WEBVTT 00:03.770 --> 00:08.570 Okay, the line has trickled to a slow speed, so we're going to get started. 00:09.250 --> 00:11.750 One quick announcement to remind you all of. 00:12.050 --> 00:14.470 Photographs of the speakers are with their permissions. 00:14.570 --> 00:17.550 Photographs of the audience, not allowed. 00:17.550 --> 00:20.350 If we find you doing it, you will be removed. 00:20.770 --> 00:24.010 And with that, SensPost and Rulof. 00:35.280 --> 00:37.020 Hello, hello. 00:37.740 --> 00:39.200 Okay, let's see. 00:39.200 --> 00:43.540 Just a couple of things before we start. 00:43.980 --> 00:46.460 I'm going to try speaking to the mic the whole time. 00:46.640 --> 00:50.860 Kind of, you know, maybe do it like this. 00:52.320 --> 00:53.200 Like that. 00:53.200 --> 00:53.880 Okay. 00:53.900 --> 00:54.820 Let's see. 00:56.040 --> 01:01.420 Okay, before we begin, most of The stuff you can find at that url over there. 01:01.800 --> 01:15.640 That's just for, you know, if we don't get through all of this, i Think we would, because we've got a double session, so there Shouldn't be a problem, but if you want to write that down, That's where you can find the tool that we'll be showing Today. 01:16.200 --> 01:29.400 Then also at amsterdam, we Actually made a promise that we would release a web application Scanner that is also available for download at the url on the Screen. 01:30.180 --> 01:36.000 In terms of time considerations, There's a lot that we must cover. 01:37.020 --> 01:44.000 We're basically going to go Through the presentation, and then afterwards, we're going to Do a bit of a live demo. 01:44.540 --> 01:53.020 We're having issues with the Wireless at the moment, but hopefully by that time, it Should be sorted out, so then we can go through a bit of live Demo on this thing. 01:54.600 --> 02:01.380 Just something to start off With, you know, there's a lot of shows that you can go see here In vegas. 02:01.380 --> 02:12.320 I've heard that, you know, Humanity is quite good, and elton john, and dan Kaminsky. 02:12.600 --> 02:17.020 So this is a presentation. 02:17.020 --> 02:19.000 There won't be any drinking on the stage. 02:19.980 --> 02:22.080 And it's not a show. 02:23.520 --> 02:26.320 So basically, let me give you Introduction. 02:26.700 --> 02:30.520 Let me just quickly, like, Briefly tell you about sense post. 02:30.520 --> 02:33.680 We're a company of about 15 people in South africa. 02:33.880 --> 02:39.140 We do external, internal Assessments, color penetration testing. 02:39.460 --> 02:41.940 We've done it for the last five Years. 02:42.200 --> 02:47.660 We've been talking at black hat For the last four years in defcon. 02:49.040 --> 02:54.660 And in our work, what we basically do, amongst other Things, is we break into networks. 02:55.380 --> 02:57.080 We train as well. 02:57.080 --> 02:59.200 We do training at black hat. 02:59.780 --> 03:02.400 We've trained a record amount of People this year at black hat. 03:02.520 --> 03:12.460 And we train them using, basically Tell them about a methodology that we use to break into Networks from the internet. 03:12.460 --> 03:13.700 This is not for internal. 03:13.700 --> 03:15.120 It's from over the internet. 03:15.860 --> 03:21.160 And so we're pretty sure that our Methodology kind of works. 03:21.220 --> 03:22.480 It seems to be working. 03:22.480 --> 03:27.960 We've seen the insides of more internal networks than we kind of Care to see. 03:28.920 --> 03:37.140 So what we've done is we've Basically said this methodology that we have, let's see how much Of this can be automated. 03:37.800 --> 03:55.840 So the idea was to basically Take every step of the way and check if that step can be Automated and to what kind of level of accuracy it can be Automated so that by the end of the day, hopefully most of the Stuff that we have to do manually, we can now do Automatically. 03:56.740 --> 04:09.640 So the talk is really about the Methodology itself, which parts of the methodology can be Automated, where it really works well and where it really breaks Down badly. 04:10.780 --> 04:15.800 And when it breaks down badly, Why it actually breaks down badly. 04:16.400 --> 04:25.860 And at the end, we're going to quickly talk about some Implications that this tool will have for, you know, the more Mediocre pen testers out there. 04:26.500 --> 04:28.860 Because i guess there's a couple Of those. 04:31.100 --> 04:31.660 Okay. 04:31.660 --> 04:38.380 So in order to automate Something, if you want to automate something, you need to Code it, right? 04:38.380 --> 04:41.100 you need to be able to write it Down and code it. 04:41.180 --> 04:45.660 And to code it, you need to Have some kind of algorithm. 04:47.300 --> 04:53.340 And in order to have an Algorithm, you need to really, really understand what it is That you're trying to do. 04:53.340 --> 04:58.540 I find a lot of people that Starting to write code for something that they don't Understand yet. 04:58.540 --> 05:04.800 So the idea is never really that The coding should take a lot of the time. 05:04.800 --> 05:11.700 The idea would be that understanding the process that You're trying to do would be taking the time. 05:12.380 --> 05:20.220 And having done hundreds and hundreds of assessments, we kind Of know what it is that we want to do. 05:20.220 --> 05:22.280 It's not just a question of coding it. 05:24.440 --> 05:37.380 With anything that you automate, if you can write it Down on a piece of paper in a kind of a flow chart, and you Know exactly what it is that you're writing down, and the Flow chart works, then you can code it, right? 