780	267980	Mediocre pen testers out there. Because i guess there's a couple
267980	273100	Of those. Okay. So in order to automate
273100	277700	Something, if you want to automate something, you need to
277700	279500	Code it, right? you need to be able to write it
279500	283800	Down and code it. And to code it, you need to
283800	288780	Have some kind of algorithm. And in order to have an
288780	292060	Algorithm, you need to really, really understand what it is
292060	294740	That you're trying to do. I find a lot of people that
294740	297680	Starting to write code for something that they don't
297680	301000	Understand yet. So the idea is never really that
301000	304800	The coding should take a lot of the time.
304800	307700	The idea would be that understanding the process that
307700	311700	You're trying to do would be taking the time.
312380	317280	And having done hundreds and hundreds of assessments, we kind
317280	320220	Of know what it is that we want to do.
320220	322280	It's not just a question of coding it.
324440	326980	With anything that you automate, if you can write it
326980	331360	Down on a piece of paper in a kind of a flow chart, and you
331360	334320	Know exactly what it is that you're writing down, and the
334320	337380	Flow chart works, then you can code it, right?
337380	339820	Then it's just a question of saying we have to take this
339820	344560	Stuff and then write it in code. The problem comes in with
344560	346880	Automation is when there's exceptions.
346880	351380	So the situation might be we can do this in this case.
351620	355040	But, you know, one out of a thousand times, the result is
355040	356560	Going to look a little bit different.
357240	359440	And if you still want to automate it, you need to make
359440	362360	Sure that you're catching that exception.
362500	365900	So as soon as, and you will see this during the talk, as soon
365900	368000	As there's exceptions and as soon as there's something that
368000	372560	We don't really understand how it's working, or we have to
372560	376660	Make, we have to see how many different exceptions there are
376660	380060	And have to write a piece of code or a code path for all of
380060	385080	Those different exceptions, it becomes very, very difficult to do.
385220	388360	Okay? now, the trade-off there is that
388360	394280	If you have something that works 99.9 of the time and it's
394280	397920	Going to take you a year to code the code path for the
397920	401040	Exception, then you kind of live with it and you say it's
401040	403580	Okay, we can live with this exception, we know that it
403580	406900	Occurs, and it's not necessarily a bad thing, we can
406900	408900	Maybe fix it manually afterwards.
412700	416020	So there's a couple of weird perceptions in the industry
416020	420660	Today, and you will find it at this conference, it would be
420660	424640	The best place to find that kind of weird perception.
425400	427620	And if you talk to anyone, just about anyone in this
427620	430960	Conference, they would tell you that unix is good and windows
430960	435100	Is bad, right? and then afterwards, you should
435100	438660	Make a kind of sheep noise, because, you know, if
438660	441900	Everybody says windows is good, unix is good and windows is
441900	446440	Bad, then it must be, right? you will also see that a lot of
446440	451020	People say that the problem with windows is that we have this
451740	455140	Gooey apps that are running on windows, and with gooey apps,
455140	457680	You can't really do a thing, because, you know, it's kind of
457680	461900	A black box, and you don't have the flexibility that you have
461900	466700	With unix tools. What i'm saying is, it really
466700	471000	Depends on who's writing that gooey application, because you
471000	473600	Can still have a gooey application and still have
473600	477000	Flexibility, the same kind of flexibility that you would have
477000	478640	On a unix. I don't want to go into this
478640	481940	Too much, because i'm thinking people are going to assault me
481940	485900	After this. I can see angry faces in the
485900	490180	Crowd. Okay? but there's really a
490180	495560	Perception out there that says, if something has a gooey
495560	499400	Application, and i guess that's the fault that a lot of people
499400	502500	That write applications is doing, is saying, as soon as we
502500	507060	Stick a gooey on top of this thing, we need to dumb the
507060	508900	Application down, because we think that people that are using
508900	512600	Gooey tools are stupid. And so because we're now
512600	515860	Catering for a crowd of people that's stupid, we need to have
515860	518780	Our gooey really point and click and go.
519100	523120	And it's really not the case. You can still build a gooey that
523120	527380	Is very flexible and that has lots of potential to play with,
528100	531000	If you assume that your users are not stupid.
531360	534840	And it's something that we've done in the tool that i'm going
534840	538260	To show you. We've basically written the
538260	541500	Tool in such a way that everything that's input and
541500	545560	Output goes into a text box. So at any time, what you can do
545560	549100	Is you can select the whole text box and copy it into your
549100	553860	Unix system and do your whole grip and set and all the nice
553860	557680	Things that we like about unix. You don't have to export it in
557680	562860	Some kind of a weird format and try to convert it into text and
562860	566660	Then you can work with it. The other thing is that the text
566660	571060	Boxes are hot, which means if you make a change in that text
571060	573840	Box, that's a change that you've made to your data set.
573840	577900	You don't have to write some kind of a sql statement in order
577900	582020	To update this stuff somewhere within a database.
582120	586220	That's totally database-less. Right.
586220	592080	Now, the tool's name is called bdblah, right?
592640	596300	Yeah, bdblah, as in blah, blah, blah, bdblah.
597020	601960	And the tool that we written is really used for doing large-scale
603160	606520	Assessments. Now, just a quick note on
606520	609860	Assessment. If you're putting your domain
609860	614600	In this tool, then this tool is doing an assessment.
614600	618460	If you're putting someone else's domain in this tool, then
618460	622320	You're doing an attack. So an attack and assessment is
622320	626320	Kind of, you know, it really, when i'm doing this at black
626320	629380	Hat, i'm saying this is an assessment tool.
629880	632820	And when i'm doing it at defcon, i can tell you that you can
632820	635320	Also use it as an attack tool. Right.
636360	643960	Now, it's built to actually look to do assessments, okay, on
643960	649440	Very large networks. The problem for demoing this
649440	653360	Thing at a conference like this is that sense post does not have
653360	658440	A very large network. Our clients, they have large
658440	662180	Networks. But they won't appreciate it if
662180	666380	We start showing the data on the screen at defcon, right?
668120	673240	So what we're doing here is we're going to do some passive
673240	676180	Work, which is totally passive. We're not sending any packets to
676180	678240	The network. Well, not a lot.
678640	683060	It's not an attack at all. No, generally, it's not a, you
683060	685460	Will see, it's not like we're attacking anything.
685780	689460	But we're going to do some passive work against just the
689460	693720	IBM dns space, and we're going to do some passive work against
694220	698340	Playboy, just because i thought, you know, if we get any results,
698340	700660	It might be interesting to verify it.
704580	709600	And then when we go active, we're going to look at the
709600	713760	Sense post network, even if it's small.
713760	716320	Keep in mind that, you know, it's a small network.
716320	718460	You can do the same thing on a large network.
718460	723520	And when we really go into attacking boxes and owning them,
724300	728160	We'll be having a vmware server that we look at.
729220	733720	Now, the problem with this stuff is there's a lot of risk in
733720	736920	Doing this live. Okay?
736920	741180	Because networks change all the time, and there might just be a
741180	744700	Situation that when we did the scan yesterday, everything was
744700	748120	Cool, but today there's a vulnerability on the machine.
748120	751980	So we're not going to do it. Well, we might afterwards do
751980	756240	Some stuff live. We'll see how it goes in terms
756240	760600	Of time as well. But when we do stuff live, you
760600	763620	Will know that we either have permission of the owners of that
763620	767200	Network, or it's on our own network, right?
767300	769720	So if there's any press in this room, i don't know if there's
769720	774440	Any press, please, after this talk, please don't write an
774440	778440	Article that says on stage, sense post attacked ibm and own
778440	781100	The network, because that is not the case.
781540	783760	We're not going to even try to do that.
783760	787000	Okay. So what we've done is in the
787000	792200	Things that in the pieces of demo that we have here, we've
792200	796500	Basically taken some video clips of that screen captures and put
796500	800820	It into a video. All of it is exactly the way
800820	803500	That it works, and there's no trickery involved.
803500	808880	However, sometimes we've paused the actual screen capture,
808880	811580	Because, you know, when you're doing a reverse scan on a class
811580	814300	B, that's going to take a while, and i don't want you to
814300	817020	Sit here and look at the screen for half an hour seeing how we're
817020	818820	Doing a reverse scan on a class b.
819400	822820	So for that stuff, we've paused it, and it's kind of time
822820	824280	Lapsed. But the rest of the stuff is
824280	826620	Absolutely real. There's no image manipulation
826620	829100	Done anyway. Right.
829100	833140	So with that out of the way, let's have a look and see what
833140	835280	Our external methodology looks like.
835280	838980	Now, the people, can i just see in the class here, who's been
838980	842300	On any of our boot camp classes at black cat?
843040	844760	Some hands. Okay.
845020	846540	Okay. Great stuff.
846540	851560	Now, if you're on the boot camp class at black cat, you will
851560	853520	Know this methodology quite well.
853520	856800	I'm not going to go into it too much, because, you know, that's
857360	860580	What the classes are there for. But basically it boils down to
860580	863060	This. We start doing a footprint.
863960	867940	From the footprint, we go on to a fingerprint.
867940	870900	From there, we do targeting of systems that we would like to
870900	873140	Attack. We then do vulnerability
873140	877480	Discovery. And the last step is we actually
877480	881600	Exploit those vulnerabilities to do penetration testing on the
881600	886060	Host, on the network itself. Now, these, all of these little
886060	890120	Blocks now break down into a whole lot of other sets of
890120	891500	Blocks. So we're going to start with
891500	895640	The footprinting. The footprinting can be
895640	899500	Broken down into six blocks. Okay.
899500	902020	The first block is we find the domains.
902020	906080	Now, it seems very silly, because you might think that if
906080	915160	You, let's say, attack, let's say you attack ibm, okay, then
915160	917740	The place to start is ibm.Com. Right.
917740	921260	And it's as easy as that. What you might not know is that
921260	925260	Large organizations can have up to 2,000, 3,000 different
925260	927580	Domains. And those domains all carry
928060	930540	Dns information that's pointing to ip addresses.
