[00:03.770 --> 00:08.570]  Okay, the line has trickled to a slow speed, so we're going to get started.
[00:09.250 --> 00:11.750]  One quick announcement to remind you all of.
[00:12.050 --> 00:14.470]  Photographs of the speakers are with their permissions.
[00:14.570 --> 00:17.550]  Photographs of the audience, not allowed.
[00:17.550 --> 00:20.350]  If we find you doing it, you will be removed.
[00:20.770 --> 00:24.010]  And with that, SensPost and Rulof.
[00:35.280 --> 00:37.020]  Hello, hello.
[00:37.740 --> 00:39.200]  Okay, let's see.
[00:39.200 --> 00:43.540]  Just a couple of things before we start.
[00:43.980 --> 00:46.460]  I'm going to try speaking to the mic the whole time.
[00:46.640 --> 00:50.860]  Kind of, you know, maybe do it like this.
[00:52.320 --> 00:53.880]  Like that. Okay.
[00:53.900 --> 00:58.480]  Let's see. Okay, before we begin, most of
[00:58.480 --> 01:01.420]  The stuff you can find at that url over there.
[01:01.800 --> 01:05.740]  That's just for, you know, if we don't get through all of this, i
[01:05.740 --> 01:09.540]  Think we would, because we've got a double session, so there
[01:09.540 --> 01:11.780]  Shouldn't be a problem, but if you want to write that down,
[01:12.500 --> 01:14.760]  That's where you can find the tool that we'll be showing
[01:14.760 --> 01:19.060]  Today. Then also at amsterdam, we
[01:19.060 --> 01:23.620]  Actually made a promise that we would release a web application
[01:23.620 --> 01:28.720]  Scanner that is also available for download at the url on the
[01:28.720 --> 01:33.100]  Screen. In terms of time considerations,
[01:33.100 --> 01:38.120]  There's a lot that we must cover. We're basically going to go
[01:38.120 --> 01:42.480]  Through the presentation, and then afterwards, we're going to
[01:42.480 --> 01:45.520]  Do a bit of a live demo. We're having issues with the
[01:45.520 --> 01:47.680]  Wireless at the moment, but hopefully by that time, it
[01:47.680 --> 01:51.200]  Should be sorted out, so then we can go through a bit of live
[01:51.200 --> 01:56.240]  Demo on this thing. Just something to start off
[01:56.240 --> 02:00.580]  With, you know, there's a lot of shows that you can go see here
[02:00.580 --> 02:03.420]  In vegas. I've heard that, you know,
[02:03.420 --> 02:09.600]  Humanity is quite good, and elton john, and dan
[02:11.280 --> 02:17.020]  Kaminsky. So this is a presentation.
[02:17.020 --> 02:19.000]  There won't be any drinking on the stage.
[02:19.980 --> 02:25.160]  And it's not a show. So basically, let me give you
[02:25.160 --> 02:29.040]  Introduction. Let me just quickly, like,
[02:29.040 --> 02:32.680]  Briefly tell you about sense post. We're a company of about 15 people in
[02:32.680 --> 02:35.680]  South africa. We do external, internal
[02:36.700 --> 02:41.180]  Assessments, color penetration testing. We've done it for the last five
[02:41.180 --> 02:45.080]  Years. We've been talking at black hat
[02:45.080 --> 02:47.660]  For the last four years in defcon.
[02:49.040 --> 02:52.340]  And in our work, what we basically do, amongst other
[02:52.340 --> 02:57.080]  Things, is we break into networks. We train as well.
[02:57.080 --> 03:00.780]  We do training at black hat. We've trained a record amount of
[03:00.780 --> 03:06.080]  People this year at black hat. And we train them using, basically
[03:06.080 --> 03:10.500]  Tell them about a methodology that we use to break into
[03:10.500 --> 03:13.700]  Networks from the internet. This is not for internal.
[03:13.700 --> 03:18.900]  It's from over the internet. And so we're pretty sure that our
[03:18.900 --> 03:22.480]  Methodology kind of works. It seems to be working.
[03:22.480 --> 03:26.800]  We've seen the insides of more internal networks than we kind of
[03:26.800 --> 03:31.380]  Care to see. So what we've done is we've
[03:31.380 --> 03:35.440]  Basically said this methodology that we have, let's see how much
[03:35.440 --> 03:40.140]  Of this can be automated. So the idea was to basically
[03:40.140 --> 03:45.020]  Take every step of the way and check if that step can be
[03:45.020 --> 03:47.740]  Automated and to what kind of level of accuracy it can be
[03:47.740 --> 03:51.920]  Automated so that by the end of the day, hopefully most of the
[03:51.920 --> 03:54.660]  Stuff that we have to do manually, we can now do
[03:54.660 --> 03:58.860]  Automatically. So the talk is really about the
[03:59.260 --> 04:04.200]  Methodology itself, which parts of the methodology can be
[04:04.200 --> 04:08.160]  Automated, where it really works well and where it really breaks
[04:08.160 --> 04:12.440]  Down badly. And when it breaks down badly,
[04:12.440 --> 04:15.800]  Why it actually breaks down badly.
[04:16.400 --> 04:19.180]  And at the end, we're going to quickly talk about some
[04:19.180 --> 04:23.780]  Implications that this tool will have for, you know, the more
[04:23.780 --> 04:27.980]  Mediocre pen testers out there. Because i guess there's a couple
[04:27.980 --> 04:33.100]  Of those. Okay. So in order to automate
[04:33.100 --> 04:37.700]  Something, if you want to automate something, you need to
[04:37.700 --> 04:39.500]  Code it, right? you need to be able to write it
[04:39.500 --> 04:43.800]  Down and code it. And to code it, you need to
[04:43.800 --> 04:48.780]  Have some kind of algorithm. And in order to have an
[04:48.780 --> 04:52.060]  Algorithm, you need to really, really understand what it is
[04:52.060 --> 04:54.740]  That you're trying to do. I find a lot of people that
[04:54.740 --> 04:57.680]  Starting to write code for something that they don't
[04:57.680 --> 05:01.000]  Understand yet. So the idea is never really that
[05:01.000 --> 05:04.800]  The coding should take a lot of the time.
[05:04.800 --> 05:07.700]  The idea would be that understanding the process that
[05:07.700 --> 05:11.700]  You're trying to do would be taking the time.
[05:12.380 --> 05:17.280]  And having done hundreds and hundreds of assessments, we kind
[05:17.280 --> 05:20.220]  Of know what it is that we want to do.
[05:20.220 --> 05:22.280]  It's not just a question of coding it.
[05:24.440 --> 05:26.980]  With anything that you automate, if you can write it
[05:26.980 --> 05:31.360]  Down on a piece of paper in a kind of a flow chart, and you
[05:31.360 --> 05:34.320]  Know exactly what it is that you're writing down, and the
[05:34.320 --> 05:37.380]  Flow chart works, then you can code it, right?
[05:37.380 --> 05:39.820]  Then it's just a question of saying we have to take this
[05:39.820 --> 05:44.560]  Stuff and then write it in code. The problem comes in with
[05:44.560 --> 05:46.880]  Automation is when there's exceptions.
[05:46.880 --> 05:51.380]  So the situation might be we can do this in this case.
[05:51.620 --> 05:55.040]  But, you know, one out of a thousand times, the result is
[05:55.040 --> 05:56.560]  Going to look a little bit different.
[05:57.240 --> 05:59.440]  And if you still want to automate it, you need to make
[05:59.440 --> 06:02.360]  Sure that you're catching that exception.
[06:02.500 --> 06:05.900]  So as soon as, and you will see this during the talk, as soon
[06:05.900 --> 06:08.000]  As there's exceptions and as soon as there's something that
[06:08.000 --> 06:12.560]  We don't really understand how it's working, or we have to
[06:12.560 --> 06:16.660]  Make, we have to see how many different exceptions there are
[06:16.660 --> 06:20.060]  And have to write a piece of code or a code path for all of
[06:20.060 --> 06:25.080]  Those different exceptions, it becomes very, very difficult to do.
[06:25.220 --> 06:28.360]  Okay? now, the trade-off there is that
[06:28.360 --> 06:34.280]  If you have something that works 99.9 of the time and it's
[06:34.280 --> 06:37.920]  Going to take you a year to code the code path for the
[06:37.920 --> 06:41.040]  Exception, then you kind of live with it and you say it's
[06:41.040 --> 06:43.580]  Okay, we can live with this exception, we know that it
[06:43.580 --> 06:46.900]  Occurs, and it's not necessarily a bad thing, we can
[06:46.900 --> 06:48.900]  Maybe fix it manually afterwards.
[06:52.700 --> 06:56.020]  So there's a couple of weird perceptions in the industry
[06:56.020 --> 07:00.660]  Today, and you will find it at this conference, it would be
[07:00.660 --> 07:04.640]  The best place to find that kind of weird perception.
[07:05.400 --> 07:07.620]  And if you talk to anyone, just about anyone in this
[07:07.620 --> 07:10.960]  Conference, they would tell you that unix is good and windows
[07:10.960 --> 07:15.100]  Is bad, right? and then afterwards, you should
[07:15.100 --> 07:18.660]  Make a kind of sheep noise, because, you know, if
[07:18.660 --> 07:21.900]  Everybody says windows is good, unix is good and windows is
[07:21.900 --> 07:26.440]  Bad, then it must be, right? you will also see that a lot of
[07:26.440 --> 07:31.020]  People say that the problem with windows is that we have this
[07:31.740 --> 07:35.140]  Gooey apps that are running on windows, and with gooey apps,
[07:35.140 --> 07:37.680]  You can't really do a thing, because, you know, it's kind of
[07:37.680 --> 07:41.900]  A black box, and you don't have the flexibility that you have
[07:41.900 --> 07:46.700]  With unix tools. What i'm saying is, it really
[07:46.700 --> 07:51.000]  Depends on who's writing that gooey application, because you
[07:51.000 --> 07:53.600]  Can still have a gooey application and still have
[07:53.600 --> 07:57.000]  Flexibility, the same kind of flexibility that you would have
[07:57.000 --> 07:58.640]  On a unix. I don't want to go into this
[07:58.640 --> 08:01.940]  Too much, because i'm thinking people are going to assault me
[08:01.940 --> 08:05.900]  After this. I can see angry faces in the
[08:05.900 --> 08:10.180]  Crowd. Okay? but there's really a
[08:10.180 --> 08:15.560]  Perception out there that says, if something has a gooey
[08:15.560 --> 08:19.400]  Application, and i guess that's the fault that a lot of people
[08:19.400 --> 08:22.500]  That write applications is doing, is saying, as soon as we
[08:22.500 --> 08:27.060]  Stick a gooey on top of this thing, we need to dumb the
[08:27.060 --> 08:28.900]  Application down, because we think that people that are using
[08:28.900 --> 08:32.600]  Gooey tools are stupid. And so because we're now
[08:32.600 --> 08:35.860]  Catering for a crowd of people that's stupid, we need to have
[08:35.860 --> 08:38.780]  Our gooey really point and click and go.
[08:39.100 --> 08:43.120]  And it's really not the case. You can still build a gooey that
[08:43.120 --> 08:47.380]  Is very flexible and that has lots of potential to play with,
[08:48.100 --> 08:51.000]  If you assume that your users are not stupid.
[08:51.360 --> 08:54.840]  And it's something that we've done in the tool that i'm going
[08:54.840 --> 08:58.260]  To show you. We've basically written the
[08:58.260 --> 09:01.500]  Tool in such a way that everything that's input and
[09:01.500 --> 09:05.560]  Output goes into a text box. So at any time, what you can do
[09:05.560 --> 09:09.100]  Is you can select the whole text box and copy it into your
[09:09.100 --> 09:13.860]  Unix system and do your whole grip and set and all the nice
[09:13.860 --> 09:17.680]  Things that we like about unix. You don't have to export it in
[09:17.680 --> 09:22.860]  Some kind of a weird format and try to convert it into text and
[09:22.860 --> 09:26.660]  Then you can work with it. The other thing is that the text
[09:26.660 --> 09:31.060]  Boxes are hot, which means if you make a change in that text
[09:31.060 --> 09:33.840]  Box, that's a change that you've made to your data set.
[09:33.840 --> 09:37.900]  You don't have to write some kind of a sql statement in order
[09:37.900 --> 09:42.020]  To update this stuff somewhere within a database.
[09:42.120 --> 09:46.220]  That's totally database-less. Right.
[09:46.220 --> 09:52.080]  Now, the tool's name is called bdblah, right?
[09:52.640 --> 09:56.300]  Yeah, bdblah, as in blah, blah, blah, bdblah.
[09:57.020 --> 10:01.960]  And the tool that we written is really used for doing large-scale
[10:03.160 --> 10:06.520]  Assessments. Now, just a quick note on
[10:06.520 --> 10:09.860]  Assessment. If you're putting your domain
[10:09.860 --> 10:14.600]  In this tool, then this tool is doing an assessment.
[10:14.600 --> 10:18.460]  If you're putting someone else's domain in this tool, then
[10:18.460 --> 10:22.320]  You're doing an attack. So an attack and assessment is
[10:22.320 --> 10:26.320]  Kind of, you know, it really, when i'm doing this at black
[10:26.320 --> 10:29.380]  Hat, i'm saying this is an assessment tool.
[10:29.880 --> 10:32.820]  And when i'm doing it at defcon, i can tell you that you can
[10:32.820 --> 10:35.320]  Also use it as an attack tool. Right.
[10:36.360 --> 10:43.960]  Now, it's built to actually look to do assessments, okay, on
[10:43.960 --> 10:49.440]  Very large networks. The problem for demoing this
[10:49.440 --> 10:53.360]  Thing at a conference like this is that sense post does not have
[10:53.360 --> 10:58.440]  A very large network. Our clients, they have large
[10:58.440 --> 11:02.180]  Networks. But they won't appreciate it if
[11:02.180 --> 11:06.380]  We start showing the data on the screen at defcon, right?
[11:08.120 --> 11:13.240]  So what we're doing here is we're going to do some passive
[11:13.240 --> 11:16.180]  Work, which is totally passive. We're not sending any packets to
[11:16.180 --> 11:18.240]  The network. Well, not a lot.
[11:18.640 --> 11:23.060]  It's not an attack at all. No, generally, it's not a, you
[11:23.060 --> 11:25.460]  Will see, it's not like we're attacking anything.
[11:25.780 --> 11:29.460]  But we're going to do some passive work against just the
[11:29.460 --> 11:33.720]  IBM dns space, and we're going to do some passive work against
[11:34.220 --> 11:38.340]  Playboy, just because i thought, you know, if we get any results,
[11:38.340 --> 11:40.660]  It might be interesting to verify it.
[11:44.580 --> 11:49.600]  And then when we go active, we're going to look at the
[11:49.600 --> 11:53.760]  Sense post network, even if it's small.
[11:53.760 --> 11:56.320]  Keep in mind that, you know, it's a small network.