05:37.380 --> 05:42.580 Then it's just a question of saying we have to take this Stuff and then write it in code. 05:43.360 --> 05:46.880 The problem comes in with Automation is when there's exceptions. 05:46.880 --> 05:51.380 So the situation might be we can do this in this case. 05:51.620 --> 05:56.560 But, you know, one out of a thousand times, the result is Going to look a little bit different. 05:57.240 --> 06:02.360 And if you still want to automate it, you need to make Sure that you're catching that exception. 06:02.500 --> 06:22.140 So as soon as, and you will see this during the talk, as soon As there's exceptions and as soon as there's something that We don't really understand how it's working, or we have to Make, we have to see how many different exceptions there are And have to write a piece of code or a code path for all of Those different exceptions, 06:22.140 --> 06:25.080 it becomes very, very difficult to do. 06:25.220 --> 06:25.360 Okay? 06:25.360 --> 06:44.220 now, the trade-off there is that If you have something that works 99.9 of the time and it's Going to take you a year to code the code path for the Exception, then you kind of live with it and you say it's Okay, we can live with this exception, we know that it Occurs, 06:44.220 --> 06:48.900 and it's not necessarily a bad thing, we can Maybe fix it manually afterwards. 06:52.700 --> 07:04.640 So there's a couple of weird perceptions in the industry Today, and you will find it at this conference, it would be The best place to find that kind of weird perception. 07:05.400 --> 07:13.160 And if you talk to anyone, just about anyone in this Conference, they would tell you that unix is good and windows Is bad, right? 07:13.300 --> 07:23.420 and then afterwards, you should Make a kind of sheep noise, because, you know, if Everybody says windows is good, unix is good and windows is Bad, then it must be, right? 07:24.740 --> 07:43.760 you will also see that a lot of People say that the problem with windows is that we have this Gooey apps that are running on windows, and with gooey apps, You can't really do a thing, because, you know, it's kind of A black box, and you don't have the flexibility that you have With unix tools. 07:44.980 --> 07:57.800 What i'm saying is, it really Depends on who's writing that gooey application, because you Can still have a gooey application and still have Flexibility, the same kind of flexibility that you would have On a unix. 07:57.800 --> 08:03.100 I don't want to go into this Too much, because i'm thinking people are going to assault me After this. 08:03.920 --> 08:06.680 I can see angry faces in the Crowd. 08:07.220 --> 08:07.740 Okay? 08:07.840 --> 08:26.800 but there's really a Perception out there that says, if something has a gooey Application, and i guess that's the fault that a lot of people That write applications is doing, is saying, as soon as we Stick a gooey on top of this thing, we need to dumb the Application down, 08:26.800 --> 08:30.660 because we think that people that are using Gooey tools are stupid. 08:31.060 --> 08:38.780 And so because we're now Catering for a crowd of people that's stupid, we need to have Our gooey really point and click and go. 08:39.100 --> 08:40.620 And it's really not the case. 08:40.620 --> 08:51.000 You can still build a gooey that Is very flexible and that has lots of potential to play with, If you assume that your users are not stupid. 08:51.360 --> 08:55.780 And it's something that we've done in the tool that i'm going To show you. 08:56.700 --> 09:03.440 We've basically written the Tool in such a way that everything that's input and Output goes into a text box. 09:03.880 --> 09:15.640 So at any time, what you can do Is you can select the whole text box and copy it into your Unix system and do your whole grip and set and all the nice Things that we like about unix. 09:16.020 --> 09:24.260 You don't have to export it in Some kind of a weird format and try to convert it into text and Then you can work with it. 09:25.060 --> 09:33.840 The other thing is that the text Boxes are hot, which means if you make a change in that text Box, that's a change that you've made to your data set. 09:33.840 --> 09:42.020 You don't have to write some kind of a sql statement in order To update this stuff somewhere within a database. 09:42.120 --> 09:44.820 That's totally database-less. 09:45.560 --> 09:46.220 Right. 09:46.220 --> 09:52.080 Now, the tool's name is called bdblah, right? 09:52.640 --> 09:56.300 Yeah, bdblah, as in blah, blah, blah, bdblah. 09:57.020 --> 10:04.220 And the tool that we written is really used for doing large-scale Assessments. 10:04.220 --> 10:07.560 Now, just a quick note on Assessment. 10:07.640 --> 10:14.600 If you're putting your domain In this tool, then this tool is doing an assessment. 10:14.600 --> 10:20.000 If you're putting someone else's domain in this tool, then You're doing an attack. 10:20.560 --> 10:29.380 So an attack and assessment is Kind of, you know, it really, when i'm doing this at black Hat, i'm saying this is an assessment tool. 10:29.880 --> 10:34.840 And when i'm doing it at defcon, i can tell you that you can Also use it as an attack tool. 10:34.840 --> 10:35.320 Right. 10:36.360 --> 10:45.720 Now, it's built to actually look to do assessments, okay, on Very large networks. 10:47.220 --> 10:55.160 The problem for demoing this Thing at a conference like this is that sense post does not have A very large network. 10:56.200 --> 11:00.080 Our clients, they have large Networks. 11:00.520 --> 11:06.380 But they won't appreciate it if We start showing the data on the screen at defcon, right? 