930540	933880	And those ip addresses sit within net blocks.
933980	936560	And those net blocks might contain machines that are
936560	941540	Vulnerable and that has access to the internal network or, you
941540	944280	Know, connected via vpn into the internal network.
944320	947200	So the idea is that we find as many domains as we can.
947200	950680	And then go to the next step, which is to find subdomains
950680	954260	Within those domains. And, again, finding subdomains
954260	958280	In a domain might seem at this stage very kind of silly.
958280	960700	But you'll see that it's actually quite interesting.
961240	964840	We then do forward dns entries. So we basically look for
964840	968560	Anything we can find within the forward zone.
968860	970940	We get net blocks. We start trimming those net
970940	974740	Blocks down to size. We might add other net blocks
974740	978200	Into those net blocks. Once we're done with our net
978200	981180	Blocks, the first round of definition of our net blocks,
981180	985660	We do a dns reverse scan of that particular block.
985960	987860	And that might lead to two things.
987860	991020	The first is we might find new domains coming out that we
991020	993680	Didn't know about. It almost always happens.
994800	999380	And we find that maybe our net blocks weren't defined so
999380	1001800	Nicely. So we can redefine our net
1001800	1004940	Blocks at that stage if it needs to be redefined.
1005380	1009020	Once we have our net blocks nicely tied down, we can go to
1009020	1012260	The next step, which is vitality testing.
1012320	1014640	Vitality testing or vitality scanning.
1014780	1016920	The idea is you sit with a class b.
1016920	1019460	You're going to run an s scan against a class b?
1019460	1022580	I don't think so, right? The idea there is to find
1022580	1027440	Machines that are alive within a big network space so that we
1027440	1030640	Can do targeting on it in the next step and decide which of
1030640	1034080	Those machines within that big piece of space is interesting
1034080	1038120	To attack. Now, this footprinting
1038120	1043220	Methodology, these six blocks that are here can now be broken
1043220	1046420	Down into more blocks. Okay?
1046420	1049380	It's like, you know, what is it, russian dolls?
1049840	1052680	You keep taking out the dolls, it's the same thing over here.
1055760	1058060	Okay. So just to give you an overview
1058060	1061600	Of how this whole thing sits together, i've made this movie.
1061740	1065160	I've made this movie using visual and word.
1065160	1069480	So it's a little bit sucky, i know, but, you know.
1071280	1073620	So we start with the main domain.
1073680	1076280	From that domain we get subdomains.
1076940	1079860	From the subdomains we start doing forward lookups.
1079860	1082260	That's pointing to ip addresses, right?
1082260	1084380	Those are the little arrows at the end.
1084900	1089260	From that we start our first round of net block definitions.
1089260	1094140	It might be one ip big. It might be, you know, class c.
1094140	1096720	At this stage we actually don't know.
1096880	1100180	We do reverse entries. Reverse dns entries.
1100180	1101240	I'm just going to pause it over here.
1101240	1104520	That's the red lines. And from the reverse we can get
1104520	1108060	New domains, right, which might be related.
1108060	1110280	Or that could be totally unrelated.
1112660	1117020	This will help us to define our net blocks even nicer.
1117360	1120300	Make the net block definition even tighter.
1120300	1123940	As you can see here, we've now broken those net blocks into
1123940	1127580	Smaller blocks. Once we're done with that, we're
1127580	1129900	Going to go on and do vitality scanning.
1129900	1133040	Those are the little dots you see over there in the x's for
1133040	1136380	Closed ports. Once we have those machines
1136380	1140240	Within those networks defined, we can do a port scan on those
1140240	1143820	Machines to find out exactly what ports are open on each of
1143820	1147640	Those ip addresses. And once we have that, we can
1147640	1151360	Basically start doing vulnerability finding.
1151360	1154880	So there, for instance, we have the apache 132 chunk encoding
1154880	1159860	Problem that sits on one port, on one ip, within one network
1159860	1162860	That was given to us by one domain.
1163280	1166220	In this case, we're using one domain.
1166260	1168100	You can use as many domains as you wish.
1168100	1170560	Like i said, some of the big corporations have up to
1171480	1174660	Thousands of domains. So this is the picture.
1174660	1176400	This is the whole picture of the thing.
1176400	1178200	Let's see how it actually works.
1179680	1184560	So within the footprint, remember we went into this.
1184600	1187080	This is now the first block finding the domains.
1187240	1191100	I'm going to go into that. We haven't implemented this
1191100	1194860	Within this tool. And i'll tell you later on why
1194860	1197780	We haven't implemented this. It's one of those things where
1197780	1201420	There's lots of exceptions and it's not that easy to implement.
1201420	1204460	We started doing it. But it's not there yet.
1204460	1206180	So you won't see it within this tool.
1206180	1212160	For the subdomain mining, what we basically do is we start
1212160	1217340	Off with a domain itself. Now, let me ask you this.
1217340	1221780	If you google for ibm, let's take ibm as an example.
1221900	1224320	And please, again, i've got nothing against them.
1224520	1228800	If you google for ibm, yeah, i'm using an ibm notebook.
1228800	1235680	Come on. If you google ibm, okay, you're
1235680	1239240	Going to find a whole lot of hits, right, that points to
1239240	1244020	Machines that's sitting on a domain ibm.Com.
1244080	1247240	So, for instance, one of the links that you might get is
1247240	1252020	Something coming off a site called tripwchess.Ibm.Com.
1252020	1254980	Not chest, no. Chess, right?
1255000	1259340	Okay. And what do we know from that?
1259640	1264060	We know there's a subdomain called chess.Ibm.Com, right?
1264060	1267440	And as we go along, we can google for different kind of
1267440	1271580	Common words and look if it's related, if it is within the
1271580	1275520	Ibm.Com domain, and using google, we can basically pull
1275520	1279680	Out a whole list of subdomains. We can also pull out a whole
1279680	1282700	Lot of domains itself, a whole lot of dns names itself,
1282700	1287340	Because if something resides on tripwchess.Ibm.Com, then we
1287340	1292020	Know that tripwchess.Ibm.Com exists, which gives us one
1292020	1296140	Forward entry in our table of maybe lots of forward entries
1296140	1299400	That we're going to pick up later. Everybody's cool with that, right?
1299480	1303000	So let's see how it is actually done. Sorry, if you want to have
1303000	1305620	More information about that, you should attend johnny long's
1305620	1307400	Talk. He's doing a whole section on
1307400	1310720	Subdomain mining. He's right there.
1311160	1315260	Okay. So let's see how it works.
1315260	1319940	Now, it normally takes about five minutes per domain to get
1320580	1324320	Subdomains, and this is at the moment set to only look at the
1324320	1327260	First three pages that google returns, right?
1327260	1331220	So we can set it to return as many pages, but the kind of 80-20
1331220	1336280	Principles at work here, we find 80% of the hits within 20% of
1336280	1339700	The time, okay? so doing three pages is just
1339700	1341920	About okay. And we've got a couple of
1341920	1344720	Keywords that we can combine the search with.
1344920	1346940	So i don't know if you can see there at the back.
1347750	1350340	What we're going to do is i'm going to start playing this
1350340	1355740	Video. So we enter ibm.Com in there
1355740	1360900	And we hit the start button. And now the tool is basically
1360900	1363580	Through the google api querying google.
1363800	1366680	We also get e-mail addresses. So, for instance, there you
1366680	1372700	Have no one, no one at us.Ibm.Com, and from that, we
1372700	1376920	Obviously know that there's a subdomain called usa.Ibm.Com.
1378300	1382260	When this tool is done, this is obviously time lapsed.
1382280	1385380	You'll see on the right-hand side, we have a whole list of
1385380	1389700	Subdomains. Uk.Ibm.Com, us.
1389700	1393420	Watson.Ibm.Chess and so forth and so on, okay?
1394180	1398180	And while this might not look so interesting on ibm.Com, we
1398180	1401460	Might afterwards show you an example that is more
1401460	1406120	Interesting, okay? so basically what we have now
1406120	1408360	Is we have the subdomains, right?
1408360	1410560	We have the domains and we have the subdomains.
1410560	1413000	And what we want to do is we want to find all the forward
1413000	1415880	Entries that we can possibly find, right?
1416180	1420340	So hang on a bit. What do you think would be
1420340	1423480	The first step to check for when we're doing, when we're
1423480	1426600	Finding forward dns entries? what would be the first thing
1427120	1430280	That we would see if this is possible on the domain?
1430480	1432480	Anyone? anyone? okay.
1432480	1435240	Hang on a bit. Where's our t-shirts?
1435240	1451440	Do we have t-shirts? let's see again.
1453540	1456280	What would be the first thing that you do when you have a
1456280	1459980	Domain and you want to find all the forward entries in the
1459980	1462540	Domain? yes, sir.
1464080	1466260	Sorry? no.
1466260	1469560	Who said zone transfer? there you go.
1469560	1470660	Okay. So the first thing that we're
1470660	1473840	Going to do is we're going to attempt to do a zone transfer,
1473840	1475100	Right? why?
1475100	1477360	Because if we can transfer the zone, we get all the
1477360	1479660	Information in the zone in one go.
1479980	1482640	We don't have to mine for any dns data.
1482640	1486280	We get the entire zone. So the first thing we're going
1486280	1490860	To do is we're basically going to check for mx records and ns
1490860	1493820	Records and then we're going to see if a zone transfer is
1493820	1498500	Possible. Where's my handy laser pointer?
1498500	1503040	If a zone transfer is possible, we immediately have all the
1503040	1506520	Forwards within that list. The next thing we want to do if a
1506520	1510440	Zone transfer is not possible, which is most likely the case,
1510440	1513220	We're basically going to go through a hit list.
1513220	1516000	I'll explain that just now. And from the hit list, we're
1516000	1520240	Going to perform the forward and that's going to drop us into
1520240	1522900	This container over there. Now, the hit list works like
1522900	1527880	This, right? if you see that a machine
1527880	1532920	Exists with the name of gandalf.Ibm.Com, what's the
1532920	1537300	Chances that there will be a machine called frodo.Ibm.Com?