[11:56.320 --> 11:58.460]  You can do the same thing on a large network.
[11:58.460 --> 12:03.520]  And when we really go into attacking boxes and owning them,
[12:04.300 --> 12:08.160]  We'll be having a vmware server that we look at.
[12:09.220 --> 12:13.720]  Now, the problem with this stuff is there's a lot of risk in
[12:13.720 --> 12:16.920]  Doing this live. Okay?
[12:16.920 --> 12:21.180]  Because networks change all the time, and there might just be a
[12:21.180 --> 12:24.700]  Situation that when we did the scan yesterday, everything was
[12:24.700 --> 12:28.120]  Cool, but today there's a vulnerability on the machine.
[12:28.120 --> 12:31.980]  So we're not going to do it. Well, we might afterwards do
[12:31.980 --> 12:36.240]  Some stuff live. We'll see how it goes in terms
[12:36.240 --> 12:40.600]  Of time as well. But when we do stuff live, you
[12:40.600 --> 12:43.620]  Will know that we either have permission of the owners of that
[12:43.620 --> 12:47.200]  Network, or it's on our own network, right?
[12:47.300 --> 12:49.720]  So if there's any press in this room, i don't know if there's
[12:49.720 --> 12:54.440]  Any press, please, after this talk, please don't write an
[12:54.440 --> 12:58.440]  Article that says on stage, sense post attacked ibm and own
[12:58.440 --> 13:01.100]  The network, because that is not the case.
[13:01.540 --> 13:03.760]  We're not going to even try to do that.
[13:03.760 --> 13:07.000]  Okay. So what we've done is in the
[13:07.000 --> 13:12.200]  Things that in the pieces of demo that we have here, we've
[13:12.200 --> 13:16.500]  Basically taken some video clips of that screen captures and put
[13:16.500 --> 13:20.820]  It into a video. All of it is exactly the way
[13:20.820 --> 13:23.500]  That it works, and there's no trickery involved.
[13:23.500 --> 13:28.880]  However, sometimes we've paused the actual screen capture,
[13:28.880 --> 13:31.580]  Because, you know, when you're doing a reverse scan on a class
[13:31.580 --> 13:34.300]  B, that's going to take a while, and i don't want you to
[13:34.300 --> 13:37.020]  Sit here and look at the screen for half an hour seeing how we're
[13:37.020 --> 13:38.820]  Doing a reverse scan on a class b.
[13:39.400 --> 13:42.820]  So for that stuff, we've paused it, and it's kind of time
[13:42.820 --> 13:44.280]  Lapsed. But the rest of the stuff is
[13:44.280 --> 13:46.620]  Absolutely real. There's no image manipulation
[13:46.620 --> 13:49.100]  Done anyway. Right.
[13:49.100 --> 13:53.140]  So with that out of the way, let's have a look and see what
[13:53.140 --> 13:55.280]  Our external methodology looks like.
[13:55.280 --> 13:58.980]  Now, the people, can i just see in the class here, who's been
[13:58.980 --> 14:02.300]  On any of our boot camp classes at black cat?
[14:03.040 --> 14:04.760]  Some hands. Okay.
[14:05.020 --> 14:06.540]  Okay. Great stuff.
[14:06.540 --> 14:11.560]  Now, if you're on the boot camp class at black cat, you will
[14:11.560 --> 14:13.520]  Know this methodology quite well.
[14:13.520 --> 14:16.800]  I'm not going to go into it too much, because, you know, that's
[14:17.360 --> 14:20.580]  What the classes are there for. But basically it boils down to
[14:20.580 --> 14:23.060]  This. We start doing a footprint.
[14:23.960 --> 14:27.940]  From the footprint, we go on to a fingerprint.
[14:27.940 --> 14:30.900]  From there, we do targeting of systems that we would like to
[14:30.900 --> 14:33.140]  Attack. We then do vulnerability
[14:33.140 --> 14:37.480]  Discovery. And the last step is we actually
[14:37.480 --> 14:41.600]  Exploit those vulnerabilities to do penetration testing on the
[14:41.600 --> 14:46.060]  Host, on the network itself. Now, these, all of these little
[14:46.060 --> 14:50.120]  Blocks now break down into a whole lot of other sets of
[14:50.120 --> 14:51.500]  Blocks. So we're going to start with
[14:51.500 --> 14:55.640]  The footprinting. The footprinting can be
[14:55.640 --> 14:59.500]  Broken down into six blocks. Okay.
[14:59.500 --> 15:02.020]  The first block is we find the domains.
[15:02.020 --> 15:06.080]  Now, it seems very silly, because you might think that if
[15:06.080 --> 15:15.160]  You, let's say, attack, let's say you attack ibm, okay, then
[15:15.160 --> 15:17.740]  The place to start is ibm.Com. Right.
[15:17.740 --> 15:21.260]  And it's as easy as that. What you might not know is that
[15:21.260 --> 15:25.260]  Large organizations can have up to 2,000, 3,000 different
[15:25.260 --> 15:27.580]  Domains. And those domains all carry
[15:28.060 --> 15:30.540]  Dns information that's pointing to ip addresses.
[15:30.540 --> 15:33.880]  And those ip addresses sit within net blocks.
[15:33.980 --> 15:36.560]  And those net blocks might contain machines that are
[15:36.560 --> 15:41.540]  Vulnerable and that has access to the internal network or, you
[15:41.540 --> 15:44.280]  Know, connected via vpn into the internal network.
[15:44.320 --> 15:47.200]  So the idea is that we find as many domains as we can.
[15:47.200 --> 15:50.680]  And then go to the next step, which is to find subdomains
[15:50.680 --> 15:54.260]  Within those domains. And, again, finding subdomains
[15:54.260 --> 15:58.280]  In a domain might seem at this stage very kind of silly.
[15:58.280 --> 16:00.700]  But you'll see that it's actually quite interesting.
[16:01.240 --> 16:04.840]  We then do forward dns entries. So we basically look for
[16:04.840 --> 16:08.560]  Anything we can find within the forward zone.
[16:08.860 --> 16:10.940]  We get net blocks. We start trimming those net
[16:10.940 --> 16:14.740]  Blocks down to size. We might add other net blocks
[16:14.740 --> 16:18.200]  Into those net blocks. Once we're done with our net
[16:18.200 --> 16:21.180]  Blocks, the first round of definition of our net blocks,
[16:21.180 --> 16:25.660]  We do a dns reverse scan of that particular block.
[16:25.960 --> 16:27.860]  And that might lead to two things.
[16:27.860 --> 16:31.020]  The first is we might find new domains coming out that we
[16:31.020 --> 16:33.680]  Didn't know about. It almost always happens.
[16:34.800 --> 16:39.380]  And we find that maybe our net blocks weren't defined so
[16:39.380 --> 16:41.800]  Nicely. So we can redefine our net
[16:41.800 --> 16:44.940]  Blocks at that stage if it needs to be redefined.
[16:45.380 --> 16:49.020]  Once we have our net blocks nicely tied down, we can go to
[16:49.020 --> 16:52.260]  The next step, which is vitality testing.
[16:52.320 --> 16:54.640]  Vitality testing or vitality scanning.
[16:54.780 --> 16:56.920]  The idea is you sit with a class b.
[16:56.920 --> 16:59.460]  You're going to run an s scan against a class b?
[16:59.460 --> 17:02.580]  I don't think so, right? The idea there is to find
[17:02.580 --> 17:07.440]  Machines that are alive within a big network space so that we
[17:07.440 --> 17:10.640]  Can do targeting on it in the next step and decide which of
[17:10.640 --> 17:14.080]  Those machines within that big piece of space is interesting
[17:14.080 --> 17:18.120]  To attack. Now, this footprinting
[17:18.120 --> 17:23.220]  Methodology, these six blocks that are here can now be broken
[17:23.220 --> 17:26.420]  Down into more blocks. Okay?
[17:26.420 --> 17:29.380]  It's like, you know, what is it, russian dolls?
[17:29.840 --> 17:32.680]  You keep taking out the dolls, it's the same thing over here.
[17:35.760 --> 17:38.060]  Okay. So just to give you an overview
[17:38.060 --> 17:41.600]  Of how this whole thing sits together, i've made this movie.
[17:41.740 --> 17:45.160]  I've made this movie using visual and word.
[17:45.160 --> 17:49.480]  So it's a little bit sucky, i know, but, you know.
[17:51.280 --> 17:53.620]  So we start with the main domain.
[17:53.680 --> 17:56.280]  From that domain we get subdomains.
[17:56.940 --> 17:59.860]  From the subdomains we start doing forward lookups.
[17:59.860 --> 18:02.260]  That's pointing to ip addresses, right?
[18:02.260 --> 18:04.380]  Those are the little arrows at the end.
[18:04.900 --> 18:09.260]  From that we start our first round of net block definitions.
[18:09.260 --> 18:14.140]  It might be one ip big. It might be, you know, class c.
[18:14.140 --> 18:16.720]  At this stage we actually don't know.
[18:16.880 --> 18:20.180]  We do reverse entries. Reverse dns entries.
[18:20.180 --> 18:21.240]  I'm just going to pause it over here.
[18:21.240 --> 18:24.520]  That's the red lines. And from the reverse we can get
[18:24.520 --> 18:28.060]  New domains, right, which might be related.
[18:28.060 --> 18:30.280]  Or that could be totally unrelated.
[18:32.660 --> 18:37.020]  This will help us to define our net blocks even nicer.
[18:37.360 --> 18:40.300]  Make the net block definition even tighter.
[18:40.300 --> 18:43.940]  As you can see here, we've now broken those net blocks into
[18:43.940 --> 18:47.580]  Smaller blocks. Once we're done with that, we're
[18:47.580 --> 18:49.900]  Going to go on and do vitality scanning.
[18:49.900 --> 18:53.040]  Those are the little dots you see over there in the x's for
[18:53.040 --> 18:56.380]  Closed ports. Once we have those machines
[18:56.380 --> 19:00.240]  Within those networks defined, we can do a port scan on those
[19:00.240 --> 19:03.820]  Machines to find out exactly what ports are open on each of
[19:03.820 --> 19:07.640]  Those ip addresses. And once we have that, we can
[19:07.640 --> 19:11.360]  Basically start doing vulnerability finding.
[19:11.360 --> 19:14.880]  So there, for instance, we have the apache 132 chunk encoding
[19:14.880 --> 19:19.860]  Problem that sits on one port, on one ip, within one network
[19:19.860 --> 19:22.860]  That was given to us by one domain.
[19:23.280 --> 19:26.220]  In this case, we're using one domain.
[19:26.260 --> 19:28.100]  You can use as many domains as you wish.
[19:28.100 --> 19:30.560]  Like i said, some of the big corporations have up to
[19:31.480 --> 19:34.660]  Thousands of domains. So this is the picture.
[19:34.660 --> 19:36.400]  This is the whole picture of the thing.
[19:36.400 --> 19:38.200]  Let's see how it actually works.
[19:39.680 --> 19:44.560]  So within the footprint, remember we went into this.
[19:44.600 --> 19:47.080]  This is now the first block finding the domains.
[19:47.240 --> 19:51.100]  I'm going to go into that. We haven't implemented this
[19:51.100 --> 19:54.860]  Within this tool. And i'll tell you later on why
[19:54.860 --> 19:57.780]  We haven't implemented this. It's one of those things where
[19:57.780 --> 20:01.420]  There's lots of exceptions and it's not that easy to implement.
[20:01.420 --> 20:04.460]  We started doing it. But it's not there yet.
[20:04.460 --> 20:06.180]  So you won't see it within this tool.
[20:06.180 --> 20:12.160]  For the subdomain mining, what we basically do is we start
[20:12.160 --> 20:17.340]  Off with a domain itself. Now, let me ask you this.
[20:17.340 --> 20:21.780]  If you google for ibm, let's take ibm as an example.
[20:21.900 --> 20:24.320]  And please, again, i've got nothing against them.
[20:24.520 --> 20:28.800]  If you google for ibm, yeah, i'm using an ibm notebook.
[20:28.800 --> 20:35.680]  Come on. If you google ibm, okay, you're
[20:35.680 --> 20:39.240]  Going to find a whole lot of hits, right, that points to
[20:39.240 --> 20:44.020]  Machines that's sitting on a domain ibm.Com.
[20:44.080 --> 20:47.240]  So, for instance, one of the links that you might get is
[20:47.240 --> 20:52.020]  Something coming off a site called tripwchess.Ibm.Com.
[20:52.020 --> 20:54.980]  Not chest, no. Chess, right?
[20:55.000 --> 20:59.340]  Okay. And what do we know from that?
[20:59.640 --> 21:04.060]  We know there's a subdomain called chess.Ibm.Com, right?
[21:04.060 --> 21:07.440]  And as we go along, we can google for different kind of
[21:07.440 --> 21:11.580]  Common words and look if it's related, if it is within the
[21:11.580 --> 21:15.520]  Ibm.Com domain, and using google, we can basically pull
[21:15.520 --> 21:19.680]  Out a whole list of subdomains. We can also pull out a whole
[21:19.680 --> 21:22.700]  Lot of domains itself, a whole lot of dns names itself,
[21:22.700 --> 21:27.340]  Because if something resides on tripwchess.Ibm.Com, then we
[21:27.340 --> 21:32.020]  Know that tripwchess.Ibm.Com exists, which gives us one
[21:32.020 --> 21:36.140]  Forward entry in our table of maybe lots of forward entries
[21:36.140 --> 21:39.400]  That we're going to pick up later. Everybody's cool with that, right?
[21:39.480 --> 21:43.000]  So let's see how it is actually done. Sorry, if you want to have
[21:43.000 --> 21:45.620]  More information about that, you should attend johnny long's
[21:45.620 --> 21:47.400]  Talk. He's doing a whole section on
[21:47.400 --> 21:50.720]  Subdomain mining. He's right there.
[21:51.160 --> 21:55.260]  Okay. So let's see how it works.
[21:55.260 --> 21:59.940]  Now, it normally takes about five minutes per domain to get
[22:00.580 --> 22:04.320]  Subdomains, and this is at the moment set to only look at the
[22:04.320 --> 22:07.260]  First three pages that google returns, right?
[22:07.260 --> 22:11.220]  So we can set it to return as many pages, but the kind of 80-20
[22:11.220 --> 22:16.280]  Principles at work here, we find 80% of the hits within 20% of
[22:16.280 --> 22:19.700]  The time, okay? so doing three pages is just
[22:19.700 --> 22:21.920]  About okay. And we've got a couple of
[22:21.920 --> 22:24.720]  Keywords that we can combine the search with.
[22:24.920 --> 22:26.940]  So i don't know if you can see there at the back.
[22:27.750 --> 22:30.340]  What we're going to do is i'm going to start playing this
[22:30.340 --> 22:35.740]  Video. So we enter ibm.Com in there
[22:35.740 --> 22:40.900]  And we hit the start button. And now the tool is basically
[22:40.900 --> 22:43.580]  Through the google api querying google.