11:08.120 --> 11:14.820 So what we're doing here is we're going to do some passive Work, which is totally passive. 11:14.820 --> 11:16.940 We're not sending any packets to The network. 11:16.940 --> 11:18.240 Well, not a lot. 11:18.640 --> 11:21.020 It's not an attack at all. 11:21.220 --> 11:25.460 No, generally, it's not a, you Will see, it's not like we're attacking anything. 11:25.780 --> 11:40.660 But we're going to do some passive work against just the IBM dns space, and we're going to do some passive work against Playboy, just because i thought, you know, if we get any results, It might be interesting to verify it. 11:44.580 --> 11:53.760 And then when we go active, we're going to look at the Sense post network, even if it's small. 11:53.760 --> 11:56.320 Keep in mind that, you know, it's a small network. 11:56.320 --> 11:58.460 You can do the same thing on a large network. 11:58.460 --> 12:08.160 And when we really go into attacking boxes and owning them, We'll be having a vmware server that we look at. 12:09.220 --> 12:15.380 Now, the problem with this stuff is there's a lot of risk in Doing this live. 12:16.420 --> 12:16.920 Okay? 12:16.920 --> 12:27.980 Because networks change all the time, and there might just be a Situation that when we did the scan yesterday, everything was Cool , but today there's a vulnerability on the machine. 12:27.980 --> 12:29.380 So we're not going to do it. 12:29.380 --> 12:33.360 Well, we might afterwards do Some stuff live. 12:34.140 --> 12:37.420 We'll see how it goes in terms Of time as well. 12:38.540 --> 12:47.200 But when we do stuff live, you Will know that we either have permission of the owners of that Network, or it's on our own network, right? 12:47.300 --> 13:01.100 So if there's any press in this room, i don't know if there's Any press, please, after this talk, please don't write an Article that says on stage, sense post attacked ibm and own The network, because that is not the case. 13:01.540 --> 13:03.760 We're not going to even try to do that. 13:03.760 --> 13:04.820 Okay. 13:04.820 --> 13:17.740 So what we've done is in the Things that in the pieces of demo that we have here, we've Basically taken some video clips of that screen captures and put It into a video. 13:18.720 --> 13:23.500 All of it is exactly the way That it works, and there's no trickery involved. 13:23.500 --> 13:38.820 However, sometimes we've paused the actual screen capture, Because, you know, when you're doing a reverse scan on a class B, that's going to take a while, and i don't want you to Sit here and look at the screen for half an hour seeing how we're Doing a reverse scan on a class b. 13:39.400 --> 13:43.260 So for that stuff, we've paused it, and it's kind of time Lapsed. 13:43.260 --> 13:45.280 But the rest of the stuff is Absolutely real. 13:45.280 --> 13:48.180 There's no image manipulation Done anyway. 13:48.520 --> 13:49.100 Right. 13:49.100 --> 13:55.280 So with that out of the way, let's have a look and see what Our external methodology looks like. 13:55.280 --> 14:02.300 Now, the people, can i just see in the class here, who's been On any of our boot camp classes at black cat? 14:03.040 --> 14:03.960 Some hands. 14:04.080 --> 14:04.760 Okay. 14:05.020 --> 14:05.760 Okay. 14:05.760 --> 14:06.540 Great stuff. 14:06.540 --> 14:13.520 Now, if you're on the boot camp class at black cat, you will Know this methodology quite well. 14:13.520 --> 14:19.400 I'm not going to go into it too much, because, you know, that's What the classes are there for. 14:19.400 --> 14:20.900 But basically it boils down to This. 14:20.900 --> 14:23.060 We start doing a footprint. 14:23.960 --> 14:27.940 From the footprint, we go on to a fingerprint. 14:27.940 --> 14:31.800 From there, we do targeting of systems that we would like to Attack. 14:32.120 --> 14:34.180 We then do vulnerability Discovery. 14:34.940 --> 14:44.540 And the last step is we actually Exploit those vulnerabilities to do penetration testing on the Host, on the network itself. 14:44.940 --> 14:50.640 Now, these, all of these little Blocks now break down into a whole lot of other sets of Blocks. 14:50.640 --> 14:52.700 So we're going to start with The footprinting. 14:54.280 --> 14:58.880 The footprinting can be Broken down into six blocks. 14:59.040 --> 14:59.500 Okay. 14:59.500 --> 15:02.020 The first block is we find the domains. 15:02.020 --> 15:17.340 Now, it seems very silly, because you might think that if You, let's say, attack, let's say you attack ibm, okay, then The place to start is ibm.Com. 15:17.340 --> 15:17.740 Right. 15:17.740 --> 15:19.220 And it's as easy as that. 15:19.220 --> 15:26.180 What you might not know is that Large organizations can have up to 2,000, 3,000 different Domains. 15:26.180 --> 15:30.540 And those domains all carry Dns information that's pointing to ip addresses. 15:30.540 --> 15:33.880 And those ip addresses sit within net blocks. 15:33.980 --> 15:44.280 And those net blocks might contain machines that are Vulnerable and that has access to the internal network or, you Know, connected via vpn into the internal network. 15:44.320 --> 15:47.200 So the idea is that we find as many domains as we can. 15:47.200 --> 15:52.080 And then go to the next step, which is to find subdomains Within those domains. 15:52.340 --> 15:58.280 And, again, finding subdomains In a domain might seem at this stage very kind of silly. 15:58.280 --> 16:00.700 But you'll see that it's actually quite interesting. 16:01.240 --> 16:03.760 We then do forward dns entries. 16:03.760 --> 16:08.560 So we basically look for Anything we can find within the forward zone. 16:08.860 --> 16:09.800 We get net blocks. 