1537820	1541180	Pretty good, right? so the idea what we're doing
1541180	1544920	There is we're building a whole lot of lists, right, of things
1544920	1550220	Like we have colors, we have animals, we have characters out
1550220	1553120	Of lords of the rings, we have characters from hitchhiker's
1553120	1557340	Guide to the galaxy, terry pratchett books, we have names
1557340	1560480	Out of the bible and so forth and so on.
1560480	1565080	And basically we test for four entries, it's configurable, but
1565080	1567620	We test for four entries within that list.
1567620	1571400	That list is sorted from the more popular names at the
1571400	1574020	Beginning. And we basically check if one
1574020	1576800	Of those names exists and if they do exist, we check the
1576800	1581960	Whole list, okay? so it gives us a way of
1581960	1585340	Finding out what kind of naming scheme these people are using,
1585340	1589940	Using only four dns entries, dns queries, right?
1590840	1593000	Because they're not going to have some kind of a weird name
1593000	1596060	Out of lords of the rings and not have gandalf, right?
1596060	1598060	They would have gandalf or frodo.
1598900	1603180	So let's see how this works. Now, for this, we've done it on
1603180	1608600	Playboy, okay? and we've now started with
1608600	1611780	Doing the subdomains. In the case of playboy, we
1611780	1615440	Only find two subdomains called casino.playboy.com and
1615440	1620060	Playboynet.playboy.com. And what we're going to do is
1620060	1622800	We're going to go on to the forwards, okay?
1622860	1626280	When we click there, we can basically import the stuff from
1626280	1630240	The previous section, okay? what you see there, sorry, i
1630240	1633400	Missed this. Let's just pause it here.
1634040	1637480	Can you see that at the back at all? probably not, right?
1637520	1639880	Can you see at the back, people at the back, can you see the
1639880	1642860	Actual lettering there? no?
1643280	1651360	Dude, i'm sorry. No, i can't make it any larger.
1652200	1655340	Okay, i can, but then, you know, that means rewriting the
1655340	1657880	App for another font in that window there, okay?
1657880	1660240	So basically what you see over there, just trust me on this,
1660240	1661420	Okay? i'm not lying.
1661420	1663080	And the people in front can verify.
1663260	1667060	So what you're seeing there at that part of the screen over
1667060	1671100	There is entries that we've already found with the google
1671100	1673200	Search, right? those are already forward
1673200	1676100	Entries that we found with the google search.
1677060	1679640	So they exist. So now we're going to add to
1679640	1682620	It. Let's just see if i can, okay?
1682720	1686980	And i'm going to click on import, right?
1687380	1691380	And we get our list over there of things that we have.
1691580	1695720	Fruit, e-commerce, colors, names, music, all of that.
1695960	1699520	And immediately when we do that, we start getting results.
1699520	1701940	Now, those results there, i know you can't see it even if
1701940	1704880	You're sitting in the front, those are the mx records and
1704880	1707540	The ns records, okay? it's just in a different color.
1707980	1711020	But we basically, here at the bottom, you'll see that we're
1711020	1713720	Starting to check forward entries, right?
1713720	1718100	And we already got ftp, we got content.playboy.com, which,
1718100	1719780	You know, i don't know, it could be interesting.
1722360	1725860	And at this stage, i've basically stopped it and let it
1725860	1727220	Run through. The capture, i stopped the
1727220	1729280	Capture. So you see there the end of
1729280	1733700	The entire capture. You get machines like secure
1733700	1740020	2.Playboy.com, it's all kind of interesting.
1740120	1743960	The other thing that we can do is we can add at the end of a
1743960	1747340	Forward, we basically add some fuzzing strings, okay?
1747340	1753420	So when we test, for instance, ftp, we also test for ftp1 and
1753420	1759260	Ftp2 and ftp-1 and ftp-2. And you can have as many as you
1761160	1763440	Want, right? at the moment we were just
1763440	1766780	Testing dash 1, dash 2, 1 and 2, okay?
1766780	1769800	But it's basically kind of fuzzing the dns out.
1770700	1775060	So what we have after this is we can collect all of the dns
1775060	1778760	Forward entries that we can possibly get from a domain, we
1778760	1783360	Can collect them in that text field on the right-hand side.
1783360	1789460	Ah, shit. Okay.
1789460	1792620	So the next step that we want to do is we basically want to
1793320	1798200	Look at net blocks, okay? now, the idea is the first thing
1798200	1801440	We can do is we can take all of those ip addresses that we had,
1801440	1803880	Right? and we can slice off the last
1803880	1807580	Digit from them and assume they're all class c's and start
1807580	1810680	Off with a class c definition, right?
1810680	1812880	Okay, we're going to start doing that.
1814440	1820260	Absolutely. You're absolutely correct.
1820760	1824060	So we're going to start by that. We've got to start somewhere.
1824160	1826420	You're absolutely correct. So you'll see.
1826880	1828900	Okay. And what we're going to do is
1828900	1832280	We're going to add into that, see what the who's definition is
1832280	1835540	Of that block to see if we can get the net block out of there.
1835780	1838280	We're going to look at additional blocks like from
1838280	1843220	And all of those wonderful places.
1844140	1846560	But you'll see how that is also difficult to do.
1846580	1851160	We're going to look at reverse dns entries to find out if the
1851160	1853920	Blocks are at the correct boundaries.
1854140	1857280	And another technique that we were looking at is to basically
1857280	1862440	Find the as number of the root connected to that particular ip
1862440	1865960	Address, then put that as number back in and see what other
1865960	1869240	Roots are within the same as. Okay?
1870140	1873220	And we'll talk about what the challenges are in that.
1873680	1876600	So let's just look what happened to playboy.
1877160	1879980	I'm going to start playing this thing again.
1880580	1883260	All right. So we go to the next step.
1883500	1887800	We do import, right? and at this stage, the tool
1887800	1894880	Will tell you this will import from the forwards and assume
1894880	1898040	Class c blocks, it might be a dangerous assumption.
1900800	1903080	All right. Okay.
1903080	1907280	So that's a start. And we see all of those 216s in
1907280	1909560	There. They kind of look as if they
1909560	1912180	Belong together. When you click on it, you
1912180	1915060	Basically get all the forwards that sit within that block.
1916400	1918040	Okay. Let's see.
1919140	1920620	Okay. So there's a lot of the playboy
1920620	1923820	Stuff coming, ftp, help. And we can click on the who's
1923820	1926820	Button and basically get the who's information for that
1926820	1931220	Block. And we see that, okay, that is
1931220	1937000	Actually not a class c, but it's a couple of them.
1937220	1940200	I think it's about, what, 16 class c's.
1940540	1943080	And then we can simply change our block definition over there
1943080	1948380	And say, okay, it's not from 36, it's from 128 all the way up
1948380	1952180	To 143. As soon as we do that, the
1952180	1954700	Other blocks that was there got kind of sucked into that list
1954700	1957660	Because they're, you know, inside of that network now.
1958880	1960640	Okay. In this case, you will see this
1960640	1966060	Machine is a name server, 244. And we can have our blocks even
1966060	1968720	One ip big. You know, we can have one ip,
1968720	1970820	We can have a class b, we can have a class a.
1970820	1973500	It really doesn't matter. We just change it to say that
1973500	1976920	That thing is now only one ip large.
1981800	1985440	Right. Okay.
1988160	1994820	What's interesting here is we did the forwards on, just want
1994820	1999260	To check if it's the case, we did the forwards on IBM as well.
2000740	2004840	So you can have a look and see what their net blocks look like.
2004840	2008280	You know, they got some crazy class bs out there.
2008360	2012140	Look at the size of that block. There's a couple of class bs in
2012140	2014280	There. Okay.
2014280	2016220	So the next thing we're going to do is we're going to do
2016220	2019680	Reverse dns scans. And the reverse dns scan looks
2019680	2023560	Kind of intimidating. It's actually quite easy.
2024020	2026260	We're going to start with the net blocks that we have at this
2026260	2028900	Stage. We're going to do a reverse
2029560	2033000	Dns entry on each of them. And then we're going to apply
2033000	2036120	Some filters and say if this thing is contained within that
2036120	2040840	Filter, okay, we say it's the match entry.
2040960	2043080	We can extract the domain from there.
2043340	2047620	See if the domain is already found in our list of domains
2047620	2050180	That we supplied. If it's not, we can add the
2050180	2052500	Domain. And if it doesn't match the
2052500	2055680	Filter, we say hang on a bit, here's a domain within that
2055680	2058720	Block that does not match your filter.
2058720	2062000	Maybe it's interesting to have a look and see what else is on
2062000	2064940	That domain. So let's see how this works.
2070080	2071400	Okay. There's the forwards.
2071400	2075500	It's now i.P. Sorted. You can go to the net blocks.
2075600	2077500	Those are the net blocks that we defined.
2077780	2080580	When we start the reverse, you'll see that it
2080580	2083680	Automatically puts in the filters a list of the domains
2083680	2085700	Because that's probably what you want to filter on.
2085700	2088180	In our case, we change it so that it only says playboy
2088180	2092140	Because maybe there's another playboy domain, playboypix.
2092140	2095200	And we want that filter to pick it up as well.
2095860	2098540	We start at the reverse now. You can see these are all the
2098540	2102600	Entries that we get back. These are domains.
2102600	2105860	There's playboyenterprise.com, for instance, that match the
2105860	2109380	Filter, but we don't have playboy enterprise as a domain.
2109380	2112020	So it's an additional domain that's a match domain that we
2112020	2114020	Want to put back into the system, right?
2114560	2117260	Now, this is not the speed at which it ran.
2117420	2120360	I kind of paused it a couple of times so you don't have to sit
2120360	2122840	Here the whole time looking at the thing running.
2123160	2126480	At the bottom, you see there's something called, what is it?
2126480	2132040	No, go down. Spicetv.com, right?