[22:43.800 --> 22:46.680]  We also get e-mail addresses. So, for instance, there you
[22:46.680 --> 22:52.700]  Have no one, no one at us.Ibm.Com, and from that, we
[22:52.700 --> 22:56.920]  Obviously know that there's a subdomain called usa.Ibm.Com.
[22:58.300 --> 23:02.260]  When this tool is done, this is obviously time lapsed.
[23:02.280 --> 23:05.380]  You'll see on the right-hand side, we have a whole list of
[23:05.380 --> 23:09.700]  Subdomains. Uk.Ibm.Com, us.
[23:09.700 --> 23:13.420]  Watson.Ibm.Chess and so forth and so on, okay?
[23:14.180 --> 23:18.180]  And while this might not look so interesting on ibm.Com, we
[23:18.180 --> 23:21.460]  Might afterwards show you an example that is more
[23:21.460 --> 23:26.120]  Interesting, okay? so basically what we have now
[23:26.120 --> 23:28.360]  Is we have the subdomains, right?
[23:28.360 --> 23:30.560]  We have the domains and we have the subdomains.
[23:30.560 --> 23:33.000]  And what we want to do is we want to find all the forward
[23:33.000 --> 23:35.880]  Entries that we can possibly find, right?
[23:36.180 --> 23:40.340]  So hang on a bit. What do you think would be
[23:40.340 --> 23:43.480]  The first step to check for when we're doing, when we're
[23:43.480 --> 23:46.600]  Finding forward dns entries? what would be the first thing
[23:47.120 --> 23:50.280]  That we would see if this is possible on the domain?
[23:50.480 --> 23:52.480]  Anyone? anyone? okay.
[23:52.480 --> 23:55.240]  Hang on a bit. Where's our t-shirts?
[23:55.240 --> 24:11.440]  Do we have t-shirts? let's see again.
[24:13.540 --> 24:16.280]  What would be the first thing that you do when you have a
[24:16.280 --> 24:19.980]  Domain and you want to find all the forward entries in the
[24:19.980 --> 24:22.540]  Domain? yes, sir.
[24:24.080 --> 24:26.260]  Sorry? no.
[24:26.260 --> 24:29.560]  Who said zone transfer? there you go.
[24:29.560 --> 24:30.660]  Okay. So the first thing that we're
[24:30.660 --> 24:33.840]  Going to do is we're going to attempt to do a zone transfer,
[24:33.840 --> 24:35.100]  Right? why?
[24:35.100 --> 24:37.360]  Because if we can transfer the zone, we get all the
[24:37.360 --> 24:39.660]  Information in the zone in one go.
[24:39.980 --> 24:42.640]  We don't have to mine for any dns data.
[24:42.640 --> 24:46.280]  We get the entire zone. So the first thing we're going
[24:46.280 --> 24:50.860]  To do is we're basically going to check for mx records and ns
[24:50.860 --> 24:53.820]  Records and then we're going to see if a zone transfer is
[24:53.820 --> 24:58.500]  Possible. Where's my handy laser pointer?
[24:58.500 --> 25:03.040]  If a zone transfer is possible, we immediately have all the
[25:03.040 --> 25:06.520]  Forwards within that list. The next thing we want to do if a
[25:06.520 --> 25:10.440]  Zone transfer is not possible, which is most likely the case,
[25:10.440 --> 25:13.220]  We're basically going to go through a hit list.
[25:13.220 --> 25:16.000]  I'll explain that just now. And from the hit list, we're
[25:16.000 --> 25:20.240]  Going to perform the forward and that's going to drop us into
[25:20.240 --> 25:22.900]  This container over there. Now, the hit list works like
[25:22.900 --> 25:27.880]  This, right? if you see that a machine
[25:27.880 --> 25:32.920]  Exists with the name of gandalf.Ibm.Com, what's the
[25:32.920 --> 25:37.300]  Chances that there will be a machine called frodo.Ibm.Com?
[25:37.820 --> 25:41.180]  Pretty good, right? so the idea what we're doing
[25:41.180 --> 25:44.920]  There is we're building a whole lot of lists, right, of things
[25:44.920 --> 25:50.220]  Like we have colors, we have animals, we have characters out
[25:50.220 --> 25:53.120]  Of lords of the rings, we have characters from hitchhiker's
[25:53.120 --> 25:57.340]  Guide to the galaxy, terry pratchett books, we have names
[25:57.340 --> 26:00.480]  Out of the bible and so forth and so on.
[26:00.480 --> 26:05.080]  And basically we test for four entries, it's configurable, but
[26:05.080 --> 26:07.620]  We test for four entries within that list.
[26:07.620 --> 26:11.400]  That list is sorted from the more popular names at the
[26:11.400 --> 26:14.020]  Beginning. And we basically check if one
[26:14.020 --> 26:16.800]  Of those names exists and if they do exist, we check the
[26:16.800 --> 26:21.960]  Whole list, okay? so it gives us a way of
[26:21.960 --> 26:25.340]  Finding out what kind of naming scheme these people are using,
[26:25.340 --> 26:29.940]  Using only four dns entries, dns queries, right?
[26:30.840 --> 26:33.000]  Because they're not going to have some kind of a weird name
[26:33.000 --> 26:36.060]  Out of lords of the rings and not have gandalf, right?
[26:36.060 --> 26:38.060]  They would have gandalf or frodo.
[26:38.900 --> 26:43.180]  So let's see how this works. Now, for this, we've done it on
[26:43.180 --> 26:48.600]  Playboy, okay? and we've now started with
[26:48.600 --> 26:51.780]  Doing the subdomains. In the case of playboy, we
[26:51.780 --> 26:55.440]  Only find two subdomains called casino.playboy.com and
[26:55.440 --> 27:00.060]  Playboynet.playboy.com. And what we're going to do is
[27:00.060 --> 27:02.800]  We're going to go on to the forwards, okay?
[27:02.860 --> 27:06.280]  When we click there, we can basically import the stuff from
[27:06.280 --> 27:10.240]  The previous section, okay? what you see there, sorry, i
[27:10.240 --> 27:13.400]  Missed this. Let's just pause it here.
[27:14.040 --> 27:17.480]  Can you see that at the back at all? probably not, right?
[27:17.520 --> 27:19.880]  Can you see at the back, people at the back, can you see the
[27:19.880 --> 27:22.860]  Actual lettering there? no?
[27:23.280 --> 27:31.360]  Dude, i'm sorry. No, i can't make it any larger.
[27:32.200 --> 27:35.340]  Okay, i can, but then, you know, that means rewriting the
[27:35.340 --> 27:37.880]  App for another font in that window there, okay?
[27:37.880 --> 27:40.240]  So basically what you see over there, just trust me on this,
[27:40.240 --> 27:41.420]  Okay? i'm not lying.
[27:41.420 --> 27:43.080]  And the people in front can verify.
[27:43.260 --> 27:47.060]  So what you're seeing there at that part of the screen over
[27:47.060 --> 27:51.100]  There is entries that we've already found with the google
[27:51.100 --> 27:53.200]  Search, right? those are already forward
[27:53.200 --> 27:56.100]  Entries that we found with the google search.
[27:57.060 --> 27:59.640]  So they exist. So now we're going to add to
[27:59.640 --> 28:02.620]  It. Let's just see if i can, okay?
[28:02.720 --> 28:06.980]  And i'm going to click on import, right?
[28:07.380 --> 28:11.380]  And we get our list over there of things that we have.
[28:11.580 --> 28:15.720]  Fruit, e-commerce, colors, names, music, all of that.
[28:15.960 --> 28:19.520]  And immediately when we do that, we start getting results.
[28:19.520 --> 28:21.940]  Now, those results there, i know you can't see it even if
[28:21.940 --> 28:24.880]  You're sitting in the front, those are the mx records and
[28:24.880 --> 28:27.540]  The ns records, okay? it's just in a different color.
[28:27.980 --> 28:31.020]  But we basically, here at the bottom, you'll see that we're
[28:31.020 --> 28:33.720]  Starting to check forward entries, right?
[28:33.720 --> 28:38.100]  And we already got ftp, we got content.playboy.com, which,
[28:38.100 --> 28:39.780]  You know, i don't know, it could be interesting.
[28:42.360 --> 28:45.860]  And at this stage, i've basically stopped it and let it
[28:45.860 --> 28:47.220]  Run through. The capture, i stopped the
[28:47.220 --> 28:49.280]  Capture. So you see there the end of
[28:49.280 --> 28:53.700]  The entire capture. You get machines like secure
[28:53.700 --> 29:00.020]  2.Playboy.com, it's all kind of interesting.
[29:00.120 --> 29:03.960]  The other thing that we can do is we can add at the end of a
[29:03.960 --> 29:07.340]  Forward, we basically add some fuzzing strings, okay?
[29:07.340 --> 29:13.420]  So when we test, for instance, ftp, we also test for ftp1 and
[29:13.420 --> 29:19.260]  Ftp2 and ftp-1 and ftp-2. And you can have as many as you
[29:21.160 --> 29:23.440]  Want, right? at the moment we were just
[29:23.440 --> 29:26.780]  Testing dash 1, dash 2, 1 and 2, okay?
[29:26.780 --> 29:29.800]  But it's basically kind of fuzzing the dns out.
[29:30.700 --> 29:35.060]  So what we have after this is we can collect all of the dns
[29:35.060 --> 29:38.760]  Forward entries that we can possibly get from a domain, we
[29:38.760 --> 29:43.360]  Can collect them in that text field on the right-hand side.
[29:43.360 --> 29:49.460]  Ah, shit. Okay.
[29:49.460 --> 29:52.620]  So the next step that we want to do is we basically want to
[29:53.320 --> 29:58.200]  Look at net blocks, okay? now, the idea is the first thing
[29:58.200 --> 30:01.440]  We can do is we can take all of those ip addresses that we had,
[30:01.440 --> 30:03.880]  Right? and we can slice off the last
[30:03.880 --> 30:07.580]  Digit from them and assume they're all class c's and start
[30:07.580 --> 30:10.680]  Off with a class c definition, right?
[30:10.680 --> 30:12.880]  Okay, we're going to start doing that.
[30:14.440 --> 30:20.260]  Absolutely. You're absolutely correct.
[30:20.760 --> 30:24.060]  So we're going to start by that. We've got to start somewhere.
[30:24.160 --> 30:26.420]  You're absolutely correct. So you'll see.
[30:26.880 --> 30:28.900]  Okay. And what we're going to do is
[30:28.900 --> 30:32.280]  We're going to add into that, see what the who's definition is
[30:32.280 --> 30:35.540]  Of that block to see if we can get the net block out of there.
[30:35.780 --> 30:38.280]  We're going to look at additional blocks like from
[30:38.280 --> 30:43.220]  And all of those wonderful places.
[30:44.140 --> 30:46.560]  But you'll see how that is also difficult to do.
[30:46.580 --> 30:51.160]  We're going to look at reverse dns entries to find out if the
[30:51.160 --> 30:53.920]  Blocks are at the correct boundaries.
[30:54.140 --> 30:57.280]  And another technique that we were looking at is to basically
[30:57.280 --> 31:02.440]  Find the as number of the root connected to that particular ip
[31:02.440 --> 31:05.960]  Address, then put that as number back in and see what other
[31:05.960 --> 31:09.240]  Roots are within the same as. Okay?
[31:10.140 --> 31:13.220]  And we'll talk about what the challenges are in that.
[31:13.680 --> 31:16.600]  So let's just look what happened to playboy.
[31:17.160 --> 31:19.980]  I'm going to start playing this thing again.
[31:20.580 --> 31:23.260]  All right. So we go to the next step.
[31:23.500 --> 31:27.800]  We do import, right? and at this stage, the tool
[31:27.800 --> 31:34.880]  Will tell you this will import from the forwards and assume
[31:34.880 --> 31:38.040]  Class c blocks, it might be a dangerous assumption.
[31:40.800 --> 31:43.080]  All right. Okay.
[31:43.080 --> 31:47.280]  So that's a start. And we see all of those 216s in
[31:47.280 --> 31:49.560]  There. They kind of look as if they
[31:49.560 --> 31:52.180]  Belong together. When you click on it, you
[31:52.180 --> 31:55.060]  Basically get all the forwards that sit within that block.
[31:56.400 --> 31:58.040]  Okay. Let's see.
[31:59.140 --> 32:00.620]  Okay. So there's a lot of the playboy
[32:00.620 --> 32:03.820]  Stuff coming, ftp, help. And we can click on the who's
[32:03.820 --> 32:06.820]  Button and basically get the who's information for that
[32:06.820 --> 32:11.220]  Block. And we see that, okay, that is
[32:11.220 --> 32:17.000]  Actually not a class c, but it's a couple of them.
[32:17.220 --> 32:20.200]  I think it's about, what, 16 class c's.
[32:20.540 --> 32:23.080]  And then we can simply change our block definition over there
[32:23.080 --> 32:28.380]  And say, okay, it's not from 36, it's from 128 all the way up
[32:28.380 --> 32:32.180]  To 143. As soon as we do that, the
[32:32.180 --> 32:34.700]  Other blocks that was there got kind of sucked into that list
[32:34.700 --> 32:37.660]  Because they're, you know, inside of that network now.
[32:38.880 --> 32:40.640]  Okay. In this case, you will see this
[32:40.640 --> 32:46.060]  Machine is a name server, 244. And we can have our blocks even
[32:46.060 --> 32:48.720]  One ip big. You know, we can have one ip,
[32:48.720 --> 32:50.820]  We can have a class b, we can have a class a.
[32:50.820 --> 32:53.500]  It really doesn't matter. We just change it to say that
[32:53.500 --> 32:56.920]  That thing is now only one ip large.
[33:01.800 --> 33:05.440]  Right. Okay.
[33:08.160 --> 33:14.820]  What's interesting here is we did the forwards on, just want
[33:14.820 --> 33:19.260]  To check if it's the case, we did the forwards on IBM as well.
[33:20.740 --> 33:24.840]  So you can have a look and see what their net blocks look like.
[33:24.840 --> 33:28.280]  You know, they got some crazy class bs out there.
[33:28.360 --> 33:32.140]  Look at the size of that block. There's a couple of class bs in
[33:32.140 --> 33:34.280]  There. Okay.
[33:34.280 --> 33:36.220]  So the next thing we're going to do is we're going to do
[33:36.220 --> 33:39.680]  Reverse dns scans. And the reverse dns scan looks
[33:39.680 --> 33:43.560]  Kind of intimidating. It's actually quite easy.
[33:44.020 --> 33:46.260]  We're going to start with the net blocks that we have at this
[33:46.260 --> 33:48.900]  Stage. We're going to do a reverse
[33:49.560 --> 33:53.000]  Dns entry on each of them. And then we're going to apply
[33:53.000 --> 33:56.120]  Some filters and say if this thing is contained within that
[33:56.120 --> 34:00.840]  Filter, okay, we say it's the match entry.