16:09.800 --> 16:12.580 We start trimming those net Blocks down to size. 16:12.840 --> 16:16.440 We might add other net blocks Into those net blocks. 16:16.620 --> 16:25.660 Once we're done with our net Blocks, the first round of definition of our net blocks, We do a dns reverse scan of that particular block. 16:25.960 --> 16:27.860 And that might lead to two things. 16:27.860 --> 16:31.960 The first is we might find new domains coming out that we Didn't know about. 16:31.960 --> 16:33.680 It almost always happens. 16:34.800 --> 16:40.340 And we find that maybe our net blocks weren't defined so Nicely. 16:40.340 --> 16:44.940 So we can redefine our net Blocks at that stage if it needs to be redefined. 16:45.380 --> 16:52.260 Once we have our net blocks nicely tied down, we can go to The next step, which is vitality testing. 16:52.320 --> 16:54.640 Vitality testing or vitality scanning. 16:54.780 --> 16:56.920 The idea is you sit with a class b. 16:56.920 --> 16:59.460 You're going to run an s scan against a class b? 16:59.460 --> 17:01.000 I don't think so, right? 17:01.140 --> 17:15.220 The idea there is to find Machines that are alive within a big network space so that we Can do targeting on it in the next step and decide which of Those machines within that big piece of space is interesting To attack. 17:16.160 --> 17:25.760 Now, this footprinting Methodology, these six blocks that are here can now be broken Down into more blocks. 17:26.020 --> 17:26.420 Okay? 17:26.420 --> 17:29.380 It's like, you know, what is it, russian dolls? 17:29.840 --> 17:32.680 You keep taking out the dolls, it's the same thing over here. 17:35.760 --> 17:36.500 Okay. 17:36.500 --> 17:41.600 So just to give you an overview Of how this whole thing sits together, i've made this movie. 17:41.740 --> 17:45.160 I've made this movie using visual and word. 17:45.160 --> 17:49.480 So it's a little bit sucky, i know, but, you know. 17:51.280 --> 17:53.620 So we start with the main domain. 17:53.680 --> 17:56.280 From that domain we get subdomains. 17:56.940 --> 17:59.860 From the subdomains we start doing forward lookups. 17:59.860 --> 18:02.260 That's pointing to ip addresses, right? 18:02.260 --> 18:04.380 Those are the little arrows at the end. 18:04.900 --> 18:09.260 From that we start our first round of net block definitions. 18:09.260 --> 18:10.880 It might be one ip big. 18:11.140 --> 18:14.140 It might be, you know, class c. 18:14.140 --> 18:16.720 At this stage we actually don't know. 18:16.880 --> 18:18.760 We do reverse entries. 18:18.960 --> 18:20.180 Reverse dns entries. 18:20.180 --> 18:21.240 I'm just going to pause it over here. 18:21.240 --> 18:22.620 That's the red lines. 18:22.820 --> 18:28.060 And from the reverse we can get New domains, right, which might be related. 18:28.060 --> 18:30.280 Or that could be totally unrelated. 18:32.660 --> 18:37.020 This will help us to define our net blocks even nicer. 18:37.360 --> 18:40.300 Make the net block definition even tighter. 18:40.300 --> 18:45.460 As you can see here, we've now broken those net blocks into Smaller blocks. 18:46.100 --> 18:49.900 Once we're done with that, we're Going to go on and do vitality scanning. 18:49.900 --> 18:54.860 Those are the little dots you see over there in the x's for Closed ports. 18:55.320 --> 19:05.060 Once we have those machines Within those networks defined, we can do a port scan on those Machines to find out exactly what ports are open on each of Those ip addresses. 19:05.760 --> 19:11.360 And once we have that, we can Basically start doing vulnerability finding. 19:11.360 --> 19:22.860 So there, for instance, we have the apache 132 chunk encoding Problem that sits on one port, on one ip, within one network That was given to us by one domain. 19:23.280 --> 19:26.220 In this case, we're using one domain. 19:26.260 --> 19:28.100 You can use as many domains as you wish. 19:28.100 --> 19:32.960 Like i said, some of the big corporations have up to Thousands of domains. 19:33.600 --> 19:34.660 So this is the picture. 19:34.660 --> 19:36.400 This is the whole picture of the thing. 19:36.400 --> 19:38.200 Let's see how it actually works. 19:39.680 --> 19:44.560 So within the footprint, remember we went into this. 19:44.600 --> 19:47.080 This is now the first block finding the domains. 19:47.240 --> 19:48.760 I'm going to go into that. 19:49.640 --> 19:52.300 We haven't implemented this Within this tool. 19:53.240 --> 19:56.560 And i'll tell you later on why We haven't implemented this. 19:56.560 --> 20:01.420 It's one of those things where There's lots of exceptions and it's not that easy to implement. 20:01.420 --> 20:02.740 We started doing it. 20:03.240 --> 20:04.460 But it's not there yet. 20:04.460 --> 20:06.180 So you won't see it within this tool. 20:06.180 --> 20:14.660 For the subdomain mining, what we basically do is we start Off with a domain itself. 20:15.720 --> 20:17.340 Now, let me ask you this. 20:17.340 --> 20:21.780 If you google for ibm, let's take ibm as an example. 20:21.900 --> 20:24.320 And please, again, i've got nothing against them. 20:24.520 --> 20:28.800 If you google for ibm, yeah, i'm using an ibm notebook. 20:28.800 --> 20:29.800 Come on. 20:32.180 --> 20:44.020 If you google ibm, okay, you're Going to find a whole lot of hits, right, that points to Machines that's sitting on a domain ibm.Com. 20:44.080 --> 20:52.020 So, for instance, one of the links that you might get is Something coming off a site called tripwchess.Ibm.Com. 20:52.020 --> 20:53.440 Not chest, no. 20:53.440 --> 20:54.980 Chess, right? 20:55.000 --> 20:55.900 Okay. 20:56.380 --> 20:59.340 And what do we know from that? 20:59.640 --> 21:04.060 We know there's a subdomain called chess.Ibm.Com, right? 