2132400	2141680	If we do a whois on spicetv.com, right, you will see that it is
2142280	2145320	Sitting at spiceentertainmentinc, and it's
2145320	2148700	Sitting somewhere in chicago. Note the address, okay?
2148700	2152400	Lake shore drive, chicago, and there's a phone number there.
2152620	2153820	So let's just have a look and see.
2153820	2158000	If we do a whois on playboy.com, what the contact information
2158000	2161940	Would be for them. And what do you know?
2162080	2167520	It is the same address. So spicetv and playboy is
2167520	2171340	Clearly related, right? they are the same company.
2171340	2175920	So in terms of putting new domains within your system to
2175920	2179620	Start scanning for more interesting domains and to
2179620	2183520	Start finding more ip addresses and more net blocks, you should
2183520	2186000	Be looking at spicetv.com as well.
2186040	2191940	So we can take that stuff, take out the subs in there, sort
2191940	2195340	Unique that, basically cut all of that stuff out.
2195600	2197620	You would see there's a bug in the program at this stage.
2197620	2200920	It's fixed in the release that we have now, whereby it didn't
2200920	2204780	Check for uppercase, lowercase. So playboy.com uppercase was
2204780	2206920	Still in the list of unmatched.
2207840	2212420	That's just too lower. And we can take all of that
2212420	2215600	Stuff and we can basically paste it back in here with the rest
2215600	2218540	Of our domains. See there, i take it out nicely.
2219720	2222480	Sort unique that. And we can start over again.
2222480	2225300	And that's why we have this kind of cyclical thing between the
2225300	2228020	Reverse and the forwards. Until those blocks that we
2228020	2230760	Scanned come out completely clean at the other end.
2231680	2235500	Okay. Now, the next step we want to
2235500	2238580	Do, when we're happy with our net block definitions, is we're
2238580	2241460	Going to find what machines are actually within those blocks
2242360	2244420	That we can attack. Correct?
2244700	2247340	Now, again, imagine that you're doing this on a very large
2247340	2250420	Organization and you've got, let's say, ibm with lots of
2250420	2254400	Class b's. You need to, well, they've got
2254400	2256720	Multiple class b's. You need something that's
2256720	2259520	Really fast, right? this is, it ain't going to work
2259520	2261580	If you're not scanning it really quick.
2262280	2264480	Now, there's three ways that we can find out if a machine is
2264480	2266460	Alive. We can do your normal icmp
2266460	2269620	Scan, of course. We can do udp scans, which is
2269620	2273580	A little bit more trickier. And we can do tcp scans.
2273580	2276140	And then we go for kind of a small list of ports.
2276300	2278460	And we only check for that. And sure, we're going to miss
2278460	2282180	Stuff, okay? but the more ports you test for,
2282180	2284820	The more it becomes a port scan on the entire range.
2286320	2287920	And the longer it's going to take.
2287920	2290260	So depending on your time here, you can either scan all the
2290260	2293780	Ports or you can scan for a very small subset and only find the
2293780	2296260	Machines that's alive on those ports.
2297200	2300000	Now, what we've done with the port scanning is basically
2300000	2303020	Implement a asynchronous port scanner.
2303360	2307260	And you've all seen this. It's been used now in many kind
2307260	2310780	Of tools. It basically works like this.
2310780	2314060	We send out a sin, right? we have a sniffer on the other
2314060	2316000	End. We check for the source port
2316000	2319420	Coming back. If it's a sinack, the port is
2319420	2321940	Open. If it's a reset, the port is
2321940	2324280	Closed. It's as easy as that.
2325460	2329800	So let's see how it works. This thing, and i know some of
2329800	2331840	The other scanners, i mean, check out the unicorn scan
2331840	2334460	Thing as well. I think they were speaking
2334460	2337520	Yesterday morning, right? they're doing the same thing,
2337520	2338940	But they're doing it distributed.
2339580	2343580	So it's even faster that way. But we can probably, you know,
2343580	2346920	Do one port in a class b in two minutes.
2347700	2349560	So if you're only scanning for one port, it's going to take
2349560	2352460	You about two minutes. We limit this thing so it only
2352460	2355280	Sends, you know, at the quickest it can send out packets
2355280	2358560	Every two milliseconds. Obviously you can do it faster
2358560	2360420	Than that if you implement it yourself.
2362640	2366200	Oops. Okay.
2366200	2369080	So let's just look at the whole process for sensepost.com
2369080	2371720	Because it's really quick. We go there, we find the
2371720	2374280	Forward entries. It's going really quick.
2374700	2377380	Okay. We're almost done.
2378300	2380900	Right. We take it into the net blocks.
2381880	2386260	What you will find is there's a 10, 15, 10 in there.
2387220	2390880	Which, i mean, it's not internal, but we use it for the
2390880	2393060	Training. So i'm taking that out
2393060	2395220	Because i'm not going to scan 10, 15, 10, right?
2395220	2399980	That's a little bit silly. And the other thing that's
2399980	2405300	Interesting here to note is, let me just pause this, is that
2405300	2410240	With service pack 2, xp service pack 2, microsoft actually
2410240	2413560	Disabled the use of raw socket sending, right?
2414700	2417540	Because they went through all the tools that uses raw socket
2417540	2421500	Sending and they were like bad, bad, bad, bad.
2421500	2423540	Let's not check the rest. They're all bad.
2423580	2426100	Okay. So they disabled it.
2426360	2429900	Which is a pity. So for us to be able to do
2429900	2433620	This on this level, we need to drop a level down and send
2433620	2436560	Those packets out on an ethernet layer.
2437420	2440480	And so there's a driver that actually that we use.
2440580	2443000	You've got to bind the driver and send the packets out that way.
2443000	2445920	It's a little bit more tricky, but it's not that much more
2445920	2449200	Tricky. Okay.
2449360	2452180	So basically these net blocks now come in from the previous
2452180	2454240	Step. We select what ports we want to
2454240	2455860	Scan. It's all configurable, of
2455860	2460020	Course. In this case, we go with 22,
2460020	2464220	23, 25, and 443. And we basically just start it
2464220	2469280	Up over here. The ports that are found open
2469280	2473640	Is listed on that side. Showing an o for open port.
2473640	2475660	Shows you the ip, shows you the port.
2475720	2479700	And it also shows you the ttl, which gives you a kind of idea
2479700	2481740	Of how far the machine is away from you.
2481740	2485380	Although, you know, some stacks send their packets out with the
2485380	2488460	Ttl of 128, others with other values.
2488460	2491500	So it's not that useful. But, you know, we put it in there
2491500	2493360	Now. You'll see as soon as we go into
2493360	2498640	The 72 network, things start to go a little bit quicker in there
2498640	2500520	Or we get more results coming back.
2500520	2502640	There we go. Okay.
2503880	2507540	Because there's lots of machines that's open on those ports.
2507540	2509600	And you'll see we paused it there.
2509600	2511340	So it's going to jump. Okay.
2512300	2514420	And that's basically doing the port scan.
2514420	2515940	Right? basically doing the port scan
2515940	2519880	On the net blocks and on the ports that we specified in the
2519880	2523220	Previous section. Okay.
2524320	2526900	All right. So if you look at the whole
2526900	2528920	Footprinting thing, it looks like this.
2529340	2531720	And you're not supposed to be able to read anything that's on
2531720	2533940	The screen. It's just to give you some
2533940	2537480	Idea of all the different steps and the complexity involved with
2537480	2538860	This whole thing. Okay.
2538860	2540740	We start off with a domain over there.
2540960	2544340	We end up with a whole list of ip numbers on that side.
2544380	2547380	We're doing whole lots of tricks in between to make it work.
2548800	2551500	Okay. So footprinting, it's over.
2551540	2553520	I know people don't like it. I dig it.
2553520	2555520	But it's not over. Right?
2555680	2558880	So within this thing, which steps are easy to automate and
2558880	2560940	Which steps are really difficult to automate?
2560940	2565380	The domain finding stuff is really difficult to automate.
2565400	2567980	Okay. We wrote a paper on this two
2567980	2572780	Years ago for black hat singapore. You can get it off the black hat site.
2572780	2574760	You can see the methods that we use there.
2575320	2577640	I know johnny is going to talk about some of those methods in
2577640	2579720	His talk as well. But it's difficult.
2579720	2582720	It's not nice. It's not a fun thing to do.
2583840	2586080	And at the moment, we don't do it.
2586080	2588980	You can learn a lot from the reverse entries like we found
2588980	2592480	On spice tv.Com. But we don't do this.
2592680	2595320	The subdomain finding, we got it.
2595320	2597360	It's cool. Forwards, no problem.
2597400	2601620	The net blocks, it's difficult. The as expansion technique that
2601620	2605880	We have there don't always work on small networks.
2605880	2610480	So, for instance, sense post has one class c.
2610620	2613320	But if you do a whois, if you look at the as that's
2613320	2617020	Basically attached to our net block, you would find that it
2617020	2618960	Belongs to the isp. And if you look at all the
2618960	2622160	Other routes within that as, you're going to get the net
2622560	2625120	Blocks for the isp, which is not necessarily what you want
2625120	2629300	To do, right? the other problem is that these
2629860	2634420	Registrars like LACNIC and APNIC and those guys, RIPE and
2634420	2639180	ARIN, don't have a way to search with a wild card for
2639180	2642740	Names and get back net blocks. I mean, you can do it on ARIN
2643640	2648120	And you can kind of do it on RIPE with a bit of trouble.
2648120	2650780	But you can't do it on LACNIC and you can't do it on
2650780	2653060	APNIC and you can't do it on any of the others.
2653060	2655260	You just can't do it. So you can't get more net
2655260	2657120	Block definitions from those guys.
2658040	2661660	The reverse scans, oh, and the other thing is the whois
2661660	2665100	Information is worthless on these small little networks,
2665100	2668860	right, because they don't have the actual person that is
2668860	2670860	The company that has that net block.
2670860	2674000	They only have the isp or something like that in there.
2674000	2677820	So that's useless as well. The reverse scans, that's
2677820	2678720	Easy. We can do it.