[34:00.960 --> 34:03.080]  We can extract the domain from there.
[34:03.340 --> 34:07.620]  See if the domain is already found in our list of domains
[34:07.620 --> 34:10.180]  That we supplied. If it's not, we can add the
[34:10.180 --> 34:12.500]  Domain. And if it doesn't match the
[34:12.500 --> 34:15.680]  Filter, we say hang on a bit, here's a domain within that
[34:15.680 --> 34:18.720]  Block that does not match your filter.
[34:18.720 --> 34:22.000]  Maybe it's interesting to have a look and see what else is on
[34:22.000 --> 34:24.940]  That domain. So let's see how this works.
[34:30.080 --> 34:31.400]  Okay. There's the forwards.
[34:31.400 --> 34:35.500]  It's now i.P. Sorted. You can go to the net blocks.
[34:35.600 --> 34:37.500]  Those are the net blocks that we defined.
[34:37.780 --> 34:40.580]  When we start the reverse, you'll see that it
[34:40.580 --> 34:43.680]  Automatically puts in the filters a list of the domains
[34:43.680 --> 34:45.700]  Because that's probably what you want to filter on.
[34:45.700 --> 34:48.180]  In our case, we change it so that it only says playboy
[34:48.180 --> 34:52.140]  Because maybe there's another playboy domain, playboypix.
[34:52.140 --> 34:55.200]  And we want that filter to pick it up as well.
[34:55.860 --> 34:58.540]  We start at the reverse now. You can see these are all the
[34:58.540 --> 35:02.600]  Entries that we get back. These are domains.
[35:02.600 --> 35:05.860]  There's playboyenterprise.com, for instance, that match the
[35:05.860 --> 35:09.380]  Filter, but we don't have playboy enterprise as a domain.
[35:09.380 --> 35:12.020]  So it's an additional domain that's a match domain that we
[35:12.020 --> 35:14.020]  Want to put back into the system, right?
[35:14.560 --> 35:17.260]  Now, this is not the speed at which it ran.
[35:17.420 --> 35:20.360]  I kind of paused it a couple of times so you don't have to sit
[35:20.360 --> 35:22.840]  Here the whole time looking at the thing running.
[35:23.160 --> 35:26.480]  At the bottom, you see there's something called, what is it?
[35:26.480 --> 35:32.040]  No, go down. Spicetv.com, right?
[35:32.400 --> 35:41.680]  If we do a whois on spicetv.com, right, you will see that it is
[35:42.280 --> 35:45.320]  Sitting at spiceentertainmentinc, and it's
[35:45.320 --> 35:48.700]  Sitting somewhere in chicago. Note the address, okay?
[35:48.700 --> 35:52.400]  Lake shore drive, chicago, and there's a phone number there.
[35:52.620 --> 35:53.820]  So let's just have a look and see.
[35:53.820 --> 35:58.000]  If we do a whois on playboy.com, what the contact information
[35:58.000 --> 36:01.940]  Would be for them. And what do you know?
[36:02.080 --> 36:07.520]  It is the same address. So spicetv and playboy is
[36:07.520 --> 36:11.340]  Clearly related, right? they are the same company.
[36:11.340 --> 36:15.920]  So in terms of putting new domains within your system to
[36:15.920 --> 36:19.620]  Start scanning for more interesting domains and to
[36:19.620 --> 36:23.520]  Start finding more ip addresses and more net blocks, you should
[36:23.520 --> 36:26.000]  Be looking at spicetv.com as well.
[36:26.040 --> 36:31.940]  So we can take that stuff, take out the subs in there, sort
[36:31.940 --> 36:35.340]  Unique that, basically cut all of that stuff out.
[36:35.600 --> 36:37.620]  You would see there's a bug in the program at this stage.
[36:37.620 --> 36:40.920]  It's fixed in the release that we have now, whereby it didn't
[36:40.920 --> 36:44.780]  Check for uppercase, lowercase. So playboy.com uppercase was
[36:44.780 --> 36:46.920]  Still in the list of unmatched.
[36:47.840 --> 36:52.420]  That's just too lower. And we can take all of that
[36:52.420 --> 36:55.600]  Stuff and we can basically paste it back in here with the rest
[36:55.600 --> 36:58.540]  Of our domains. See there, i take it out nicely.
[36:59.720 --> 37:02.480]  Sort unique that. And we can start over again.
[37:02.480 --> 37:05.300]  And that's why we have this kind of cyclical thing between the
[37:05.300 --> 37:08.020]  Reverse and the forwards. Until those blocks that we
[37:08.020 --> 37:10.760]  Scanned come out completely clean at the other end.
[37:11.680 --> 37:15.500]  Okay. Now, the next step we want to
[37:15.500 --> 37:18.580]  Do, when we're happy with our net block definitions, is we're
[37:18.580 --> 37:21.460]  Going to find what machines are actually within those blocks
[37:22.360 --> 37:24.420]  That we can attack. Correct?
[37:24.700 --> 37:27.340]  Now, again, imagine that you're doing this on a very large
[37:27.340 --> 37:30.420]  Organization and you've got, let's say, ibm with lots of
[37:30.420 --> 37:34.400]  Class b's. You need to, well, they've got
[37:34.400 --> 37:36.720]  Multiple class b's. You need something that's
[37:36.720 --> 37:39.520]  Really fast, right? this is, it ain't going to work
[37:39.520 --> 37:41.580]  If you're not scanning it really quick.
[37:42.280 --> 37:44.480]  Now, there's three ways that we can find out if a machine is
[37:44.480 --> 37:46.460]  Alive. We can do your normal icmp
[37:46.460 --> 37:49.620]  Scan, of course. We can do udp scans, which is
[37:49.620 --> 37:53.580]  A little bit more trickier. And we can do tcp scans.
[37:53.580 --> 37:56.140]  And then we go for kind of a small list of ports.
[37:56.300 --> 37:58.460]  And we only check for that. And sure, we're going to miss
[37:58.460 --> 38:02.180]  Stuff, okay? but the more ports you test for,
[38:02.180 --> 38:04.820]  The more it becomes a port scan on the entire range.
[38:06.320 --> 38:07.920]  And the longer it's going to take.
[38:07.920 --> 38:10.260]  So depending on your time here, you can either scan all the
[38:10.260 --> 38:13.780]  Ports or you can scan for a very small subset and only find the
[38:13.780 --> 38:16.260]  Machines that's alive on those ports.
[38:17.200 --> 38:20.000]  Now, what we've done with the port scanning is basically
[38:20.000 --> 38:23.020]  Implement a asynchronous port scanner.
[38:23.360 --> 38:27.260]  And you've all seen this. It's been used now in many kind
[38:27.260 --> 38:30.780]  Of tools. It basically works like this.
[38:30.780 --> 38:34.060]  We send out a sin, right? we have a sniffer on the other
[38:34.060 --> 38:36.000]  End. We check for the source port
[38:36.000 --> 38:39.420]  Coming back. If it's a sinack, the port is
[38:39.420 --> 38:41.940]  Open. If it's a reset, the port is
[38:41.940 --> 38:44.280]  Closed. It's as easy as that.
[38:45.460 --> 38:49.800]  So let's see how it works. This thing, and i know some of
[38:49.800 --> 38:51.840]  The other scanners, i mean, check out the unicorn scan
[38:51.840 --> 38:54.460]  Thing as well. I think they were speaking
[38:54.460 --> 38:57.520]  Yesterday morning, right? they're doing the same thing,
[38:57.520 --> 38:58.940]  But they're doing it distributed.
[38:59.580 --> 39:03.580]  So it's even faster that way. But we can probably, you know,
[39:03.580 --> 39:06.920]  Do one port in a class b in two minutes.
[39:07.700 --> 39:09.560]  So if you're only scanning for one port, it's going to take
[39:09.560 --> 39:12.460]  You about two minutes. We limit this thing so it only
[39:12.460 --> 39:15.280]  Sends, you know, at the quickest it can send out packets
[39:15.280 --> 39:18.560]  Every two milliseconds. Obviously you can do it faster
[39:18.560 --> 39:20.420]  Than that if you implement it yourself.
[39:22.640 --> 39:26.200]  Oops. Okay.
[39:26.200 --> 39:29.080]  So let's just look at the whole process for sensepost.com
[39:29.080 --> 39:31.720]  Because it's really quick. We go there, we find the
[39:31.720 --> 39:34.280]  Forward entries. It's going really quick.
[39:34.700 --> 39:37.380]  Okay. We're almost done.
[39:38.300 --> 39:40.900]  Right. We take it into the net blocks.
[39:41.880 --> 39:46.260]  What you will find is there's a 10, 15, 10 in there.
[39:47.220 --> 39:50.880]  Which, i mean, it's not internal, but we use it for the
[39:50.880 --> 39:53.060]  Training. So i'm taking that out
[39:53.060 --> 39:55.220]  Because i'm not going to scan 10, 15, 10, right?
[39:55.220 --> 39:59.980]  That's a little bit silly. And the other thing that's
[39:59.980 --> 40:05.300]  Interesting here to note is, let me just pause this, is that
[40:05.300 --> 40:10.240]  With service pack 2, xp service pack 2, microsoft actually
[40:10.240 --> 40:13.560]  Disabled the use of raw socket sending, right?
[40:14.700 --> 40:17.540]  Because they went through all the tools that uses raw socket
[40:17.540 --> 40:21.500]  Sending and they were like bad, bad, bad, bad.
[40:21.500 --> 40:23.540]  Let's not check the rest. They're all bad.
[40:23.580 --> 40:26.100]  Okay. So they disabled it.
[40:26.360 --> 40:29.900]  Which is a pity. So for us to be able to do
[40:29.900 --> 40:33.620]  This on this level, we need to drop a level down and send
[40:33.620 --> 40:36.560]  Those packets out on an ethernet layer.
[40:37.420 --> 40:40.480]  And so there's a driver that actually that we use.
[40:40.580 --> 40:43.000]  You've got to bind the driver and send the packets out that way.
[40:43.000 --> 40:45.920]  It's a little bit more tricky, but it's not that much more
[40:45.920 --> 40:49.200]  Tricky. Okay.
[40:49.360 --> 40:52.180]  So basically these net blocks now come in from the previous
[40:52.180 --> 40:54.240]  Step. We select what ports we want to
[40:54.240 --> 40:55.860]  Scan. It's all configurable, of
[40:55.860 --> 41:00.020]  Course. In this case, we go with 22,
[41:00.020 --> 41:04.220]  23, 25, and 443. And we basically just start it
[41:04.220 --> 41:09.280]  Up over here. The ports that are found open
[41:09.280 --> 41:13.640]  Is listed on that side. Showing an o for open port.
[41:13.640 --> 41:15.660]  Shows you the ip, shows you the port.
[41:15.720 --> 41:19.700]  And it also shows you the ttl, which gives you a kind of idea
[41:19.700 --> 41:21.740]  Of how far the machine is away from you.
[41:21.740 --> 41:25.380]  Although, you know, some stacks send their packets out with the
[41:25.380 --> 41:28.460]  Ttl of 128, others with other values.
[41:28.460 --> 41:31.500]  So it's not that useful. But, you know, we put it in there
[41:31.500 --> 41:33.360]  Now. You'll see as soon as we go into
[41:33.360 --> 41:38.640]  The 72 network, things start to go a little bit quicker in there
[41:38.640 --> 41:40.520]  Or we get more results coming back.
[41:40.520 --> 41:42.640]  There we go. Okay.
[41:43.880 --> 41:47.540]  Because there's lots of machines that's open on those ports.
[41:47.540 --> 41:49.600]  And you'll see we paused it there.
[41:49.600 --> 41:51.340]  So it's going to jump. Okay.
[41:52.300 --> 41:54.420]  And that's basically doing the port scan.
[41:54.420 --> 41:55.940]  Right? basically doing the port scan
[41:55.940 --> 41:59.880]  On the net blocks and on the ports that we specified in the
[41:59.880 --> 42:03.220]  Previous section. Okay.
[42:04.320 --> 42:06.900]  All right. So if you look at the whole
[42:06.900 --> 42:08.920]  Footprinting thing, it looks like this.
[42:09.340 --> 42:11.720]  And you're not supposed to be able to read anything that's on
[42:11.720 --> 42:13.940]  The screen. It's just to give you some
[42:13.940 --> 42:17.480]  Idea of all the different steps and the complexity involved with
[42:17.480 --> 42:18.860]  This whole thing. Okay.
[42:18.860 --> 42:20.740]  We start off with a domain over there.
[42:20.960 --> 42:24.340]  We end up with a whole list of ip numbers on that side.
[42:24.380 --> 42:27.380]  We're doing whole lots of tricks in between to make it work.
[42:28.800 --> 42:31.500]  Okay. So footprinting, it's over.
[42:31.540 --> 42:33.520]  I know people don't like it. I dig it.
[42:33.520 --> 42:35.520]  But it's not over. Right?
[42:35.680 --> 42:38.880]  So within this thing, which steps are easy to automate and
[42:38.880 --> 42:40.940]  Which steps are really difficult to automate?
[42:40.940 --> 42:45.380]  The domain finding stuff is really difficult to automate.
[42:45.400 --> 42:47.980]  Okay. We wrote a paper on this two
[42:47.980 --> 42:52.780]  Years ago for black hat singapore. You can get it off the black hat site.
[42:52.780 --> 42:54.760]  You can see the methods that we use there.
[42:55.320 --> 42:57.640]  I know johnny is going to talk about some of those methods in
[42:57.640 --> 42:59.720]  His talk as well. But it's difficult.
[42:59.720 --> 43:02.720]  It's not nice. It's not a fun thing to do.
[43:03.840 --> 43:06.080]  And at the moment, we don't do it.
[43:06.080 --> 43:08.980]  You can learn a lot from the reverse entries like we found
[43:08.980 --> 43:12.480]  On spice tv.Com. But we don't do this.
[43:12.680 --> 43:15.320]  The subdomain finding, we got it.
[43:15.320 --> 43:17.360]  It's cool. Forwards, no problem.
[43:17.400 --> 43:21.620]  The net blocks, it's difficult. The as expansion technique that
[43:21.620 --> 43:25.880]  We have there don't always work on small networks.
[43:25.880 --> 43:30.480]  So, for instance, sense post has one class c.
[43:30.620 --> 43:33.320]  But if you do a whois, if you look at the as that's
[43:33.320 --> 43:37.020]  Basically attached to our net block, you would find that it
[43:37.020 --> 43:38.960]  Belongs to the isp. And if you look at all the
[43:38.960 --> 43:42.160]  Other routes within that as, you're going to get the net
[43:42.560 --> 43:45.120]  Blocks for the isp, which is not necessarily what you want
[43:45.120 --> 43:49.300]  To do, right? the other problem is that these
[43:49.860 --> 43:54.420]  Registrars like LACNIC and APNIC and those guys, RIPE and
[43:54.420 --> 43:59.180]  ARIN, don't have a way to search with a wild card for
[43:59.180 --> 44:02.740]  Names and get back net blocks. I mean, you can do it on ARIN
[44:03.640 --> 44:08.120]  And you can kind of do it on RIPE with a bit of trouble.