21:04.060 --> 21:18.060 And as we go along, we can google for different kind of Common words and look if it's related, if it is within the Ibm.Com domain, and using google, we can basically pull Out a whole list of subdomains. 21:18.160 --> 21:37.760 We can also pull out a whole Lot of domains itself, a whole lot of dns names itself, Because if something resides on tripwchess.Ibm.Com, then we Know that tripwchess.Ibm.Com exists, which gives us one Forward entry in our table of maybe lots of forward entries That we're going to pick up later. 21:37.800 --> 21:39.400 Everybody's cool with that, right? 21:39.480 --> 21:41.860 So let's see how it is actually done. 21:42.060 --> 21:46.200 Sorry, if you want to have More information about that, you should attend johnny long's Talk. 21:46.200 --> 21:48.840 He's doing a whole section on Subdomain mining. 21:49.520 --> 21:50.720 He's right there. 21:51.160 --> 21:51.800 Okay. 21:53.140 --> 21:55.260 So let's see how it works. 21:55.260 --> 22:07.260 Now, it normally takes about five minutes per domain to get Subdomains, and this is at the moment set to only look at the First three pages that google returns, right? 22:07.260 --> 22:17.700 So we can set it to return as many pages, but the kind of 80-20 Principles at work here, we find 80% of the hits within 20% of The time, okay? 22:17.700 --> 22:20.680 so doing three pages is just About okay. 22:20.920 --> 22:24.720 And we've got a couple of Keywords that we can combine the search with. 22:24.920 --> 22:26.940 So i don't know if you can see there at the back. 22:27.750 --> 22:31.120 What we're going to do is i'm going to start playing this Video. 22:31.980 --> 22:38.000 So we enter ibm.Com in there And we hit the start button. 22:38.860 --> 22:43.580 And now the tool is basically Through the google api querying google. 22:43.800 --> 22:45.700 We also get e-mail addresses. 22:45.840 --> 22:56.920 So, for instance, there you Have no one, no one at us.Ibm.Com, and from that, we Obviously know that there's a subdomain called usa.Ibm.Com. 22:58.300 --> 23:02.260 When this tool is done, this is obviously time lapsed. 23:02.280 --> 23:06.920 You'll see on the right-hand side, we have a whole list of Subdomains. 23:07.560 --> 23:09.700 Uk.Ibm.Com, us. 23:09.700 --> 23:13.420 Watson.Ibm.Chess and so forth and so on, okay? 23:14.180 --> 23:23.300 And while this might not look so interesting on ibm.Com, we Might afterwards show you an example that is more Interesting, okay? 23:23.520 --> 23:28.360 so basically what we have now Is we have the subdomains, right? 23:28.360 --> 23:30.560 We have the domains and we have the subdomains. 23:30.560 --> 23:35.880 And what we want to do is we want to find all the forward Entries that we can possibly find, right? 23:36.180 --> 23:37.600 So hang on a bit. 23:38.620 --> 23:45.520 What do you think would be The first step to check for when we're doing, when we're Finding forward dns entries? 23:45.520 --> 23:50.280 what would be the first thing That we would see if this is possible on the domain? 23:50.480 --> 23:51.220 Anyone? 23:51.640 --> 23:52.180 anyone? 23:52.180 --> 23:52.480 okay. 23:52.480 --> 23:53.380 Hang on a bit. 23:54.000 --> 23:55.240 Where's our t-shirts? 23:55.240 --> 23:57.100 Do we have t-shirts? 24:10.140 --> 24:11.440 let's see again. 24:13.540 --> 24:20.320 What would be the first thing that you do when you have a Domain and you want to find all the forward entries in the Domain ? 24:20.320 --> 24:20.920 yes, sir. 24:21.940 --> 24:22.540 Sorry? 24:24.080 --> 24:24.880 no. 24:25.760 --> 24:27.220 Who said zone transfer? 24:27.380 --> 24:28.160 there you go. 24:29.000 --> 24:29.560 Okay. 24:29.560 --> 24:34.320 So the first thing that we're Going to do is we're going to attempt to do a zone transfer, Right ? 24:34.500 --> 24:35.100 why? 24:35.100 --> 24:39.660 Because if we can transfer the zone, we get all the Information in the zone in one go. 24:39.980 --> 24:42.640 We don't have to mine for any dns data. 24:42.640 --> 24:44.640 We get the entire zone. 24:45.340 --> 24:54.640 So the first thing we're going To do is we're basically going to check for mx records and ns Records and then we're going to see if a zone transfer is Possible. 24:55.260 --> 24:58.500 Where's my handy laser pointer? 24:58.500 --> 25:04.560 If a zone transfer is possible, we immediately have all the Forwards within that list. 25:04.860 --> 25:12.900 The next thing we want to do if a Zone transfer is not possible, which is most likely the case, We're basically going to go through a hit list. 25:12.920 --> 25:14.940 I'll explain that just now. 25:14.980 --> 25:21.080 And from the hit list, we're Going to perform the forward and that's going to drop us into This container over there. 25:21.080 --> 25:23.560 Now, the hit list works like This, right? 25:23.560 --> 25:37.300 if you see that a machine Exists with the name of gandalf.Ibm.Com, what's the Chances that there will be a machine called frodo.Ibm.Com? 25:37.820 --> 25:39.560 Pretty good, right? 25:39.620 --> 25:56.060 so the idea what we're doing There is we're building a whole lot of lists, right, of things Like we have colors, we have animals, we have characters out Of lords of the rings, we have characters from hitchhiker's Guide to the galaxy, terry pratchett books, 25:56.060 --> 26:00.480 we have names Out of the bible and so forth and so on. 26:00.480 --> 26:07.620 And basically we test for four entries, it's configurable, but We test for four entries within that list. 26:07.620 --> 26:12.160 That list is sorted from the more popular names at the Beginning. 