2678720	2682040	It's a no-brainer. The vitality stuff, easy.
2682240	2685940	At the moment we only got the TCP stuff, but doing the rest
2685940	2688300	Is really just an extension on that.
2688740	2691220	So why do you care about footprinting?
2692420	2695580	You know, because there's a difference between finding one
2695580	2699560	Vulnerability on one machine versus finding one machine
2699560	2703640	With one vulnerability. And I think actually Dan
2703640	2706100	Kaminsky had this point that he made in his talk last night
2706100	2708460	As well. It's easier finding one
2708460	2711680	Vulnerability on a whole lot of machines than finding one
2711680	2714740	Vulnerability on one machine. Okay.
2714740	2717260	So we've done with that, right? we've done with that first
2717260	2718340	Block. We're going to move on to
2718340	2721620	Fingerprinting. Now, fingerprinting, we
2721620	2723420	Actually want to do os detection, right?
2723420	2726860	We want to be able to see, say, that is a windows machine
2726860	2731180	Running windows 2000, service pack 3, whatever.
2731200	2734160	It's really difficult to do this from the internet on a
2734160	2737280	Machine that is tightly firewalled. Why?
2737280	2740540	It's not technically difficult. It's not only technically
2740540	2743280	Difficult, but it's conceptually difficult as well.
2743460	2746760	So if you have an apache machine, all right, that's
2746760	2751580	Protected with the firewall 1 running on windows, microsoft
2751580	2757160	Windows, with one-to-one net back to that apache box, that
2757820	2761040	Thing is going to report itself on a network level as a
2761040	2764360	Windows machine, right? because you're talking to the
2764360	2767640	Windows stack. But on application level, it's
2767640	2772020	Going to return itself back as a apache machine.
2772340	2775620	So not just is it difficult to find that stuff, it's also
2775620	2778160	Difficult to kind of decide which one will it be.
2778740	2781760	So with bdblah, we don't try to do os detection.
2781760	2784460	We don't even try to. What we do is we do banner
2784460	2786900	Scanning. And i know, i know, everybody
2786900	2789800	Tells me you can change the banner, but how many people
2789800	2792400	Actually is changing their banners? not a whole lot of
2792400	2794220	People are changing their banners, right?
2794300	2795820	So we're saying, okay, that's fine.
2795820	2798860	Let's just do banner scanning, let's see what we get.
2799600	2802280	And we do it asynchronously again.
2802280	2805020	And the asynchronous banner scanning stuff is quite cool.
2805780	2808700	You can do asynchronous banner scanning for any kind of
2808700	2811280	Banner. But the more complex it
2811280	2815360	Becomes in terms of negotiation, like ssl, for instance, the
2815360	2817940	More tricky it becomes to do it asynchronously.
2817940	2822080	So we've done it with the ssl stuff.
2822080	2824660	We've done it multithreaded. And with the rest of the stuff,
2824660	2827920	We did it with the other ports, we've done it asynchronously.
2827920	2829980	How does it work? okay.
2830060	2835560	Basically, the same way that we had a asynchronous port
2835560	2837580	Scanner, it works in the same way.
2838820	2841800	So we got a sniffer. We're sending sins on this
2841800	2843480	Sound. We have a sniffer that checks
2843480	2846760	The source port, right? normally, if the port is open,
2846760	2850860	It's going to come back with a sin.
2853560	2855720	So normally it's going to go into this thing.
2855720	2858340	It's going to get a sin. We've got to act that packet
2858340	2860340	Back. So we send an act.
2862340	2865120	We check if it's port 80 that we're testing.
2865300	2866760	It could be other ports as well.
2869620	2872360	And if it is, we send back a get
2873220	2876360	Http1.0. Now we're going to get an act
2876360	2881360	Back into this tree. If it's port 80, we extract it
2881360	2885300	From the http header. If it's not port 80, we simply
2885300	2888280	Extract the banner. Then it's a 25 or a 21 or any
2888280	2892380	Of those, right? and we have to close the
2892380	2895340	Session because otherwise our web servers are going to keep
2895340	2898680	On sending the stuff back. So we have to send a fin.
2899660	2902340	If there's a fin, we have to fin act that.
2902920	2916460	Now, who can tell me for a t-shirt, what is the thing
2916460	2921820	That's going to bite us? this works, but we have to do
2921820	2925060	Something else to make this work. Who can tell me what the
2925060	2927380	Problem is here? yes, sir?
2930580	2941520	Yeah. I think you're right, but we
2941520	2942820	Haven't seen a lot of that.
2945580	2949300	No, no, no, no, no, no. That's not the problem either.
2949500	2954120	Look, i mean, think about this. This stuff happens, right, on
2954120	2955620	User level. Doesn't happen through the
2955620	2958720	Kernel. Doesn't happen through the stack.
2959280	2961820	The stack doesn't know about this happening.
2962320	2965160	So we're sending out a fin, right?
2965160	2967420	No problem. Our stack can send it out.
2968500	2972800	Okay? so we get back a fin act.
2972800	2977080	Right? and now, what's my stack going to
2977080	2979420	Do? in comes a fin act packet.
2980760	2982980	Who said reset? thank you, sir.
2984840	2987640	So that's exactly the problem. Now, our fin act packet is
2987640	2990300	Coming back into our stack. Our stack says, hey, i don't
2990300	2996820	Know what you did. So the stack says, hey, hang on
2996820	2999120	A bit, here's a fin act coming back to me.
2999120	3002300	I never send out the fin. It doesn't know about that, so
3002300	3003940	It's going to reply with a reset.
3004360	3006880	So we've got to cut those resets off somewhere.
3007260	3010440	In this case, you can do it in an upstream firewall.
3011060	3013880	What we usually do is we, you know, we have a personal
3013880	3016900	Firewall on the machine. We cut the resets off there.
3016900	3019160	So there's no reset that your machine can send out.
3019160	3021800	Not reset coming back. Reset's going out.
3022680	3024620	Okay? this thing, this asynchronous
3024620	3028820	Banners, a grabber can really work very fast.
3029180	3034640	So we can do about 2,000 banners in three minutes that we can grab.
3036000	3039520	What i want to show you is how it actually works.
3039520	3044160	When we start out, we do the, we first do multi-threaded
3044160	3047720	Work on the hdps to get that, because we can do it
3047720	3050460	Asynchronously, but, hey, it's a lot of work.
3050460	3056280	So let's go on and see. So those are the port scans.
3056720	3059360	You go to the banners. You basically import that
3059360	3063340	Stuff in there. Okay.
3063680	3067120	Select the interface. Right.
3069460	3071540	We start, it's starting there at the bottom.
3071540	3073880	You can see it's starting on the ssl.
3073880	3077420	It's doing 15 threads at the same time to find the banners
3077420	3079960	For the ssl stuff. So that's not really fast.
3081620	3085600	Right. And you will see there's a delay
3085600	3087320	In there. The moment we're sending it out
3087320	3090980	At 302 milliseconds delay between packets.
3090980	3094420	But you can actually drop it off as, hang on, hang on, hang
3094420	3095440	On. Hang on.
3095440	3097980	Okay. You can drop it off as low as
3097980	3099400	You want to. Right.
3099400	3101500	You'll see there's additional weight in there.
3101500	3105240	That's basically, you know, those smtp servers when you
3105240	3107720	Connect to it, it doesn't do anything.
3107840	3110900	And it waits and waits and waits. And then finally you get the
3110900	3113060	Banner coming back. That's the time that we've got
3113060	3115600	To wait for those stuff coming back.
3115640	3119120	Now, what you will see here is i'm going to drop that delay
3119120	3123760	There down to 2 milliseconds. And what's interesting is note
3123760	3128640	The scroll bar on the right-hand side as i drop it.
3133900	3135580	Okay. Zip.
3137820	3139020	Okay. And those are all the banners
3139020	3143340	That we could get there. So it's kind of fast.
3143780	3145060	Okay. And now we're just waiting for
3145060	3147220	Other banners to come in if there's anything.
3148840	3150480	Okay. Cool. I'm going to go on.
3151860	3153200	Right. So this is what we do for
3153200	3155560	Banner scanning. What's the next step?
3155560	3157140	We want to be able to do targeting.
3157740	3161280	Now, the thing there is if you have a lot and lots and lots of
3162180	3165580	Potential targets, you want something that can easily say,
3165580	3168140	Oh, well, i want to identify everything that's running on
3168140	3171440	Port 22 and i want to only test against those.
3171440	3175080	Or i want to have only machines that have open ports within a
3175080	3177520	Certain net block and i want to test those.
3177520	3182320	Or you get the idea, right? so this is what the targeting
3182320	3185740	Stuff looks like. We basically have the banners
3185740	3188420	Now for everything. We can click on targeting and
3188420	3191880	We basically get our net blocks definitions in there.
3191880	3195740	We can drop down to those, see the machines that are in there.
3195740	3200600	The machines in there has either a dns name or reverse or
3200600	3204020	Forward or it's the mx record or it's the ns record for a domain
3204020	3209140	Or it has an open port. Once it's got an open port,
3209140	3212100	That's something that we would want to see in there, right?
3212100	3214300	A machine that's totally dead with no forward or reverse
3214300	3217020	Entries are kind of boring to us.
3217400	3221200	Machines with dns information or open ports are interesting to
3221200	3223960	Us and we can get the banners in there as well.
3224560	3227740	What's interesting about the banner scanning is if you get a
3227740	3230680	Reset coming from the host, what do you know?
3230680	3231920	You know that it's wrapped, right?
3232060	3235420	It's a tcp wrapped port. So it actually accepted the
3235420	3240700	Entire conversation and then it sent back a reset to close the
3240700	3244280	Connection afterwards. So we can do a search for
3244280	3248500	Instance for open ssl and we're going to get all the machines
3248500	3253980	That has a banner that contains the word open ssl in the banner.
3254780	3257660	And then we can just simply say, okay, make those targets.