[44:08.120 --> 44:10.780]  But you can't do it on LACNIC and you can't do it on
[44:10.780 --> 44:13.060]  APNIC and you can't do it on any of the others.
[44:13.060 --> 44:15.260]  You just can't do it. So you can't get more net
[44:15.260 --> 44:17.120]  Block definitions from those guys.
[44:18.040 --> 44:21.660]  The reverse scans, oh, and the other thing is the whois
[44:21.660 --> 44:25.100]  Information is worthless on these small little networks,
[44:25.100 --> 44:28.860]  right, because they don't have the actual person that is
[44:28.860 --> 44:30.860]  The company that has that net block.
[44:30.860 --> 44:34.000]  They only have the isp or something like that in there.
[44:34.000 --> 44:37.820]  So that's useless as well. The reverse scans, that's
[44:37.820 --> 44:38.720]  Easy. We can do it.
[44:38.720 --> 44:42.040]  It's a no-brainer. The vitality stuff, easy.
[44:42.240 --> 44:45.940]  At the moment we only got the TCP stuff, but doing the rest
[44:45.940 --> 44:48.300]  Is really just an extension on that.
[44:48.740 --> 44:51.220]  So why do you care about footprinting?
[44:52.420 --> 44:55.580]  You know, because there's a difference between finding one
[44:55.580 --> 44:59.560]  Vulnerability on one machine versus finding one machine
[44:59.560 --> 45:03.640]  With one vulnerability. And I think actually Dan
[45:03.640 --> 45:06.100]  Kaminsky had this point that he made in his talk last night
[45:06.100 --> 45:08.460]  As well. It's easier finding one
[45:08.460 --> 45:11.680]  Vulnerability on a whole lot of machines than finding one
[45:11.680 --> 45:14.740]  Vulnerability on one machine. Okay.
[45:14.740 --> 45:17.260]  So we've done with that, right? we've done with that first
[45:17.260 --> 45:18.340]  Block. We're going to move on to
[45:18.340 --> 45:21.620]  Fingerprinting. Now, fingerprinting, we
[45:21.620 --> 45:23.420]  Actually want to do os detection, right?
[45:23.420 --> 45:26.860]  We want to be able to see, say, that is a windows machine
[45:26.860 --> 45:31.180]  Running windows 2000, service pack 3, whatever.
[45:31.200 --> 45:34.160]  It's really difficult to do this from the internet on a
[45:34.160 --> 45:37.280]  Machine that is tightly firewalled. Why?
[45:37.280 --> 45:40.540]  It's not technically difficult. It's not only technically
[45:40.540 --> 45:43.280]  Difficult, but it's conceptually difficult as well.
[45:43.460 --> 45:46.760]  So if you have an apache machine, all right, that's
[45:46.760 --> 45:51.580]  Protected with the firewall 1 running on windows, microsoft
[45:51.580 --> 45:57.160]  Windows, with one-to-one net back to that apache box, that
[45:57.820 --> 46:01.040]  Thing is going to report itself on a network level as a
[46:01.040 --> 46:04.360]  Windows machine, right? because you're talking to the
[46:04.360 --> 46:07.640]  Windows stack. But on application level, it's
[46:07.640 --> 46:12.020]  Going to return itself back as a apache machine.
[46:12.340 --> 46:15.620]  So not just is it difficult to find that stuff, it's also
[46:15.620 --> 46:18.160]  Difficult to kind of decide which one will it be.
[46:18.740 --> 46:21.760]  So with bdblah, we don't try to do os detection.
[46:21.760 --> 46:24.460]  We don't even try to. What we do is we do banner
[46:24.460 --> 46:26.900]  Scanning. And i know, i know, everybody
[46:26.900 --> 46:29.800]  Tells me you can change the banner, but how many people
[46:29.800 --> 46:32.400]  Actually is changing their banners? not a whole lot of
[46:32.400 --> 46:34.220]  People are changing their banners, right?
[46:34.300 --> 46:35.820]  So we're saying, okay, that's fine.
[46:35.820 --> 46:38.860]  Let's just do banner scanning, let's see what we get.
[46:39.600 --> 46:42.280]  And we do it asynchronously again.
[46:42.280 --> 46:45.020]  And the asynchronous banner scanning stuff is quite cool.
[46:45.780 --> 46:48.700]  You can do asynchronous banner scanning for any kind of
[46:48.700 --> 46:51.280]  Banner. But the more complex it
[46:51.280 --> 46:55.360]  Becomes in terms of negotiation, like ssl, for instance, the
[46:55.360 --> 46:57.940]  More tricky it becomes to do it asynchronously.
[46:57.940 --> 47:02.080]  So we've done it with the ssl stuff.
[47:02.080 --> 47:04.660]  We've done it multithreaded. And with the rest of the stuff,
[47:04.660 --> 47:07.920]  We did it with the other ports, we've done it asynchronously.
[47:07.920 --> 47:09.980]  How does it work? okay.
[47:10.060 --> 47:15.560]  Basically, the same way that we had a asynchronous port
[47:15.560 --> 47:17.580]  Scanner, it works in the same way.
[47:18.820 --> 47:21.800]  So we got a sniffer. We're sending sins on this
[47:21.800 --> 47:23.480]  Sound. We have a sniffer that checks
[47:23.480 --> 47:26.760]  The source port, right? normally, if the port is open,
[47:26.760 --> 47:30.860]  It's going to come back with a sin.
[47:33.560 --> 47:35.720]  So normally it's going to go into this thing.
[47:35.720 --> 47:38.340]  It's going to get a sin. We've got to act that packet
[47:38.340 --> 47:40.340]  Back. So we send an act.
[47:42.340 --> 47:45.120]  We check if it's port 80 that we're testing.
[47:45.300 --> 47:46.760]  It could be other ports as well.
[47:49.620 --> 47:52.360]  And if it is, we send back a get
[47:53.220 --> 47:56.360]  Http1.0. Now we're going to get an act
[47:56.360 --> 48:01.360]  Back into this tree. If it's port 80, we extract it
[48:01.360 --> 48:05.300]  From the http header. If it's not port 80, we simply
[48:05.300 --> 48:08.280]  Extract the banner. Then it's a 25 or a 21 or any
[48:08.280 --> 48:12.380]  Of those, right? and we have to close the
[48:12.380 --> 48:15.340]  Session because otherwise our web servers are going to keep
[48:15.340 --> 48:18.680]  On sending the stuff back. So we have to send a fin.
[48:19.660 --> 48:22.340]  If there's a fin, we have to fin act that.
[48:22.920 --> 48:36.460]  Now, who can tell me for a t-shirt, what is the thing
[48:36.460 --> 48:41.820]  That's going to bite us? this works, but we have to do
[48:41.820 --> 48:45.060]  Something else to make this work. Who can tell me what the
[48:45.060 --> 48:47.380]  Problem is here? yes, sir?
[48:50.580 --> 49:01.520]  Yeah. I think you're right, but we
[49:01.520 --> 49:02.820]  Haven't seen a lot of that.
[49:05.580 --> 49:09.300]  No, no, no, no, no, no. That's not the problem either.
[49:09.500 --> 49:14.120]  Look, i mean, think about this. This stuff happens, right, on
[49:14.120 --> 49:15.620]  User level. Doesn't happen through the
[49:15.620 --> 49:18.720]  Kernel. Doesn't happen through the stack.
[49:19.280 --> 49:21.820]  The stack doesn't know about this happening.
[49:22.320 --> 49:25.160]  So we're sending out a fin, right?
[49:25.160 --> 49:27.420]  No problem. Our stack can send it out.
[49:28.500 --> 49:32.800]  Okay? so we get back a fin act.
[49:32.800 --> 49:37.080]  Right? and now, what's my stack going to
[49:37.080 --> 49:39.420]  Do? in comes a fin act packet.
[49:40.760 --> 49:42.980]  Who said reset? thank you, sir.
[49:44.840 --> 49:47.640]  So that's exactly the problem. Now, our fin act packet is
[49:47.640 --> 49:50.300]  Coming back into our stack. Our stack says, hey, i don't
[49:50.300 --> 49:56.820]  Know what you did. So the stack says, hey, hang on
[49:56.820 --> 49:59.120]  A bit, here's a fin act coming back to me.
[49:59.120 --> 50:02.300]  I never send out the fin. It doesn't know about that, so
[50:02.300 --> 50:03.940]  It's going to reply with a reset.
[50:04.360 --> 50:06.880]  So we've got to cut those resets off somewhere.
[50:07.260 --> 50:10.440]  In this case, you can do it in an upstream firewall.
[50:11.060 --> 50:13.880]  What we usually do is we, you know, we have a personal
[50:13.880 --> 50:16.900]  Firewall on the machine. We cut the resets off there.
[50:16.900 --> 50:19.160]  So there's no reset that your machine can send out.
[50:19.160 --> 50:21.800]  Not reset coming back. Reset's going out.
[50:22.680 --> 50:24.620]  Okay? this thing, this asynchronous
[50:24.620 --> 50:28.820]  Banners, a grabber can really work very fast.
[50:29.180 --> 50:34.640]  So we can do about 2,000 banners in three minutes that we can grab.
[50:36.000 --> 50:39.520]  What i want to show you is how it actually works.
[50:39.520 --> 50:44.160]  When we start out, we do the, we first do multi-threaded
[50:44.160 --> 50:47.720]  Work on the hdps to get that, because we can do it
[50:47.720 --> 50:50.460]  Asynchronously, but, hey, it's a lot of work.
[50:50.460 --> 50:56.280]  So let's go on and see. So those are the port scans.
[50:56.720 --> 50:59.360]  You go to the banners. You basically import that
[50:59.360 --> 51:03.340]  Stuff in there. Okay.
[51:03.680 --> 51:07.120]  Select the interface. Right.
[51:09.460 --> 51:11.540]  We start, it's starting there at the bottom.
[51:11.540 --> 51:13.880]  You can see it's starting on the ssl.
[51:13.880 --> 51:17.420]  It's doing 15 threads at the same time to find the banners
[51:17.420 --> 51:19.960]  For the ssl stuff. So that's not really fast.
[51:21.620 --> 51:25.600]  Right. And you will see there's a delay
[51:25.600 --> 51:27.320]  In there. The moment we're sending it out
[51:27.320 --> 51:30.980]  At 302 milliseconds delay between packets.
[51:30.980 --> 51:34.420]  But you can actually drop it off as, hang on, hang on, hang
[51:34.420 --> 51:35.440]  On. Hang on.
[51:35.440 --> 51:37.980]  Okay. You can drop it off as low as
[51:37.980 --> 51:39.400]  You want to. Right.
[51:39.400 --> 51:41.500]  You'll see there's additional weight in there.
[51:41.500 --> 51:45.240]  That's basically, you know, those smtp servers when you
[51:45.240 --> 51:47.720]  Connect to it, it doesn't do anything.
[51:47.840 --> 51:50.900]  And it waits and waits and waits. And then finally you get the
[51:50.900 --> 51:53.060]  Banner coming back. That's the time that we've got
[51:53.060 --> 51:55.600]  To wait for those stuff coming back.
[51:55.640 --> 51:59.120]  Now, what you will see here is i'm going to drop that delay
[51:59.120 --> 52:03.760]  There down to 2 milliseconds. And what's interesting is note
[52:03.760 --> 52:08.640]  The scroll bar on the right-hand side as i drop it.
[52:13.900 --> 52:15.580]  Okay. Zip.
[52:17.820 --> 52:19.020]  Okay. And those are all the banners
[52:19.020 --> 52:23.340]  That we could get there. So it's kind of fast.
[52:23.780 --> 52:25.060]  Okay. And now we're just waiting for
[52:25.060 --> 52:27.220]  Other banners to come in if there's anything.
[52:28.840 --> 52:30.480]  Okay. Cool. I'm going to go on.
[52:31.860 --> 52:33.200]  Right. So this is what we do for
[52:33.200 --> 52:35.560]  Banner scanning. What's the next step?
[52:35.560 --> 52:37.140]  We want to be able to do targeting.
[52:37.740 --> 52:41.280]  Now, the thing there is if you have a lot and lots and lots of
[52:42.180 --> 52:45.580]  Potential targets, you want something that can easily say,
[52:45.580 --> 52:48.140]  Oh, well, i want to identify everything that's running on
[52:48.140 --> 52:51.440]  Port 22 and i want to only test against those.
[52:51.440 --> 52:55.080]  Or i want to have only machines that have open ports within a
[52:55.080 --> 52:57.520]  Certain net block and i want to test those.
[52:57.520 --> 53:02.320]  Or you get the idea, right? so this is what the targeting
[53:02.320 --> 53:05.740]  Stuff looks like. We basically have the banners
[53:05.740 --> 53:08.420]  Now for everything. We can click on targeting and
[53:08.420 --> 53:11.880]  We basically get our net blocks definitions in there.
[53:11.880 --> 53:15.740]  We can drop down to those, see the machines that are in there.
[53:15.740 --> 53:20.600]  The machines in there has either a dns name or reverse or
[53:20.600 --> 53:24.020]  Forward or it's the mx record or it's the ns record for a domain
[53:24.020 --> 53:29.140]  Or it has an open port. Once it's got an open port,
[53:29.140 --> 53:32.100]  That's something that we would want to see in there, right?
[53:32.100 --> 53:34.300]  A machine that's totally dead with no forward or reverse
[53:34.300 --> 53:37.020]  Entries are kind of boring to us.
[53:37.400 --> 53:41.200]  Machines with dns information or open ports are interesting to
[53:41.200 --> 53:43.960]  Us and we can get the banners in there as well.
[53:44.560 --> 53:47.740]  What's interesting about the banner scanning is if you get a
[53:47.740 --> 53:50.680]  Reset coming from the host, what do you know?
[53:50.680 --> 53:51.920]  You know that it's wrapped, right?
[53:52.060 --> 53:55.420]  It's a tcp wrapped port. So it actually accepted the
[53:55.420 --> 54:00.700]  Entire conversation and then it sent back a reset to close the
[54:00.700 --> 54:04.280]  Connection afterwards. So we can do a search for
[54:04.280 --> 54:08.500]  Instance for open ssl and we're going to get all the machines
[54:08.500 --> 54:13.980]  That has a banner that contains the word open ssl in the banner.
[54:14.780 --> 54:17.660]  And then we can just simply say, okay, make those targets.
[54:17.660 --> 54:21.500]  I want to attack those machines with open ssl and immediately
[54:21.500 --> 54:25.040]  Goes off to the target section. Okay, cool.
[54:26.480 --> 54:30.120]  There we're doing a scan for machines on tcp 22.