26:12.340 --> 26:18.460 And we basically check if one Of those names exists and if they do exist, we check the Whole list, okay? 26:18.980 --> 26:29.940 so it gives us a way of Finding out what kind of naming scheme these people are using, Using only four dns entries, dns queries, right? 26:30.840 --> 26:36.060 Because they're not going to have some kind of a weird name Out of lords of the rings and not have gandalf, right? 26:36.060 --> 26:38.060 They would have gandalf or frodo. 26:38.900 --> 26:40.340 So let's see how this works. 26:40.340 --> 26:44.760 Now, for this, we've done it on Playboy, okay? 26:44.820 --> 26:50.280 and we've now started with Doing the subdomains. 26:50.440 --> 26:57.740 In the case of playboy, we Only find two subdomains called casino.playboy.com and Playboynet.playboy.com. 26:58.900 --> 27:02.800 And what we're going to do is We're going to go on to the forwards, okay? 27:02.860 --> 27:08.740 When we click there, we can basically import the stuff from The previous section, okay? 27:08.740 --> 27:11.060 what you see there, sorry, i Missed this. 27:11.780 --> 27:13.400 Let's just pause it here. 27:14.040 --> 27:15.980 Can you see that at the back at all? 27:16.120 --> 27:17.480 probably not, right? 27:17.520 --> 27:21.140 Can you see at the back, people at the back, can you see the Actual lettering there? 27:22.060 --> 27:22.860 no? 27:23.280 --> 27:24.480 Dude, i'm sorry. 27:28.580 --> 27:31.360 No, i can't make it any larger. 27:32.200 --> 27:37.880 Okay, i can, but then, you know, that means rewriting the App for another font in that window there, okay? 27:37.880 --> 27:40.520 So basically what you see over there, just trust me on this, Okay? 27:40.520 --> 27:41.420 i'm not lying. 27:41.420 --> 27:43.080 And the people in front can verify. 27:43.260 --> 27:51.860 So what you're seeing there at that part of the screen over There is entries that we've already found with the google Search, right? 27:51.860 --> 27:56.100 those are already forward Entries that we found with the google search. 27:57.060 --> 27:58.140 So they exist. 27:58.760 --> 28:00.300 So now we're going to add to It. 28:00.380 --> 28:02.620 Let's just see if i can, okay? 28:02.720 --> 28:06.980 And i'm going to click on import, right? 28:07.380 --> 28:11.380 And we get our list over there of things that we have. 28:11.580 --> 28:15.720 Fruit, e-commerce, colors, names, music, all of that. 28:15.960 --> 28:19.520 And immediately when we do that, we start getting results. 28:19.520 --> 28:26.220 Now, those results there, i know you can't see it even if You're sitting in the front, those are the mx records and The ns records, okay? 28:26.220 --> 28:27.540 it's just in a different color. 28:27.980 --> 28:33.720 But we basically, here at the bottom, you'll see that we're Starting to check forward entries, right? 28:33.720 --> 28:39.780 And we already got ftp, we got content.playboy.com, which, You know, i don't know, it could be interesting. 28:42.360 --> 28:46.300 And at this stage, i've basically stopped it and let it Run through. 28:46.300 --> 28:47.560 The capture, i stopped the Capture. 28:47.560 --> 28:50.920 So you see there the end of The entire capture. 28:51.460 --> 29:00.020 You get machines like secure 2.Playboy.com, it's all kind of interesting. 29:00.120 --> 29:07.180 The other thing that we can do is we can add at the end of a Forward , we basically add some fuzzing strings, okay? 29:07.180 --> 29:16.840 So when we test, for instance, ftp, we also test for ftp1 and Ftp2 and ftp-1 and ftp-2. 29:17.320 --> 29:22.440 And you can have as many as you Want, right? 29:22.440 --> 29:26.780 at the moment we were just Testing dash 1, dash 2, 1 and 2, okay? 29:26.780 --> 29:29.800 But it's basically kind of fuzzing the dns out. 29:30.700 --> 29:43.360 So what we have after this is we can collect all of the dns Forward entries that we can possibly get from a domain, we Can collect them in that text field on the right-hand side. 29:43.360 --> 29:47.040 Ah, shit. 29:48.680 --> 29:49.460 Okay. 29:49.460 --> 29:56.800 So the next step that we want to do is we basically want to Look at net blocks, okay? 29:56.800 --> 30:02.100 now, the idea is the first thing We can do is we can take all of those ip addresses that we had, Right? 30:02.260 --> 30:10.680 and we can slice off the last Digit from them and assume they're all class c's and start Off with a class c definition, right? 30:10.680 --> 30:12.880 Okay, we're going to start doing that. 30:14.440 --> 30:15.240 Absolutely. 30:18.980 --> 30:20.260 You're absolutely correct. 30:20.760 --> 30:22.820 So we're going to start by that. 30:22.820 --> 30:24.060 We've got to start somewhere. 30:24.160 --> 30:25.380 You're absolutely correct. 30:25.380 --> 30:26.420 So you'll see. 30:26.880 --> 30:27.440 Okay. 30:27.700 --> 30:35.540 And what we're going to do is We're going to add into that, see what the who's definition is Of that block to see if we can get the net block out of there. 30:35.780 --> 30:43.220 We're going to look at additional blocks like from And all of those wonderful places. 30:44.140 --> 30:46.560 But you'll see how that is also difficult to do. 30:46.580 --> 30:53.920 We're going to look at reverse dns entries to find out if the Blocks are at the correct boundaries. 30:54.140 --> 31:08.120 And another technique that we were looking at is to basically Find the as number of the root connected to that particular ip Address, then put that as number back in and see what other Roots are within the same as. 31:08.640 --> 31:09.240 Okay? 31:10.140 --> 31:13.220 And we'll talk about what the challenges are in that. 31:13.680 --> 31:16.600 So let's just look what happened to playboy. 