3257660	3261500	I want to attack those machines with open ssl and immediately
3261500	3265040	Goes off to the target section. Okay, cool.
3266480	3270120	There we're doing a scan for machines on tcp 22.
3270120	3275380	Anything that's open on 22? all right.
3275380	3277320	So you see all the banners coming back there and i can
3277320	3280780	Again just say make those machines targets.
3280780	3282580	I want to attack it in the next stage.
3286270	3288710	Okay. I think we get the idea.
3289430	3292170	Right. So now we have our targets
3292170	3294810	Defined. Remember we went through the
3294810	3296550	Whole thing. We went through the whole thing.
3296550	3299810	At this stage we have the machines that we're going to
3299810	3301210	Attack. Okay.
3301210	3303230	We went through the targeting, all of that.
3303230	3304750	We have the machines that we want to attack.
3304970	3307530	Right. So what's the next step?
3307530	3309250	We want to do vulnerability discovery.
3309270	3311570	We're going to find what vulnerabilities are on these
3311570	3315350	Machines. So we're not going to write a
3315350	3318630	Vulnerability scanner because there's a lot of people that
3318630	3321050	Wrote vulnerability scanners. We're going to use something
3321050	3325970	That's really solid, we hope, and widely used, and that is
3325970	3327650	Nessus. So what we need to do is we
3327650	3332190	Need to write a nessus client. Okay.
3332190	3333790	We need to write a nessus client.
3333930	3336250	And what we want to do is we want to give the user the
3336250	3340170	Ability to select the plug-ins that he wants to use just as a
3340170	3342710	Normal nessus client and say, well, i want to test this
3342710	3345190	Particular bug. Okay.
3345190	3349070	Remember what i said previously. It's easier to find a single
3349170	3352090	Bug on a whole lot of machines than finding the one bug on one
3352270	3353870	Machine. So, for instance, if we want to
3353870	3357810	Check which machines on an entire class b has snmp
3357810	3362270	Community strings enabled, you know, we put one plug-in into
3362270	3365530	Nessus and we scan it across the whole class a and we find the
3365530	3367770	Stuff really quick. Okay.
3370350	3374710	So this is basically what we use for plug-in selection.
3377650	3380590	It's really easy. You can decide which plug-ins
3380590	3382630	You want to use. You can move them from the one
3382630	3387290	End to the other end and you can save that information afterwards.
3387390	3389970	It actually just saves the plug-in i.D. So you can have
3389970	3394830	Your list of plug-in i.D.s wherever you want to have it.
3394830	3399210	You can put it in a text file and you can use whatever kind of
3399210	3403850	Selector you want to basically select these plug-ins.
3403850	3407270	It's just a list of nessus plug-ins, right, i.D.s.
3408270	3412670	Afterwards we're going to save that and i can give it a name.
3412670	3415390	Those are the plug-in i.D.s on the left-hand side and i can call
3415390	3418370	That thing whatever i want. I'm going to call it black hat
3418370	3422390	Demo.PLG. That's a plug-in set.
3422390	3424330	You're going to see i'm going to use it later on.
3426810	3430430	So in the next step we actually want to now run vulnerability
3430430	3432450	Scans, right? we're going to run the nessus
3432450	3435930	Scan against our target on a particular plug-in set.
3438890	3442210	So there's the sense for stuff. There's the net blocks.
3442750	3445810	There's all the reverse entries. Click.
3446290	3449410	Yeah. There's the port scan.
3450210	3453410	The banners. And what we want to do now is
3453410	3456330	Run a nessus scan against those machines.
3456970	3459610	But we have to target them first. So i'm going to click on
3459610	3462590	Targeting and i'm going to say that first, you see that first
3462590	3465290	Class c over there? there's a couple of machines in
3465290	3468270	There. It's in our lab situation that
3468270	3473470	We want to scan, right? i can right-click on any of those
3473470	3476290	And say select it as a target or what i can do is i can
3476290	3479030	Simply say anything that's in that block that's got an open
3479030	3482950	Port, make it a target. So immediately i get a list of
3482950	3484990	Machines there. Those machines are now my
3484990	3489630	Because they're live, right? they responded to any of those scans.
3490370	3493650	And i go to the nessus tab over there and i basically import
3493650	3496010	Those by just clicking on the import button.
3496550	3498250	Okay. I select the set that i want to
3498250	3504250	Use. And i click on start.
3505010	3507290	Right. Now, with ntp, the nessus
3507290	3510450	Protocol, you have to get all the plug-ins.
3510550	3512590	You have to load the plug-ins before you can actually run the
3512590	3513750	Scan. It's kind of weird.
3513750	3517070	Even if you know exactly what plug-ins you want to use, you
3517070	3520210	Have to select, you have to get all the plug-in information
3520210	3522510	Coming back. Now, there you can see the
3522510	3524550	Scan is now running. It started with the port scan
3524550	3527010	As per normal on all those ip addresses.
3527490	3531190	You can set your nessus server up as you want to, to, you know,
3531190	3534850	Scan more machines at a time or more threads at a time or any of
3534850	3537790	That stuff at a time. It really depends on your nessus
3537790	3540970	Server how fast that scan is going to happen.
3540970	3543770	At any time, we can just click on the update tree button and we
3543770	3546990	Can see how far the scan has gone and what we've done there
3546990	3548790	And, you know, get the output back.
3548790	3551190	It's, you know, the same old, same old.
3551190	3554950	We've all seen this before. It's just a different flavor,
3554950	3557630	Different interface, but it's not doing anything else.
3559510	3561830	And it will tell you when the scan is done.
3562150	3565150	You can see there's still a bug there at the bottom as well.
3565150	3568470	We sorted that out as well. But i thought, you know, let me
3568470	3571210	Rather have the bug in there and you can see that it's really
3571210	3573870	Running and not a video recording somewhere.
3574850	3578030	It also now shows you the actual issues.
3579110	3580990	Right. Okay.
3580990	3587850	So let's move on. We've done the vulnerability discovery.
3587850	3590850	The only thing that's left to do is basically exploit those
3590850	3595570	Vulnerabilities, right? now, again, we don't want to
3595570	3600570	Reinvent the wheel here. So we have this thing talk to a
3601090	3604570	Nice exploitation framework, which is metasploit.
3604670	3606690	There's a couple of others as well.
3606690	3611410	But metasploit is quite neat. So what do we have to do?
3611410	3614750	We write a metasploit client. Now, the problem with
3614750	3618390	Metasploit, it's actually not a problem with metasploit, it's a
3618390	3619830	Problem with us, okay, is that it's very operating
3623650	3628630	Specific, which is this exploit will work against, you know,
3628630	3635430	Windows 2k service pack 2. We don't have that information,
3635430	3637010	Right? we don't have that kind of
3637010	3638610	Level of information about our targets.
3638610	3641790	If we were internal to the network, we can do funky stuff.
3641870	3643630	But we're not. We're external.
3643690	3646570	So we don't have the information. So what do we do is we select
3646570	3649230	The target number zero and we hope for the best.
3649250	3651610	Because a lot of the metasploit plug-ins actually does a brute
3651610	3653990	Force. So we don't have to supply it.
3654370	3656830	What else is it that we have to supply to metasploit?
3656830	3659590	We have to supply the remote port, right?
3659850	3662750	But the remote port we can pick up from the nasus scan.
3663250	3665870	Because let's say your server was running on, your web server
3665870	3671490	Was running on port 27, right? the nasus would pick it up as on
3671490	3674070	Port 27. And we have that port, right?
3674070	3676630	We know when stuff is ssl as well.
3676870	3680770	So we can specify in metasploit if it's got to use ssl or not.
3682190	3685590	And we have the local ip address as well.
3685590	3688990	If we have, if we're doing, for instance, a reverse shell.
3688990	3693110	Because that's our ip address. So most of the stuff we have.
3693130	3696270	The only thing that we don't have is we don't have a way to
3696270	3703210	Tie up a metasploit exploit with the nasus id, right?
3703210	3708450	So basically saying we use nasus to identify the weakness.
3708950	3711030	And we use metasploit to exploit it.
3711030	3712830	But how do you tie the two together?
3713490	3715350	So what we've done, where's gareth?
3716230	3722390	What gareth has done there, gareth phillips, right in front
3722390	3726670	Of the camera, he's been a week basically, you know, tying these
3726670	3730570	Two things up, saying here's a metasploit exploit, okay?
3730570	3733690	Is there a nasus plug-in that will identify this particular
3733690	3736750	Problem? and if he can find it, he
3736750	3738930	Basically writes it down in a little list.
3738930	3742950	Says this exploit, that plug-in. And if there's multiple plug-ins
3742950	3746090	For a specific exploit, he's got them listed there.
3746090	3753130	And if there's no nasus plug-in for the metasploit exploit,
3753130	3759050	That's, a, scary, right? and so, b, he would write some
3759050	3760650	Of them. So how many did we write?
3760910	3764950	We write about four, five. And i think at the moment, in
3764950	3769530	Terms of tying the stuff together, we need another 13 of
3769530	3773050	The 70, how many, 70? 78.
3773270	3775650	78 exploits. That was, you know, the
3775650	3778490	Adding to it the whole time. The rest of the stuff is pretty
3778490	3781910	Much mapped, okay? and what we're hoping to do,
3781910	3786190	And i'll beg hd for this, is to see if we can get it so
3786190	3788690	That when they write new exploits for metasploit, they
3788690	3792350	Include a nasus id in there. And if there's no nasus id,
3792350	3795030	Then they basically write a nasus check for it.
3795870	3798570	Because then we can just query, you know, the framework and get
3798570	3801150	The ids out of it dynamically, and we don't have to keep this
3801150	3802370	List. And we're not going to keep
3802370	3805030	This list current, okay? that's not what we do.
3805750	3808470	Okay. So let's see, let's see how it works.
3809630	3812150	Okay. So for this instance, we're
3812150	3813850	Looking at a vmware server, right?
3813850	3817090	We're not, this is just a vmware server.
3818770	3822370	Now, what's interesting here is, when we now do our nasus
3822370	3826190	Scan, right, why do we have to check for all the nasus ids?