[54:30.120 --> 54:35.380]  Anything that's open on 22? all right.
[54:35.380 --> 54:37.320]  So you see all the banners coming back there and i can
[54:37.320 --> 54:40.780]  Again just say make those machines targets.
[54:40.780 --> 54:42.580]  I want to attack it in the next stage.
[54:46.270 --> 54:48.710]  Okay. I think we get the idea.
[54:49.430 --> 54:52.170]  Right. So now we have our targets
[54:52.170 --> 54:54.810]  Defined. Remember we went through the
[54:54.810 --> 54:56.550]  Whole thing. We went through the whole thing.
[54:56.550 --> 54:59.810]  At this stage we have the machines that we're going to
[54:59.810 --> 55:01.210]  Attack. Okay.
[55:01.210 --> 55:03.230]  We went through the targeting, all of that.
[55:03.230 --> 55:04.750]  We have the machines that we want to attack.
[55:04.970 --> 55:07.530]  Right. So what's the next step?
[55:07.530 --> 55:09.250]  We want to do vulnerability discovery.
[55:09.270 --> 55:11.570]  We're going to find what vulnerabilities are on these
[55:11.570 --> 55:15.350]  Machines. So we're not going to write a
[55:15.350 --> 55:18.630]  Vulnerability scanner because there's a lot of people that
[55:18.630 --> 55:21.050]  Wrote vulnerability scanners. We're going to use something
[55:21.050 --> 55:25.970]  That's really solid, we hope, and widely used, and that is
[55:25.970 --> 55:27.650]  Nessus. So what we need to do is we
[55:27.650 --> 55:32.190]  Need to write a nessus client. Okay.
[55:32.190 --> 55:33.790]  We need to write a nessus client.
[55:33.930 --> 55:36.250]  And what we want to do is we want to give the user the
[55:36.250 --> 55:40.170]  Ability to select the plug-ins that he wants to use just as a
[55:40.170 --> 55:42.710]  Normal nessus client and say, well, i want to test this
[55:42.710 --> 55:45.190]  Particular bug. Okay.
[55:45.190 --> 55:49.070]  Remember what i said previously. It's easier to find a single
[55:49.170 --> 55:52.090]  Bug on a whole lot of machines than finding the one bug on one
[55:52.270 --> 55:53.870]  Machine. So, for instance, if we want to
[55:53.870 --> 55:57.810]  Check which machines on an entire class b has snmp
[55:57.810 --> 56:02.270]  Community strings enabled, you know, we put one plug-in into
[56:02.270 --> 56:05.530]  Nessus and we scan it across the whole class a and we find the
[56:05.530 --> 56:07.770]  Stuff really quick. Okay.
[56:10.350 --> 56:14.710]  So this is basically what we use for plug-in selection.
[56:17.650 --> 56:20.590]  It's really easy. You can decide which plug-ins
[56:20.590 --> 56:22.630]  You want to use. You can move them from the one
[56:22.630 --> 56:27.290]  End to the other end and you can save that information afterwards.
[56:27.390 --> 56:29.970]  It actually just saves the plug-in i.D. So you can have
[56:29.970 --> 56:34.830]  Your list of plug-in i.D.s wherever you want to have it.
[56:34.830 --> 56:39.210]  You can put it in a text file and you can use whatever kind of
[56:39.210 --> 56:43.850]  Selector you want to basically select these plug-ins.
[56:43.850 --> 56:47.270]  It's just a list of nessus plug-ins, right, i.D.s.
[56:48.270 --> 56:52.670]  Afterwards we're going to save that and i can give it a name.
[56:52.670 --> 56:55.390]  Those are the plug-in i.D.s on the left-hand side and i can call
[56:55.390 --> 56:58.370]  That thing whatever i want. I'm going to call it black hat
[56:58.370 --> 57:02.390]  Demo.PLG. That's a plug-in set.
[57:02.390 --> 57:04.330]  You're going to see i'm going to use it later on.
[57:06.810 --> 57:10.430]  So in the next step we actually want to now run vulnerability
[57:10.430 --> 57:12.450]  Scans, right? we're going to run the nessus
[57:12.450 --> 57:15.930]  Scan against our target on a particular plug-in set.
[57:18.890 --> 57:22.210]  So there's the sense for stuff. There's the net blocks.
[57:22.750 --> 57:25.810]  There's all the reverse entries. Click.
[57:26.290 --> 57:29.410]  Yeah. There's the port scan.
[57:30.210 --> 57:33.410]  The banners. And what we want to do now is
[57:33.410 --> 57:36.330]  Run a nessus scan against those machines.
[57:36.970 --> 57:39.610]  But we have to target them first. So i'm going to click on
[57:39.610 --> 57:42.590]  Targeting and i'm going to say that first, you see that first
[57:42.590 --> 57:45.290]  Class c over there? there's a couple of machines in
[57:45.290 --> 57:48.270]  There. It's in our lab situation that
[57:48.270 --> 57:53.470]  We want to scan, right? i can right-click on any of those
[57:53.470 --> 57:56.290]  And say select it as a target or what i can do is i can
[57:56.290 --> 57:59.030]  Simply say anything that's in that block that's got an open
[57:59.030 --> 58:02.950]  Port, make it a target. So immediately i get a list of
[58:02.950 --> 58:04.990]  Machines there. Those machines are now my
[58:04.990 --> 58:09.630]  Because they're live, right? they responded to any of those scans.
[58:10.370 --> 58:13.650]  And i go to the nessus tab over there and i basically import
[58:13.650 --> 58:16.010]  Those by just clicking on the import button.
[58:16.550 --> 58:18.250]  Okay. I select the set that i want to
[58:18.250 --> 58:24.250]  Use. And i click on start.
[58:25.010 --> 58:27.290]  Right. Now, with ntp, the nessus
[58:27.290 --> 58:30.450]  Protocol, you have to get all the plug-ins.
[58:30.550 --> 58:32.590]  You have to load the plug-ins before you can actually run the
[58:32.590 --> 58:33.750]  Scan. It's kind of weird.
[58:33.750 --> 58:37.070]  Even if you know exactly what plug-ins you want to use, you
[58:37.070 --> 58:40.210]  Have to select, you have to get all the plug-in information
[58:40.210 --> 58:42.510]  Coming back. Now, there you can see the
[58:42.510 --> 58:44.550]  Scan is now running. It started with the port scan
[58:44.550 --> 58:47.010]  As per normal on all those ip addresses.
[58:47.490 --> 58:51.190]  You can set your nessus server up as you want to, to, you know,
[58:51.190 --> 58:54.850]  Scan more machines at a time or more threads at a time or any of
[58:54.850 --> 58:57.790]  That stuff at a time. It really depends on your nessus
[58:57.790 --> 59:00.970]  Server how fast that scan is going to happen.
[59:00.970 --> 59:03.770]  At any time, we can just click on the update tree button and we
[59:03.770 --> 59:06.990]  Can see how far the scan has gone and what we've done there
[59:06.990 --> 59:08.790]  And, you know, get the output back.
[59:08.790 --> 59:11.190]  It's, you know, the same old, same old.
[59:11.190 --> 59:14.950]  We've all seen this before. It's just a different flavor,
[59:14.950 --> 59:17.630]  Different interface, but it's not doing anything else.
[59:19.510 --> 59:21.830]  And it will tell you when the scan is done.
[59:22.150 --> 59:25.150]  You can see there's still a bug there at the bottom as well.
[59:25.150 --> 59:28.470]  We sorted that out as well. But i thought, you know, let me
[59:28.470 --> 59:31.210]  Rather have the bug in there and you can see that it's really
[59:31.210 --> 59:33.870]  Running and not a video recording somewhere.
[59:34.850 --> 59:38.030]  It also now shows you the actual issues.
[59:39.110 --> 59:40.990]  Right. Okay.
[59:40.990 --> 59:47.850]  So let's move on. We've done the vulnerability discovery.
[59:47.850 --> 59:50.850]  The only thing that's left to do is basically exploit those
[59:50.850 --> 59:55.570]  Vulnerabilities, right? now, again, we don't want to
[59:55.570 --> 01:00:00.570]  Reinvent the wheel here. So we have this thing talk to a
[01:00:01.090 --> 01:00:04.570]  Nice exploitation framework, which is metasploit.
[01:00:04.670 --> 01:00:06.690]  There's a couple of others as well.
[01:00:06.690 --> 01:00:11.410]  But metasploit is quite neat. So what do we have to do?
[01:00:11.410 --> 01:00:14.750]  We write a metasploit client. Now, the problem with
[01:00:14.750 --> 01:00:18.390]  Metasploit, it's actually not a problem with metasploit, it's a
[01:00:18.390 --> 01:00:19.830]  Problem with us, okay, is that it's very operating
[01:00:23.650 --> 01:00:28.630]  Specific, which is this exploit will work against, you know,
[01:00:28.630 --> 01:00:35.430]  Windows 2k service pack 2. We don't have that information,
[01:00:35.430 --> 01:00:37.010]  Right? we don't have that kind of
[01:00:37.010 --> 01:00:38.610]  Level of information about our targets.
[01:00:38.610 --> 01:00:41.790]  If we were internal to the network, we can do funky stuff.
[01:00:41.870 --> 01:00:43.630]  But we're not. We're external.
[01:00:43.690 --> 01:00:46.570]  So we don't have the information. So what do we do is we select
[01:00:46.570 --> 01:00:49.230]  The target number zero and we hope for the best.
[01:00:49.250 --> 01:00:51.610]  Because a lot of the metasploit plug-ins actually does a brute
[01:00:51.610 --> 01:00:53.990]  Force. So we don't have to supply it.
[01:00:54.370 --> 01:00:56.830]  What else is it that we have to supply to metasploit?
[01:00:56.830 --> 01:00:59.590]  We have to supply the remote port, right?
[01:00:59.850 --> 01:01:02.750]  But the remote port we can pick up from the nasus scan.
[01:01:03.250 --> 01:01:05.870]  Because let's say your server was running on, your web server
[01:01:05.870 --> 01:01:11.490]  Was running on port 27, right? the nasus would pick it up as on
[01:01:11.490 --> 01:01:14.070]  Port 27. And we have that port, right?
[01:01:14.070 --> 01:01:16.630]  We know when stuff is ssl as well.
[01:01:16.870 --> 01:01:20.770]  So we can specify in metasploit if it's got to use ssl or not.
[01:01:22.190 --> 01:01:25.590]  And we have the local ip address as well.
[01:01:25.590 --> 01:01:28.990]  If we have, if we're doing, for instance, a reverse shell.
[01:01:28.990 --> 01:01:33.110]  Because that's our ip address. So most of the stuff we have.
[01:01:33.130 --> 01:01:36.270]  The only thing that we don't have is we don't have a way to
[01:01:36.270 --> 01:01:43.210]  Tie up a metasploit exploit with the nasus id, right?
[01:01:43.210 --> 01:01:48.450]  So basically saying we use nasus to identify the weakness.
[01:01:48.950 --> 01:01:51.030]  And we use metasploit to exploit it.
[01:01:51.030 --> 01:01:52.830]  But how do you tie the two together?
[01:01:53.490 --> 01:01:55.350]  So what we've done, where's gareth?
[01:01:56.230 --> 01:02:02.390]  What gareth has done there, gareth phillips, right in front
[01:02:02.390 --> 01:02:06.670]  Of the camera, he's been a week basically, you know, tying these
[01:02:06.670 --> 01:02:10.570]  Two things up, saying here's a metasploit exploit, okay?
[01:02:10.570 --> 01:02:13.690]  Is there a nasus plug-in that will identify this particular
[01:02:13.690 --> 01:02:16.750]  Problem? and if he can find it, he
[01:02:16.750 --> 01:02:18.930]  Basically writes it down in a little list.
[01:02:18.930 --> 01:02:22.950]  Says this exploit, that plug-in. And if there's multiple plug-ins
[01:02:22.950 --> 01:02:26.090]  For a specific exploit, he's got them listed there.
[01:02:26.090 --> 01:02:33.130]  And if there's no nasus plug-in for the metasploit exploit,
[01:02:33.130 --> 01:02:39.050]  That's, a, scary, right? and so, b, he would write some
[01:02:39.050 --> 01:02:40.650]  Of them. So how many did we write?
[01:02:40.910 --> 01:02:44.950]  We write about four, five. And i think at the moment, in
[01:02:44.950 --> 01:02:49.530]  Terms of tying the stuff together, we need another 13 of
[01:02:49.530 --> 01:02:53.050]  The 70, how many, 70? 78.
[01:02:53.270 --> 01:02:55.650]  78 exploits. That was, you know, the
[01:02:55.650 --> 01:02:58.490]  Adding to it the whole time. The rest of the stuff is pretty
[01:02:58.490 --> 01:03:01.910]  Much mapped, okay? and what we're hoping to do,
[01:03:01.910 --> 01:03:06.190]  And i'll beg hd for this, is to see if we can get it so
[01:03:06.190 --> 01:03:08.690]  That when they write new exploits for metasploit, they
[01:03:08.690 --> 01:03:12.350]  Include a nasus id in there. And if there's no nasus id,
[01:03:12.350 --> 01:03:15.030]  Then they basically write a nasus check for it.
[01:03:15.870 --> 01:03:18.570]  Because then we can just query, you know, the framework and get
[01:03:18.570 --> 01:03:21.150]  The ids out of it dynamically, and we don't have to keep this
[01:03:21.150 --> 01:03:22.370]  List. And we're not going to keep
[01:03:22.370 --> 01:03:25.030]  This list current, okay? that's not what we do.
[01:03:25.750 --> 01:03:28.470]  Okay. So let's see, let's see how it works.
[01:03:29.630 --> 01:03:32.150]  Okay. So for this instance, we're
[01:03:32.150 --> 01:03:33.850]  Looking at a vmware server, right?
[01:03:33.850 --> 01:03:37.090]  We're not, this is just a vmware server.
[01:03:38.770 --> 01:03:42.370]  Now, what's interesting here is, when we now do our nasus
[01:03:42.370 --> 01:03:46.190]  Scan, right, why do we have to check for all the nasus ids?
[01:03:47.010 --> 01:03:51.130]  We only check for the ones that's got related metasploit
[01:03:51.870 --> 01:03:56.050]  Exploits, right? we check for those 72 minus
[01:03:56.050 --> 01:03:59.210]  13 nasus ids that we already got.
[01:03:59.230 --> 01:04:03.090]  So what i'm doing here is i'm basically running a nasus scan
[01:04:03.090 --> 01:04:07.510]  Against the ip address and only using the, i'm only using the
[01:04:07.510 --> 01:04:13.470]  List of nasus ids with related metasploit plug-ins.
[01:04:13.910 --> 01:04:16.330]  And you can see it, it can do it rather quickly.
[01:04:16.910 --> 01:04:20.530]  So there, it's done. And we found three issues.