31:17.160 --> 31:19.980 I'm going to start playing this thing again. 31:20.580 --> 31:21.240 All right. 31:21.240 --> 31:23.260 So we go to the next step. 31:23.500 --> 31:26.600 We do import, right? 31:26.600 --> 31:38.040 and at this stage, the tool Will tell you this will import from the forwards and assume Class c blocks, it might be a dangerous assumption. 31:40.800 --> 31:41.900 All right. 31:42.760 --> 31:43.080 Okay. 31:43.080 --> 31:44.300 So that's a start. 31:44.680 --> 31:47.960 And we see all of those 216s in There. 31:48.340 --> 31:50.580 They kind of look as if they Belong together. 31:50.620 --> 31:55.060 When you click on it, you Basically get all the forwards that sit within that block. 31:56.400 --> 31:57.120 Okay. 31:57.120 --> 31:58.040 Let's see. 31:59.140 --> 31:59.500 Okay. 31:59.500 --> 32:02.600 So there's a lot of the playboy Stuff coming, ftp, help. 32:02.680 --> 32:07.540 And we can click on the who's Button and basically get the who's information for that Block. 32:07.640 --> 32:17.000 And we see that, okay, that is Actually not a class c, but it's a couple of them. 32:17.220 --> 32:20.200 I think it's about, what, 16 class c's. 32:20.540 --> 32:30.720 And then we can simply change our block definition over there And say, okay, it's not from 36, it's from 128 all the way up To 143. 32:31.120 --> 32:37.660 As soon as we do that, the Other blocks that was there got kind of sucked into that list Because they're, you know, inside of that network now. 32:38.880 --> 32:39.480 Okay. 32:39.480 --> 32:44.000 In this case, you will see this Machine is a name server, 244. 32:44.040 --> 32:47.280 And we can have our blocks even One ip big. 32:47.340 --> 32:50.820 You know, we can have one ip, We can have a class b, we can have a class a. 32:50.820 --> 32:51.800 It really doesn't matter. 32:51.880 --> 32:56.920 We just change it to say that That thing is now only one ip large. 33:01.800 --> 33:02.380 Right . 33:04.280 --> 33:05.440 Okay. 33:08.160 --> 33:19.260 What's interesting here is we did the forwards on, just want To check if it's the case, we did the forwards on IBM as well. 33:20.740 --> 33:24.840 So you can have a look and see what their net blocks look like. 33:24.840 --> 33:28.280 You know, they got some crazy class bs out there. 33:28.360 --> 33:29.920 Look at the size of that block. 33:29.920 --> 33:32.760 There's a couple of class bs in There. 33:33.460 --> 33:34.280 Okay. 33:34.280 --> 33:37.820 So the next thing we're going to do is we're going to do Reverse dns scans. 33:37.820 --> 33:41.640 And the reverse dns scan looks Kind of intimidating. 33:41.820 --> 33:43.560 It's actually quite easy. 33:44.020 --> 33:46.900 We're going to start with the net blocks that we have at this Stage. 33:46.900 --> 33:51.880 We're going to do a reverse Dns entry on each of them. 33:52.160 --> 34:00.840 And then we're going to apply Some filters and say if this thing is contained within that Filter, okay, we say it's the match entry. 34:00.960 --> 34:03.080 We can extract the domain from there. 34:03.340 --> 34:08.840 See if the domain is already found in our list of domains That we supplied. 34:08.860 --> 34:10.980 If it's not, we can add the Domain. 34:11.360 --> 34:18.720 And if it doesn't match the Filter, we say hang on a bit, here's a domain within that Block that does not match your filter. 34:18.720 --> 34:22.840 Maybe it's interesting to have a look and see what else is on That domain. 34:23.260 --> 34:24.940 So let's see how this works. 34:30.080 --> 34:30.580 Okay. 34:30.580 --> 34:31.400 There's the forwards. 34:31.400 --> 34:32.020 It's now i.P. 34:32.020 --> 34:32.760 Sorted. 34:33.660 --> 34:35.500 You can go to the net blocks. 34:35.600 --> 34:37.500 Those are the net blocks that we defined. 34:37.780 --> 34:45.700 When we start the reverse, you'll see that it Automatically puts in the filters a list of the domains Because that's probably what you want to filter on. 34:45.700 --> 34:52.140 In our case, we change it so that it only says playboy Because maybe there's another playboy domain, playboypix. 34:52.140 --> 34:55.200 And we want that filter to pick it up as well. 34:55.860 --> 34:57.500 We start at the reverse now. 34:57.500 --> 35:00.080 You can see these are all the Entries that we get back. 35:00.900 --> 35:02.600 These are domains. 35:02.600 --> 35:09.380 There's playboyenterprise.com, for instance, that match the Filter, but we don't have playboy enterprise as a domain. 35:09.380 --> 35:14.020 So it's an additional domain that's a match domain that we Want to put back into the system, right? 35:14.560 --> 35:17.260 Now, this is not the speed at which it ran. 35:17.420 --> 35:22.840 I kind of paused it a couple of times so you don't have to sit Here the whole time looking at the thing running. 35:23.160 --> 35:26.480 At the bottom, you see there's something called, what is it? 35:26.480 --> 35:27.960 No, go down. 35:29.460 --> 35:32.040 Spicetv.com, right? 35:32.400 --> 35:46.560 If we do a whois on spicetv.com, right, you will see that it is Sitting at spiceentertainmentinc, and it's Sitting somewhere in chicago. 35:46.560 --> 35:48.700 Note the address, okay? 35:48.700 --> 35:52.400 Lake shore drive, chicago, and there's a phone number there. 35:52.620 --> 35:53.820 So let's just have a look and see. 35:53.820 --> 35:59.400 If we do a whois on playboy.com, what the contact information Would be for them. 36:00.380 --> 36:01.940 And what do you know? 36:02.080 --> 36:04.280 It is the same address. 36:04.460 --> 36:09.640 So spicetv and playboy is Clearly related, right? 