3827010	3831130	We only check for the ones that's got related metasploit
3831870	3836050	Exploits, right? we check for those 72 minus
3836050	3839210	13 nasus ids that we already got.
3839230	3843090	So what i'm doing here is i'm basically running a nasus scan
3843090	3847510	Against the ip address and only using the, i'm only using the
3847510	3853470	List of nasus ids with related metasploit plug-ins.
3853910	3856330	And you can see it, it can do it rather quickly.
3856910	3860530	So there, it's done. And we found three issues.
3861190	3863890	You click on it, you'll basically see, it should be all
3863890	3866190	Red, right? the last one, i don't know,
3866190	3869290	It's a bug. Basically tells you these are
3869290	3871830	The three heavy issues that we found on this machine.
3871830	3877230	You can look at them. And when you go to metasploit,
3877230	3880030	What you do is you click on that little button over there,
3880030	3882430	And that loads the definitions in.
3882430	3885750	Hang on. That basically loads the
3885750	3889110	Definitions in that says this is the nasus id that matches with
3889110	3892570	This metasploit id. Once we have that, we can
3892570	3895350	Simply click on a thing that says find the matching target.
3895530	3898970	So now it will go through the entire nasus scan, right?
3898970	3902050	Of all the machines that we want to scan, and it's going to
3902050	3907170	Pick out the ones that has related metasploit ids and say
3907170	3910210	These are potential targets. If you run the metasploit exploit
3910210	3913210	Against this, you have a good chance that it's going to work.
3914610	3918070	And those are, that's obviously the same machine, right?
3918070	3921370	It's all the same machine. And there's identified four
3921370	3925130	Problems, four possible exploits that we can run against that machine.
3925130	3928810	We now have to configure our exploits.
3930170	3934110	So we're going to go for, which one is it, the decom one?
3934110	3935790	No. Yes.
3935790	3937810	It will tell you what the exploit is all about.
3937870	3940290	Now you've got to select what you want to do with that thing.
3940550	3943290	So you configure the exploit. Click.
3944590	3947850	And it basically dynamically queries the framework and tells
3947850	3951430	You for that exploit, these are the different payloads that you
3951430	3954810	Can have, right? that's the reverse.
3954810	3961630	And the stuff that you have to fill out, okay, the stuff that
3961630	3963990	You have to fill out, you can fill out, right?
3963990	3966890	The rest of the stuff is automatically populated with all
3966890	3969050	The information that we know at this stage.
3969750	3971530	Okay. So i'm going to bring up the
3973210	3975370	Vmware machine. There we go.
3975370	3979370	I've configured the rest of the exploits as well, but i didn't
3979370	3981910	Want to go through that. And you can save it as well.
3982150	3984850	And i start the metasploit framework on this side.
3984850	3987930	It could be sitting on any box, right, at this stage it's just
3987930	3991110	Sitting on your local machine. But you can have it speak to a
3991110	3995450	Metasploit framework on a remote machine as well.
3995450	3997830	And that's it. We click on start.
3997830	4002430	And now it's basically running those exploits against the machines.
4002430	4005710	Remember, those machines could be a whole lot of machines.
4006090	4010090	If you're scanning a large organization, again, you know,
4010090	4012130	Through the whole thing. Okay.
4012130	4014370	And when it's done, what we expect is that in the framework
4014370	4016230	We're going to have those shells.
4017550	4023190	And lo and behold, if you click on sessions, hey, there you go.
4023190	4025810	There's your shells. Okay.
4025810	4029530	And, you know, i think you all know what this looks like, right?
4029730	4032450	If you don't know, we're going to click on a session there just
4032450	4034270	So that you also see it's not bullshit.
4040320	4043100	Okay. You can do it.
4044100	4045960	All right. That's this metasploit.
4045960	4050540	Okay. Now, think about a large network.
4050540	4053720	Okay. Let's say you're even sitting
4054320	4060180	Internal on a network. Let me show you something.
4060500	4062720	This was done on an internal network.
4063080	4066740	I can't tell you who's network there.
4068320	4071100	I'm going to just load that data set in.
4074000	4076100	That's the one that says can't say who.
4076100	4078900	It's all text files. It saves it in text files.
4079760	4081640	Okay. This is the net blocks.
4081640	4083960	You check all the ten dot somethings in there.
4084220	4088420	And if we go to nesis, you'll find that there's lots of
4088420	4092500	Issues with these machines. A lot of them have the same
4092500	4095740	Issue, right? but some have some interesting
4095740	4098880	Issues in there, like dot printer and those kind of
4098880	4101760	Overflows. In metasploit, look at this.
4101860	4103320	Okay. If you click on matching
4103320	4108340	Targets, it's kind of funny.
4109760	4113380	That's worm territory, man. Okay.
4113920	4119040	So in a perfect world, sorry, yes.
4150570	4152970	Okay. Can we take this offline
4152970	4154670	Afterwards? okay.
4155930	4159390	So but i will speak to you. So are we done?
4159390	4162450	In a perfect world, we're done. In a perfect world, we're done.
4162450	4165350	And we, you know, we've done our assessment and this.
4165350	4168170	But if you're doing assessments, can i just see in this room
4168170	4171310	Here who actually has to write reports?
4172270	4174690	Aha. I thought so much.
4174910	4177550	So in a perfect world, you have to write reports.
4177630	4181110	You don't have to write reports. In a perfect world, there's no
4181110	4183270	False positives. Nowhere.
4183390	4187270	Nesis never makes a mistake. Well, guess what?
4187270	4189490	It does, right? and sometimes the stuff that
4189490	4191090	It gives you is just not relevant.
4191090	4195450	So what we've done is we have this thing.
4196410	4202850	To start off with, you know, within the nesis scan, you can
4202850	4205270	Mark something as a false positive, right?
4205590	4211490	If you really want to. And you can basically say mark
4211490	4215730	This as a false positive across the entire range of scans that
4215730	4218630	You've done. And you can comment on the
4218630	4221470	Stuff. And what's nice about this is
4221470	4224430	That when you go back to your targeting section, you can
4224430	4227850	Basically then go and say, well, let's find wherever i put that
4227850	4231030	Comment in. Or you can basically say, let's
4231030	4235130	Search all the machines that nesis croaked about on, i don't
4235130	4238090	Know, usable name server, for instance, right?
4238090	4240430	And i want to find those machines because those are the
4240430	4244170	Machines i need to attack or defend.
4244170	4246610	I need to patch these machines or i need to attack these
4246610	4248770	Machines, right? so you can very easily do
4248770	4253090	That kind of advanced targeting.
4255050	4258110	Supposed to be one. Okay?
4259170	4262590	And what's nice about this thing as well is the last tag on this
4262590	4267430	Thing basically does a lot of the reporting work for you,
4267430	4269030	Okay? so you have to write these
4269030	4272210	Things out for your boss. You have to give it out to a
4272210	4275930	Client. It would go a long, long way
4275930	4280750	To basically help you not to have to write that report.
4280910	4283330	The reason why we do this, the reason why we use this tool and
4283330	4286710	Develop this tool was that we use it internally, right?
4286710	4289750	And we want to spend our time doing interesting stuff.
4289750	4291210	Okay? we want to do the more
4291210	4293210	Interesting work of an assessment.
4293210	4296170	We don't want to spend time writing reports and basically
4296670	4301610	Having to copy and paste from a nesis report into a real report.
4301610	4305570	You know, that stuff, we want to play with the interesting stuff.
4305570	4309870	And that's why we have this particular, it's just going on
4309870	4312410	There, but i can't forward the video, actually.
4313530	4314950	There we go. There's the reporting.
4318370	4320270	I'm just doing the host tables now.
4320370	4322070	So basically we have all the information, right?
4322070	4323710	We have the forwards. We have the reverse.
4323830	4325690	We have the domains. We have the banners.
4325690	4327490	We have the open ports. We have the issues.
4327490	4330150	We have the severity of the issues. We have all of these things.
4330370	4333830	So we can basically take one host and build up a kind of a
4333830	4337010	Host table that says this is the entire machine.
4337010	4339130	This is what the machine looks like, right?
4340290	4343730	It's an mx record. It has this ip address.
4343730	4346210	It has these ports open. It has these banners.
4347610	4350470	Okay? and it has these nesis ids with
4350470	4353370	Whatever impact. And that happens all
4353370	4355470	Automatically because we don't want to do it.
4355470	4357690	All the comments that we put in there, if there's a comment that
4357690	4361630	We wanted to put in there, then that comment is also retained.
4362150	4364810	So you can see there it says analyst comment.
4365390	4368530	That's a comment that we put in there in the past.
4368530	4371530	It's really nice for banners as well.
4371530	4375250	So if you do banner scanning and then you sort by banner, you can
4375250	4378870	See immediately these are all my is5 machines or this is the
4378870	4382330	Target's is5 machines. This is the target's this.
4382330	4384730	All of those things come out quite neatly.
4385190	4387010	Okay. So what's the bottom line?
4387390	4391130	The bottom line is this tool is basically doing 80 of the work
4391130	4394490	In 20 of the time that it takes us to do.
4394570	4399430	Which leaves us with 80 of the time that we can play with more
4399430	4401370	Interesting things. Okay?
4402450	4405230	Some of the steps of the methodology is really hard to
4405230	4407970	Automate. And it's usually where there's
4407970	4409970	Exceptions. You know, there's exception to
4409970	4412450	The rule. Makes it very hard to automate.
4413550	4417510	Hopefully it will also raise the bar on people that, you know,
4417510	4420250	Do penetration. I'm a penetration testing
4420250	4424190	Specialist kind of dude. Because these things, i mean,
4424190	4427550	The report that you get out of this is just about the same
4427550	4430810	Report as these people are doing in a long, long, long time and
4430810	4435270	Charging a lot of money for it. So that's hopefully what we're
4435270	4438050	Going to get out of it. In terms of release of this
4438050	4443250	Tool, there's always a problem here, right?