[01:04:21.190 --> 01:04:23.890]  You click on it, you'll basically see, it should be all
[01:04:23.890 --> 01:04:26.190]  Red, right? the last one, i don't know,
[01:04:26.190 --> 01:04:29.290]  It's a bug. Basically tells you these are
[01:04:29.290 --> 01:04:31.830]  The three heavy issues that we found on this machine.
[01:04:31.830 --> 01:04:37.230]  You can look at them. And when you go to metasploit,
[01:04:37.230 --> 01:04:40.030]  What you do is you click on that little button over there,
[01:04:40.030 --> 01:04:42.430]  And that loads the definitions in.
[01:04:42.430 --> 01:04:45.750]  Hang on. That basically loads the
[01:04:45.750 --> 01:04:49.110]  Definitions in that says this is the nasus id that matches with
[01:04:49.110 --> 01:04:52.570]  This metasploit id. Once we have that, we can
[01:04:52.570 --> 01:04:55.350]  Simply click on a thing that says find the matching target.
[01:04:55.530 --> 01:04:58.970]  So now it will go through the entire nasus scan, right?
[01:04:58.970 --> 01:05:02.050]  Of all the machines that we want to scan, and it's going to
[01:05:02.050 --> 01:05:07.170]  Pick out the ones that has related metasploit ids and say
[01:05:07.170 --> 01:05:10.210]  These are potential targets. If you run the metasploit exploit
[01:05:10.210 --> 01:05:13.210]  Against this, you have a good chance that it's going to work.
[01:05:14.610 --> 01:05:18.070]  And those are, that's obviously the same machine, right?
[01:05:18.070 --> 01:05:21.370]  It's all the same machine. And there's identified four
[01:05:21.370 --> 01:05:25.130]  Problems, four possible exploits that we can run against that machine.
[01:05:25.130 --> 01:05:28.810]  We now have to configure our exploits.
[01:05:30.170 --> 01:05:34.110]  So we're going to go for, which one is it, the decom one?
[01:05:34.110 --> 01:05:35.790]  No. Yes.
[01:05:35.790 --> 01:05:37.810]  It will tell you what the exploit is all about.
[01:05:37.870 --> 01:05:40.290]  Now you've got to select what you want to do with that thing.
[01:05:40.550 --> 01:05:43.290]  So you configure the exploit. Click.
[01:05:44.590 --> 01:05:47.850]  And it basically dynamically queries the framework and tells
[01:05:47.850 --> 01:05:51.430]  You for that exploit, these are the different payloads that you
[01:05:51.430 --> 01:05:54.810]  Can have, right? that's the reverse.
[01:05:54.810 --> 01:06:01.630]  And the stuff that you have to fill out, okay, the stuff that
[01:06:01.630 --> 01:06:03.990]  You have to fill out, you can fill out, right?
[01:06:03.990 --> 01:06:06.890]  The rest of the stuff is automatically populated with all
[01:06:06.890 --> 01:06:09.050]  The information that we know at this stage.
[01:06:09.750 --> 01:06:11.530]  Okay. So i'm going to bring up the
[01:06:13.210 --> 01:06:15.370]  Vmware machine. There we go.
[01:06:15.370 --> 01:06:19.370]  I've configured the rest of the exploits as well, but i didn't
[01:06:19.370 --> 01:06:21.910]  Want to go through that. And you can save it as well.
[01:06:22.150 --> 01:06:24.850]  And i start the metasploit framework on this side.
[01:06:24.850 --> 01:06:27.930]  It could be sitting on any box, right, at this stage it's just
[01:06:27.930 --> 01:06:31.110]  Sitting on your local machine. But you can have it speak to a
[01:06:31.110 --> 01:06:35.450]  Metasploit framework on a remote machine as well.
[01:06:35.450 --> 01:06:37.830]  And that's it. We click on start.
[01:06:37.830 --> 01:06:42.430]  And now it's basically running those exploits against the machines.
[01:06:42.430 --> 01:06:45.710]  Remember, those machines could be a whole lot of machines.
[01:06:46.090 --> 01:06:50.090]  If you're scanning a large organization, again, you know,
[01:06:50.090 --> 01:06:52.130]  Through the whole thing. Okay.
[01:06:52.130 --> 01:06:54.370]  And when it's done, what we expect is that in the framework
[01:06:54.370 --> 01:06:56.230]  We're going to have those shells.
[01:06:57.550 --> 01:07:03.190]  And lo and behold, if you click on sessions, hey, there you go.
[01:07:03.190 --> 01:07:05.810]  There's your shells. Okay.
[01:07:05.810 --> 01:07:09.530]  And, you know, i think you all know what this looks like, right?
[01:07:09.730 --> 01:07:12.450]  If you don't know, we're going to click on a session there just
[01:07:12.450 --> 01:07:14.270]  So that you also see it's not bullshit.
[01:07:20.320 --> 01:07:23.100]  Okay. You can do it.
[01:07:24.100 --> 01:07:25.960]  All right. That's this metasploit.
[01:07:25.960 --> 01:07:30.540]  Okay. Now, think about a large network.
[01:07:30.540 --> 01:07:33.720]  Okay. Let's say you're even sitting
[01:07:34.320 --> 01:07:40.180]  Internal on a network. Let me show you something.
[01:07:40.500 --> 01:07:42.720]  This was done on an internal network.
[01:07:43.080 --> 01:07:46.740]  I can't tell you who's network there.
[01:07:48.320 --> 01:07:51.100]  I'm going to just load that data set in.
[01:07:54.000 --> 01:07:56.100]  That's the one that says can't say who.
[01:07:56.100 --> 01:07:58.900]  It's all text files. It saves it in text files.
[01:07:59.760 --> 01:08:01.640]  Okay. This is the net blocks.
[01:08:01.640 --> 01:08:03.960]  You check all the ten dot somethings in there.
[01:08:04.220 --> 01:08:08.420]  And if we go to nesis, you'll find that there's lots of
[01:08:08.420 --> 01:08:12.500]  Issues with these machines. A lot of them have the same
[01:08:12.500 --> 01:08:15.740]  Issue, right? but some have some interesting
[01:08:15.740 --> 01:08:18.880]  Issues in there, like dot printer and those kind of
[01:08:18.880 --> 01:08:21.760]  Overflows. In metasploit, look at this.
[01:08:21.860 --> 01:08:23.320]  Okay. If you click on matching
[01:08:23.320 --> 01:08:28.340]  Targets, it's kind of funny.
[01:08:29.760 --> 01:08:33.380]  That's worm territory, man. Okay.
[01:08:33.920 --> 01:08:39.040]  So in a perfect world, sorry, yes.
[01:09:10.570 --> 01:09:12.970]  Okay. Can we take this offline
[01:09:12.970 --> 01:09:14.670]  Afterwards? okay.
[01:09:15.930 --> 01:09:19.390]  So but i will speak to you. So are we done?
[01:09:19.390 --> 01:09:22.450]  In a perfect world, we're done. In a perfect world, we're done.
[01:09:22.450 --> 01:09:25.350]  And we, you know, we've done our assessment and this.
[01:09:25.350 --> 01:09:28.170]  But if you're doing assessments, can i just see in this room
[01:09:28.170 --> 01:09:31.310]  Here who actually has to write reports?
[01:09:32.270 --> 01:09:34.690]  Aha. I thought so much.
[01:09:34.910 --> 01:09:37.550]  So in a perfect world, you have to write reports.
[01:09:37.630 --> 01:09:41.110]  You don't have to write reports. In a perfect world, there's no
[01:09:41.110 --> 01:09:43.270]  False positives. Nowhere.
[01:09:43.390 --> 01:09:47.270]  Nesis never makes a mistake. Well, guess what?
[01:09:47.270 --> 01:09:49.490]  It does, right? and sometimes the stuff that
[01:09:49.490 --> 01:09:51.090]  It gives you is just not relevant.
[01:09:51.090 --> 01:09:55.450]  So what we've done is we have this thing.
[01:09:56.410 --> 01:10:02.850]  To start off with, you know, within the nesis scan, you can
[01:10:02.850 --> 01:10:05.270]  Mark something as a false positive, right?
[01:10:05.590 --> 01:10:11.490]  If you really want to. And you can basically say mark
[01:10:11.490 --> 01:10:15.730]  This as a false positive across the entire range of scans that
[01:10:15.730 --> 01:10:18.630]  You've done. And you can comment on the
[01:10:18.630 --> 01:10:21.470]  Stuff. And what's nice about this is
[01:10:21.470 --> 01:10:24.430]  That when you go back to your targeting section, you can
[01:10:24.430 --> 01:10:27.850]  Basically then go and say, well, let's find wherever i put that
[01:10:27.850 --> 01:10:31.030]  Comment in. Or you can basically say, let's
[01:10:31.030 --> 01:10:35.130]  Search all the machines that nesis croaked about on, i don't
[01:10:35.130 --> 01:10:38.090]  Know, usable name server, for instance, right?
[01:10:38.090 --> 01:10:40.430]  And i want to find those machines because those are the
[01:10:40.430 --> 01:10:44.170]  Machines i need to attack or defend.
[01:10:44.170 --> 01:10:46.610]  I need to patch these machines or i need to attack these
[01:10:46.610 --> 01:10:48.770]  Machines, right? so you can very easily do
[01:10:48.770 --> 01:10:53.090]  That kind of advanced targeting.
[01:10:55.050 --> 01:10:58.110]  Supposed to be one. Okay?
[01:10:59.170 --> 01:11:02.590]  And what's nice about this thing as well is the last tag on this
[01:11:02.590 --> 01:11:07.430]  Thing basically does a lot of the reporting work for you,
[01:11:07.430 --> 01:11:09.030]  Okay? so you have to write these
[01:11:09.030 --> 01:11:12.210]  Things out for your boss. You have to give it out to a
[01:11:12.210 --> 01:11:15.930]  Client. It would go a long, long way
[01:11:15.930 --> 01:11:20.750]  To basically help you not to have to write that report.
[01:11:20.910 --> 01:11:23.330]  The reason why we do this, the reason why we use this tool and
[01:11:23.330 --> 01:11:26.710]  Develop this tool was that we use it internally, right?
[01:11:26.710 --> 01:11:29.750]  And we want to spend our time doing interesting stuff.
[01:11:29.750 --> 01:11:31.210]  Okay? we want to do the more
[01:11:31.210 --> 01:11:33.210]  Interesting work of an assessment.
[01:11:33.210 --> 01:11:36.170]  We don't want to spend time writing reports and basically
[01:11:36.670 --> 01:11:41.610]  Having to copy and paste from a nesis report into a real report.
[01:11:41.610 --> 01:11:45.570]  You know, that stuff, we want to play with the interesting stuff.
[01:11:45.570 --> 01:11:49.870]  And that's why we have this particular, it's just going on
[01:11:49.870 --> 01:11:52.410]  There, but i can't forward the video, actually.
[01:11:53.530 --> 01:11:54.950]  There we go. There's the reporting.
[01:11:58.370 --> 01:12:00.270]  I'm just doing the host tables now.
[01:12:00.370 --> 01:12:02.070]  So basically we have all the information, right?
[01:12:02.070 --> 01:12:03.710]  We have the forwards. We have the reverse.
[01:12:03.830 --> 01:12:05.690]  We have the domains. We have the banners.
[01:12:05.690 --> 01:12:07.490]  We have the open ports. We have the issues.
[01:12:07.490 --> 01:12:10.150]  We have the severity of the issues. We have all of these things.
[01:12:10.370 --> 01:12:13.830]  So we can basically take one host and build up a kind of a
[01:12:13.830 --> 01:12:17.010]  Host table that says this is the entire machine.
[01:12:17.010 --> 01:12:19.130]  This is what the machine looks like, right?
[01:12:20.290 --> 01:12:23.730]  It's an mx record. It has this ip address.
[01:12:23.730 --> 01:12:26.210]  It has these ports open. It has these banners.
[01:12:27.610 --> 01:12:30.470]  Okay? and it has these nesis ids with
[01:12:30.470 --> 01:12:33.370]  Whatever impact. And that happens all
[01:12:33.370 --> 01:12:35.470]  Automatically because we don't want to do it.
[01:12:35.470 --> 01:12:37.690]  All the comments that we put in there, if there's a comment that
[01:12:37.690 --> 01:12:41.630]  We wanted to put in there, then that comment is also retained.
[01:12:42.150 --> 01:12:44.810]  So you can see there it says analyst comment.
[01:12:45.390 --> 01:12:48.530]  That's a comment that we put in there in the past.
[01:12:48.530 --> 01:12:51.530]  It's really nice for banners as well.
[01:12:51.530 --> 01:12:55.250]  So if you do banner scanning and then you sort by banner, you can
[01:12:55.250 --> 01:12:58.870]  See immediately these are all my is5 machines or this is the
[01:12:58.870 --> 01:13:02.330]  Target's is5 machines. This is the target's this.
[01:13:02.330 --> 01:13:04.730]  All of those things come out quite neatly.
[01:13:05.190 --> 01:13:07.010]  Okay. So what's the bottom line?
[01:13:07.390 --> 01:13:11.130]  The bottom line is this tool is basically doing 80 of the work
[01:13:11.130 --> 01:13:14.490]  In 20 of the time that it takes us to do.
[01:13:14.570 --> 01:13:19.430]  Which leaves us with 80 of the time that we can play with more
[01:13:19.430 --> 01:13:21.370]  Interesting things. Okay?
[01:13:22.450 --> 01:13:25.230]  Some of the steps of the methodology is really hard to
[01:13:25.230 --> 01:13:27.970]  Automate. And it's usually where there's
[01:13:27.970 --> 01:13:29.970]  Exceptions. You know, there's exception to
[01:13:29.970 --> 01:13:32.450]  The rule. Makes it very hard to automate.
[01:13:33.550 --> 01:13:37.510]  Hopefully it will also raise the bar on people that, you know,
[01:13:37.510 --> 01:13:40.250]  Do penetration. I'm a penetration testing
[01:13:40.250 --> 01:13:44.190]  Specialist kind of dude. Because these things, i mean,
[01:13:44.190 --> 01:13:47.550]  The report that you get out of this is just about the same
[01:13:47.550 --> 01:13:50.810]  Report as these people are doing in a long, long, long time and
[01:13:50.810 --> 01:13:55.270]  Charging a lot of money for it. So that's hopefully what we're
[01:13:55.270 --> 01:13:58.050]  Going to get out of it. In terms of release of this
[01:13:58.050 --> 01:14:03.250]  Tool, there's always a problem here, right?
[01:14:03.370 --> 01:14:06.810]  We've got the gentleman in front that's going to tell me, you're
[01:14:06.810 --> 01:14:08.510]  Not going to release this, right?
[01:14:08.550 --> 01:14:12.530]  I mean, this is point and click, you know, weapons of mass
[01:14:12.530 --> 01:14:16.670]  Destruction. You're not going to release it,
[01:14:16.670 --> 01:14:18.970]  Right? and then we've got the other
[01:14:18.970 --> 01:14:22.090]  Side, which i guess is the rest of the class.