4443370	4446810	We've got the gentleman in front that's going to tell me, you're
4446810	4448510	Not going to release this, right?
4448550	4452530	I mean, this is point and click, you know, weapons of mass
4452530	4456670	Destruction. You're not going to release it,
4456670	4458970	Right? and then we've got the other
4458970	4462090	Side, which i guess is the rest of the class.
4462950	4465650	That's saying, okay, where do we download it?
4467170	4471470	So we build this version, which is a cripple version.
4471470	4474190	It's only crippled in two ways. Okay?
4474190	4477650	It runs for 20 minutes, and you can't save your data.
4477650	4480150	The rest of the stuff is exactly the same.
4480670	4483930	Okay? i just want to see, harun, are
4483930	4488450	We do we have time left? how much time do we have left?
4488950	4490590	30 minutes? okay, what we're going to do
4490590	4495390	Now is we're going to play with it a bit and see how it works in
4495390	4498690	Real life, okay? keep in mind, we're doing it
4498690	4501430	Via the wireless, and the wireless is kind of, you know,
4501430	4506190	Flaky because of the fact that we kind of ride next door to
4506190	4512390	The wi-fi shootout room. So if it's not handling itself
4512390	4517870	Well, then you know why. Okay.
4520700	4523340	So this is what the tool looks like.
4525800	4528520	All right. It's a, the new release is a
4528520	4532820	Little bit more friendlier and so forth and so on.
4532820	4536060	Okay. So are we good?
4536380	4537840	Okay. Let's just see if i can get out
4537840	4540940	To the net. Okay.
4540940	4548040	As you can see, it's kind of, you know, yeah.
4548100	4549580	Okay. Okay.
4549580	4550980	So but let's give it a go. Okay.
4550980	4554200	So for subdomains, remember i told you subdomains,
4554740	4558440	Subdomains, but it actually gets really interesting.
4558440	4560840	So i want to put a domain in there.
4560840	4563760	So if you're from this organization, keep in mind that
4563760	4566520	We're only mining subdomains. We're not attacking your
4566520	4568580	Network. We're not going to go further
4568580	4571040	Than subdomains. Okay.
4571440	4573500	So i'm going to put in there a domain.
4576630	4578050	Right. I don't know if you can see
4578050	4590420	That. If you can't, remember, it's
4590420	4593320	Only subdomain mining. It's not anything else.
4593320	4595280	We're not attacking the network. We're not sending a single
4595280	4598000	Packet to that network. Okay.
4598000	4601480	And you can see that it's basically pulling down a whole
4601480	4604580	Lot of subdomains there. Okay.
4605960	4610420	Right. We got some interesting things
4610420	4615500	In there and e-mail addresses that we can mine as well if we
4615500	4618500	Want to use it for later use. Okay.
4618500	4623700	I'm going to stop this now. So let me just find the stop
4623700	4625640	Button. And then, of course, you can
4625640	4627940	Go to the forwards and you can simply input that and start
4627940	4630860	Doing all the forwards on that, which i'm not going to do.
4630960	4633700	Right. We actually have the permission
4633700	4639260	To look at some of the other network, good friends at
4639940	4642640	Electronic arts. Is frank here?
4642640	4644620	Frank? frank?
4645540	4649340	Frank is not here. But he said to us it's okay if
4649340	4654180	We show some of the stuff that we've done on there.
4654180	4656940	So i'm going to put in the ea. You know ea, ea sports.
4656940	4663380	It's in the game. Okay.
4663380	4667100	We're going to quickly go through there, see how that
4667100	4671420	Works. It's actually works quite nice.
4675590	4677570	Okay. So there you can see some
4679870	4683490	Burnout3.Ea and earth and beyond.Ea.Com.
4683650	4688730	And freedomfighters.Ea.Com. Those are all subdomains that
4688730	4691330	Actually belong to them. And it's just adding to the list
4691330	4694470	As we go along. It's actually a uefa
4695910	4699410	Championsleaguegame.Ea.Com. Once we have this stuff, i'm
4699410	4700890	Not going to go through all of this.
4701170	4703810	It's going to take a while to finish this up.
4703810	4706310	Takes about five minutes to run through one of these domains.
4706770	4709070	Okay. We can go to the forwards.
4710190	4715170	And basically just do this mouse is not working on this.
4715170	4720910	Come back here to import, right? and then we're going to start
4720910	4724230	Looking at the dns information at the forwards, right?
4724230	4727150	So those are what you see there. You can't see them, right?
4727150	4730810	Let me just um... those are the mx records and
4730810	4734570	The ns records. And as we go through there, we
4734570	4741810	Basically find trip w, obviously, ftp1, ftp, mail.
4743270	4746970	No, no, no, no, no, no. Okay.
4746970	4749770	Next one we find, i'm going to move over to the next tab.
4752450	4757190	Testing for cisco e-commerce. There we go.
4757190	4761270	Corporate.Ea.Com. And it's actually got two ip
4761270	4763950	Addresses. So i'm going to stop it over
4763950	4766550	There. I'm going to go to the net
4766550	4768470	Blocks, import the net blocks there.
4769210	4771330	I'm not going to spend a whole lot of time on the net block
4771330	4774230	Definitions. You can see they've got a class b
4774230	4777230	Network, right? if i get the who's information
4777230	4785670	On this, it will tell me so. And, of course, you can do this
4785670	4787110	For any domain, right? there we go.
4787150	4789990	Electronic arts. You can see that it's a class b.
4789990	4791770	I'm not going to make it a class b now.
4791890	4793190	I'm just going to keep it there.
4794010	4796430	Import it there. Here's our matching filters
4796430	4799150	That we've got. I want to change all of those
4799150	4801590	Matching filters just to be ea.Com.
4804460	4806960	Okay. And we're doing multi-threaded, 25
4806960	4810120	Threads at a time. Reverse scan.
4810120	4815660	There we've got smtp-eu1.Ea.Com, which is your, i
4815660	4820400	Think it's the european smtp gateway.
4821080	4824720	Okay. You get the idea, right?
4824720	4827640	With them, it's really interesting when you start
4827640	4830940	Looking at the reverses because in the reverse of some of these
4830940	4834480	Blocks, you would find that they have a whole lot of domains.
4835340	4837620	For just about every game that they make, they have a domain
4837620	4840140	For it. And they have reverse dns
4840140	4843300	Entries that points to those ip address, from those ip
4843300	4846080	Addresses that point outwards. So you can get a whole lot of
4846080	4847580	Domains. I've collected all of the
4847580	4850500	Information earlier. I'll show you the full, you
4850500	4853340	Know, the complete, what the complete thing looks like.
4853340	4856560	Okay. So let's just stop this here.
4857100	4859980	We go to the port scanner. Basically import that stuff
4859980	4861800	Straight in there. Those are the blocks.
4861860	4864180	I promise you there's more blocks, but, you know, let's
4864180	4867900	Keep it sweet and short for now. I'm going to bind my driver.
4869140	4871140	I'm going to say use that interface.
4872400	4874660	And let's see what ports do you want to scan.
4874660	4876480	I'm not going to scan a whole lot of ports.
4876620	4881840	Let's just do 443, 80 and 25. See how it works.
4881840	4884140	Hopefully it will be good. Okay.
4884520	4887480	You can see at the bottom the speed at which this thing is
4887480	4890680	Scanning. It's quite fast.
4898080	4901280	And those are the machines that's basically coming back to it.
4901420	4903300	You'll see there's some duplicates in there.
4903560	4906760	What happens is the machine, that fin that i'm sending out, i
4906760	4908700	Was just kidding. I'm not sending the fin.
4909200	4911580	So the machines respond a couple of times.
4911980	4915440	It's just something i still need to sort out.
4916520	4918740	Okay. So there's a couple of 25s in
4918740	4920240	There. There's a 443.
4924020	4927960	And we're almost a third of the way in the port scan.
4929880	4933780	I'm not going to take your time looking at a progress bar.
4933780	4935800	So let's move on to the next one. You get the idea.
4935860	4938480	You can go through all of these machines.
4938480	4941740	There's a couple of nice ones. Okay.
4941740	4943900	There we go. Okay.
4943900	4946300	That starts looking better and better.
4946760	4949980	Okay. Let's just keep it running for a
4949980	4953580	Little bit longer. Okay.
4953580	4955100	And i'm going to stop it over there.
4955100	4957480	All right. So let's pull it in from the
4957480	4961580	Banners. Basically do this.
4961580	4967320	We bind our driver again. And we go to this one.
4967320	4969920	And let's do a scan. And there you can see the
4969920	4973340	Banners coming back in. Kind of quick, right?
4974540	4978540	Okay. We've already sent out the
4978540	4980000	Packets. These are just packets coming
4980000	4986200	Back at this stage. Got a 25-second wait for this
4986200	4990500	Thing. And there's not a lot more
4990500	4992280	Coming back at this stage, right?
4992640	4995380	So already at this stage what i can do is i can go to the
4995380	4997940	Targeting. I can update the tree.
4997940	5000720	I can say, well, i want to find apache boxes.
5001540	5003120	Okay. Search the tree.
5004100	5007120	And make those targets. Those are the apache boxes in
5007600	5009080	That range that we scanned, right?
5009080	5011860	Not a lot. I wonder if there's any
5011860	5014320	Microsoft boxes in there. Clear the selection.
5018560	5021280	It says microsoft is in the banner, right?
5021880	5024600	I think so, yeah. Clear the selection.
5024600	5026400	Search. We've got some.
5026760	5028460	Make them targets. There we go.
5028460	5031040	Those are the microsoft boxes in that network.
5031360	5033660	How long did it take me to get that information?
5033860	5036060	What, three minutes? okay.
5036200	5045500	We can go into the nasa scan. Maybe not.
5045500	5051080	Maybe some other day. No.
5051360	5053600	No, no, no, no. It's not all in the game.
5056580	5058220	Okay. I thank you very much.
5058220	5060240	And you've still got 20 minutes to catch the next talk.
5060240	5060700	Thanks.