[01:14:22.950 --> 01:14:25.650]  That's saying, okay, where do we download it?
[01:14:27.170 --> 01:14:31.470]  So we build this version, which is a cripple version.
[01:14:31.470 --> 01:14:34.190]  It's only crippled in two ways. Okay?
[01:14:34.190 --> 01:14:37.650]  It runs for 20 minutes, and you can't save your data.
[01:14:37.650 --> 01:14:40.150]  The rest of the stuff is exactly the same.
[01:14:40.670 --> 01:14:43.930]  Okay? i just want to see, harun, are
[01:14:43.930 --> 01:14:48.450]  We do we have time left? how much time do we have left?
[01:14:48.950 --> 01:14:50.590]  30 minutes? okay, what we're going to do
[01:14:50.590 --> 01:14:55.390]  Now is we're going to play with it a bit and see how it works in
[01:14:55.390 --> 01:14:58.690]  Real life, okay? keep in mind, we're doing it
[01:14:58.690 --> 01:15:01.430]  Via the wireless, and the wireless is kind of, you know,
[01:15:01.430 --> 01:15:06.190]  Flaky because of the fact that we kind of ride next door to
[01:15:06.190 --> 01:15:12.390]  The wi-fi shootout room. So if it's not handling itself
[01:15:12.390 --> 01:15:17.870]  Well, then you know why. Okay.
[01:15:20.700 --> 01:15:23.340]  So this is what the tool looks like.
[01:15:25.800 --> 01:15:28.520]  All right. It's a, the new release is a
[01:15:28.520 --> 01:15:32.820]  Little bit more friendlier and so forth and so on.
[01:15:32.820 --> 01:15:36.060]  Okay. So are we good?
[01:15:36.380 --> 01:15:37.840]  Okay. Let's just see if i can get out
[01:15:37.840 --> 01:15:40.940]  To the net. Okay.
[01:15:40.940 --> 01:15:48.040]  As you can see, it's kind of, you know, yeah.
[01:15:48.100 --> 01:15:49.580]  Okay. Okay.
[01:15:49.580 --> 01:15:50.980]  So but let's give it a go. Okay.
[01:15:50.980 --> 01:15:54.200]  So for subdomains, remember i told you subdomains,
[01:15:54.740 --> 01:15:58.440]  Subdomains, but it actually gets really interesting.
[01:15:58.440 --> 01:16:00.840]  So i want to put a domain in there.
[01:16:00.840 --> 01:16:03.760]  So if you're from this organization, keep in mind that
[01:16:03.760 --> 01:16:06.520]  We're only mining subdomains. We're not attacking your
[01:16:06.520 --> 01:16:08.580]  Network. We're not going to go further
[01:16:08.580 --> 01:16:11.040]  Than subdomains. Okay.
[01:16:11.440 --> 01:16:13.500]  So i'm going to put in there a domain.
[01:16:16.630 --> 01:16:18.050]  Right. I don't know if you can see
[01:16:18.050 --> 01:16:30.420]  That. If you can't, remember, it's
[01:16:30.420 --> 01:16:33.320]  Only subdomain mining. It's not anything else.
[01:16:33.320 --> 01:16:35.280]  We're not attacking the network. We're not sending a single
[01:16:35.280 --> 01:16:38.000]  Packet to that network. Okay.
[01:16:38.000 --> 01:16:41.480]  And you can see that it's basically pulling down a whole
[01:16:41.480 --> 01:16:44.580]  Lot of subdomains there. Okay.
[01:16:45.960 --> 01:16:50.420]  Right. We got some interesting things
[01:16:50.420 --> 01:16:55.500]  In there and e-mail addresses that we can mine as well if we
[01:16:55.500 --> 01:16:58.500]  Want to use it for later use. Okay.
[01:16:58.500 --> 01:17:03.700]  I'm going to stop this now. So let me just find the stop
[01:17:03.700 --> 01:17:05.640]  Button. And then, of course, you can
[01:17:05.640 --> 01:17:07.940]  Go to the forwards and you can simply input that and start
[01:17:07.940 --> 01:17:10.860]  Doing all the forwards on that, which i'm not going to do.
[01:17:10.960 --> 01:17:13.700]  Right. We actually have the permission
[01:17:13.700 --> 01:17:19.260]  To look at some of the other network, good friends at
[01:17:19.940 --> 01:17:22.640]  Electronic arts. Is frank here?
[01:17:22.640 --> 01:17:24.620]  Frank? frank?
[01:17:25.540 --> 01:17:29.340]  Frank is not here. But he said to us it's okay if
[01:17:29.340 --> 01:17:34.180]  We show some of the stuff that we've done on there.
[01:17:34.180 --> 01:17:36.940]  So i'm going to put in the ea. You know ea, ea sports.
[01:17:36.940 --> 01:17:43.380]  It's in the game. Okay.
[01:17:43.380 --> 01:17:47.100]  We're going to quickly go through there, see how that
[01:17:47.100 --> 01:17:51.420]  Works. It's actually works quite nice.
[01:17:55.590 --> 01:17:57.570]  Okay. So there you can see some
[01:17:59.870 --> 01:18:03.490]  Burnout3.Ea and earth and beyond.Ea.Com.
[01:18:03.650 --> 01:18:08.730]  And freedomfighters.Ea.Com. Those are all subdomains that
[01:18:08.730 --> 01:18:11.330]  Actually belong to them. And it's just adding to the list
[01:18:11.330 --> 01:18:14.470]  As we go along. It's actually a uefa
[01:18:15.910 --> 01:18:19.410]  Championsleaguegame.Ea.Com. Once we have this stuff, i'm
[01:18:19.410 --> 01:18:20.890]  Not going to go through all of this.
[01:18:21.170 --> 01:18:23.810]  It's going to take a while to finish this up.
[01:18:23.810 --> 01:18:26.310]  Takes about five minutes to run through one of these domains.
[01:18:26.770 --> 01:18:29.070]  Okay. We can go to the forwards.
[01:18:30.190 --> 01:18:35.170]  And basically just do this mouse is not working on this.
[01:18:35.170 --> 01:18:40.910]  Come back here to import, right? and then we're going to start
[01:18:40.910 --> 01:18:44.230]  Looking at the dns information at the forwards, right?
[01:18:44.230 --> 01:18:47.150]  So those are what you see there. You can't see them, right?
[01:18:47.150 --> 01:18:50.810]  Let me just um... those are the mx records and
[01:18:50.810 --> 01:18:54.570]  The ns records. And as we go through there, we
[01:18:54.570 --> 01:19:01.810]  Basically find trip w, obviously, ftp1, ftp, mail.
[01:19:03.270 --> 01:19:06.970]  No, no, no, no, no, no. Okay.
[01:19:06.970 --> 01:19:09.770]  Next one we find, i'm going to move over to the next tab.
[01:19:12.450 --> 01:19:17.190]  Testing for cisco e-commerce. There we go.
[01:19:17.190 --> 01:19:21.270]  Corporate.Ea.Com. And it's actually got two ip
[01:19:21.270 --> 01:19:23.950]  Addresses. So i'm going to stop it over
[01:19:23.950 --> 01:19:26.550]  There. I'm going to go to the net
[01:19:26.550 --> 01:19:28.470]  Blocks, import the net blocks there.
[01:19:29.210 --> 01:19:31.330]  I'm not going to spend a whole lot of time on the net block
[01:19:31.330 --> 01:19:34.230]  Definitions. You can see they've got a class b
[01:19:34.230 --> 01:19:37.230]  Network, right? if i get the who's information
[01:19:37.230 --> 01:19:45.670]  On this, it will tell me so. And, of course, you can do this
[01:19:45.670 --> 01:19:47.110]  For any domain, right? there we go.
[01:19:47.150 --> 01:19:49.990]  Electronic arts. You can see that it's a class b.
[01:19:49.990 --> 01:19:51.770]  I'm not going to make it a class b now.
[01:19:51.890 --> 01:19:53.190]  I'm just going to keep it there.
[01:19:54.010 --> 01:19:56.430]  Import it there. Here's our matching filters
[01:19:56.430 --> 01:19:59.150]  That we've got. I want to change all of those
[01:19:59.150 --> 01:20:01.590]  Matching filters just to be ea.Com.
[01:20:04.460 --> 01:20:06.960]  Okay. And we're doing multi-threaded, 25
[01:20:06.960 --> 01:20:10.120]  Threads at a time. Reverse scan.
[01:20:10.120 --> 01:20:15.660]  There we've got smtp-eu1.Ea.Com, which is your, i
[01:20:15.660 --> 01:20:20.400]  Think it's the european smtp gateway.
[01:20:21.080 --> 01:20:24.720]  Okay. You get the idea, right?
[01:20:24.720 --> 01:20:27.640]  With them, it's really interesting when you start
[01:20:27.640 --> 01:20:30.940]  Looking at the reverses because in the reverse of some of these
[01:20:30.940 --> 01:20:34.480]  Blocks, you would find that they have a whole lot of domains.
[01:20:35.340 --> 01:20:37.620]  For just about every game that they make, they have a domain
[01:20:37.620 --> 01:20:40.140]  For it. And they have reverse dns
[01:20:40.140 --> 01:20:43.300]  Entries that points to those ip address, from those ip
[01:20:43.300 --> 01:20:46.080]  Addresses that point outwards. So you can get a whole lot of
[01:20:46.080 --> 01:20:47.580]  Domains. I've collected all of the
[01:20:47.580 --> 01:20:50.500]  Information earlier. I'll show you the full, you
[01:20:50.500 --> 01:20:53.340]  Know, the complete, what the complete thing looks like.
[01:20:53.340 --> 01:20:56.560]  Okay. So let's just stop this here.
[01:20:57.100 --> 01:20:59.980]  We go to the port scanner. Basically import that stuff
[01:20:59.980 --> 01:21:01.800]  Straight in there. Those are the blocks.
[01:21:01.860 --> 01:21:04.180]  I promise you there's more blocks, but, you know, let's
[01:21:04.180 --> 01:21:07.900]  Keep it sweet and short for now. I'm going to bind my driver.
[01:21:09.140 --> 01:21:11.140]  I'm going to say use that interface.
[01:21:12.400 --> 01:21:14.660]  And let's see what ports do you want to scan.
[01:21:14.660 --> 01:21:16.480]  I'm not going to scan a whole lot of ports.
[01:21:16.620 --> 01:21:21.840]  Let's just do 443, 80 and 25. See how it works.
[01:21:21.840 --> 01:21:24.140]  Hopefully it will be good. Okay.
[01:21:24.520 --> 01:21:27.480]  You can see at the bottom the speed at which this thing is
[01:21:27.480 --> 01:21:30.680]  Scanning. It's quite fast.
[01:21:38.080 --> 01:21:41.280]  And those are the machines that's basically coming back to it.
[01:21:41.420 --> 01:21:43.300]  You'll see there's some duplicates in there.
[01:21:43.560 --> 01:21:46.760]  What happens is the machine, that fin that i'm sending out, i
[01:21:46.760 --> 01:21:48.700]  Was just kidding. I'm not sending the fin.
[01:21:49.200 --> 01:21:51.580]  So the machines respond a couple of times.
[01:21:51.980 --> 01:21:55.440]  It's just something i still need to sort out.
[01:21:56.520 --> 01:21:58.740]  Okay. So there's a couple of 25s in
[01:21:58.740 --> 01:22:00.240]  There. There's a 443.
[01:22:04.020 --> 01:22:07.960]  And we're almost a third of the way in the port scan.
[01:22:09.880 --> 01:22:13.780]  I'm not going to take your time looking at a progress bar.
[01:22:13.780 --> 01:22:15.800]  So let's move on to the next one. You get the idea.
[01:22:15.860 --> 01:22:18.480]  You can go through all of these machines.
[01:22:18.480 --> 01:22:21.740]  There's a couple of nice ones. Okay.
[01:22:21.740 --> 01:22:23.900]  There we go. Okay.
[01:22:23.900 --> 01:22:26.300]  That starts looking better and better.
[01:22:26.760 --> 01:22:29.980]  Okay. Let's just keep it running for a
[01:22:29.980 --> 01:22:33.580]  Little bit longer. Okay.
[01:22:33.580 --> 01:22:35.100]  And i'm going to stop it over there.
[01:22:35.100 --> 01:22:37.480]  All right. So let's pull it in from the
[01:22:37.480 --> 01:22:41.580]  Banners. Basically do this.
[01:22:41.580 --> 01:22:47.320]  We bind our driver again. And we go to this one.
[01:22:47.320 --> 01:22:49.920]  And let's do a scan. And there you can see the
[01:22:49.920 --> 01:22:53.340]  Banners coming back in. Kind of quick, right?
[01:22:54.540 --> 01:22:58.540]  Okay. We've already sent out the
[01:22:58.540 --> 01:23:00.000]  Packets. These are just packets coming
[01:23:00.000 --> 01:23:06.200]  Back at this stage. Got a 25-second wait for this
[01:23:06.200 --> 01:23:10.500]  Thing. And there's not a lot more
[01:23:10.500 --> 01:23:12.280]  Coming back at this stage, right?
[01:23:12.640 --> 01:23:15.380]  So already at this stage what i can do is i can go to the
[01:23:15.380 --> 01:23:17.940]  Targeting. I can update the tree.
[01:23:17.940 --> 01:23:20.720]  I can say, well, i want to find apache boxes.
[01:23:21.540 --> 01:23:23.120]  Okay. Search the tree.
[01:23:24.100 --> 01:23:27.120]  And make those targets. Those are the apache boxes in
[01:23:27.600 --> 01:23:29.080]  That range that we scanned, right?
[01:23:29.080 --> 01:23:31.860]  Not a lot. I wonder if there's any
[01:23:31.860 --> 01:23:34.320]  Microsoft boxes in there. Clear the selection.
[01:23:38.560 --> 01:23:41.280]  It says microsoft is in the banner, right?
[01:23:41.880 --> 01:23:44.600]  I think so, yeah. Clear the selection.
[01:23:44.600 --> 01:23:46.400]  Search. We've got some.
[01:23:46.760 --> 01:23:48.460]  Make them targets. There we go.
[01:23:48.460 --> 01:23:51.040]  Those are the microsoft boxes in that network.
[01:23:51.360 --> 01:23:53.660]  How long did it take me to get that information?
[01:23:53.860 --> 01:23:56.060]  What, three minutes? okay.
[01:23:56.200 --> 01:24:05.500]  We can go into the nasa scan. Maybe not.
[01:24:05.500 --> 01:24:11.080]  Maybe some other day. No.
[01:24:11.360 --> 01:24:13.600]  No, no, no, no. It's not all in the game.
[01:24:16.580 --> 01:24:18.220]  Okay. I thank you very much.
[01:24:18.220 --> 01:24:20.240]  And you've still got 20 minutes to catch the next talk.
[01:24:20.240 --> 01:24:20.700]  Thanks.