36:09.800 --> 36:11.340 they are the same company. 36:11.340 --> 36:26.000 So in terms of putting new domains within your system to Start scanning for more interesting domains and to Start finding more ip addresses and more net blocks, you should Be looking at spicetv.com as well. 36:26.040 --> 36:35.340 So we can take that stuff, take out the subs in there, sort Unique that, basically cut all of that stuff out. 36:35.600 --> 36:37.620 You would see there's a bug in the program at this stage. 36:37.620 --> 36:43.320 It's fixed in the release that we have now, whereby it didn't Check for uppercase, lowercase. 36:43.320 --> 36:46.920 So playboy.com uppercase was Still in the list of unmatched. 36:47.840 --> 36:50.100 That's just too lower. 36:51.480 --> 36:56.620 And we can take all of that Stuff and we can basically paste it back in here with the rest Of our domains. 36:56.820 --> 36:58.540 See there, i take it out nicely. 36:59.720 --> 37:01.080 Sort unique that. 37:01.180 --> 37:02.480 And we can start over again. 37:02.480 --> 37:06.500 And that's why we have this kind of cyclical thing between the Reverse and the forwards. 37:06.500 --> 37:10.760 Until those blocks that we Scanned come out completely clean at the other end. 37:11.680 --> 37:12.560 Okay. 37:13.980 --> 37:23.880 Now, the next step we want to Do, when we're happy with our net block definitions, is we're Going to find what machines are actually within those blocks That we can attack. 37:23.880 --> 37:24.420 Correct? 37:24.700 --> 37:31.480 Now, again, imagine that you're doing this on a very large Organization and you've got, let's say, ibm with lots of Class b's. 37:32.240 --> 37:35.980 You need to, well, they've got Multiple class b's. 37:35.980 --> 37:37.680 You need something that's Really fast, right? 37:37.680 --> 37:41.580 this is, it ain't going to work If you're not scanning it really quick. 37:42.280 --> 37:44.940 Now, there's three ways that we can find out if a machine is Alive. 37:44.940 --> 37:47.680 We can do your normal icmp Scan, of course. 37:48.180 --> 37:50.980 We can do udp scans, which is A little bit more trickier. 37:51.580 --> 37:53.580 And we can do tcp scans. 37:53.580 --> 37:56.140 And then we go for kind of a small list of ports. 37:56.300 --> 37:57.440 And we only check for that. 37:57.440 --> 37:59.880 And sure, we're going to miss Stuff, okay? 38:00.100 --> 38:04.820 but the more ports you test for, The more it becomes a port scan on the entire range. 38:06.320 --> 38:07.920 And the longer it's going to take. 38:07.920 --> 38:16.260 So depending on your time here, you can either scan all the Ports or you can scan for a very small subset and only find the Machines that's alive on those ports. 38:17.200 --> 38:23.020 Now, what we've done with the port scanning is basically Implement a asynchronous port scanner. 38:23.360 --> 38:25.040 And you've all seen this. 38:25.040 --> 38:28.780 It's been used now in many kind Of tools. 38:29.340 --> 38:30.780 It basically works like this. 38:30.780 --> 38:32.960 We send out a sin, right? 38:32.960 --> 38:34.800 we have a sniffer on the other End. 38:34.800 --> 38:36.980 We check for the source port Coming back. 38:37.240 --> 38:40.100 If it's a sinack, the port is Open. 38:40.240 --> 38:42.680 If it's a reset, the port is Closed. 38:42.800 --> 38:44.280 It's as easy as that. 38:45.460 --> 38:47.020 So let's see how it works. 38:47.920 --> 38:53.080 This thing, and i know some of The other scanners, i mean, check out the unicorn scan Thing as well. 38:53.180 --> 38:55.880 I think they were speaking Yesterday morning, right? 38:56.260 --> 38:58.940 they're doing the same thing, But they're doing it distributed. 38:59.580 --> 39:01.500 So it's even faster that way. 39:01.820 --> 39:06.920 But we can probably, you know, Do one port in a class b in two minutes. 39:07.700 --> 39:10.680 So if you're only scanning for one port, it's going to take You about two minutes. 39:11.220 --> 39:16.500 We limit this thing so it only Sends, you know, at the quickest it can send out packets Every two milliseconds. 39:17.280 --> 39:20.420 Obviously you can do it faster Than that if you implement it yourself. 39:22.640 --> 39:23.440 Oops. 39:25.720 --> 39:26.200 Okay. 39:26.200 --> 39:30.340 So let's just look at the whole process for sensepost.com Because it's really quick. 39:30.380 --> 39:32.680 We go there, we find the Forward entries. 39:33.000 --> 39:34.280 It's going really quick. 39:34.700 --> 39:35.180 Okay. 39:36.040 --> 39:37.380 We're almost done. 39:38.300 --> 39:39.100 Right. 39:39.260 --> 39:40.900 We take it into the net blocks. 39:41.880 --> 39:46.260 What you will find is there's a 10, 15, 10 in there. 39:47.220 --> 39:51.540 Which, i mean, it's not internal, but we use it for the Training. 39:51.720 --> 39:55.220 So i'm taking that out Because i'm not going to scan 10, 15, 10, right? 39:55.220 --> 39:56.480 That's a little bit silly. 39:58.000 --> 40:13.560 And the other thing that's Interesting here to note is, let me just pause this, is that With service pack 2, xp service pack 2, microsoft actually Disabled the use of raw socket sending, right? 40:14.700 --> 40:21.500 Because they went through all the tools that uses raw socket Sending and they were like bad, bad, bad, bad. 40:21.500 --> 40:22.620 Let's not check the rest. 40:22.620 --> 40:23.540 They're all bad. 40:23.580 --> 40:24.240 Okay. 40:24.300 --> 40:26.100 So they disabled it. 40:26.360 --> 40:28.480 Which is a pity. 40:28.500 --> 40:36.560 So for us to be able to do This on this level, we need to drop a level down and send Those packets out on an ethernet layer. 40:37.420 --> 40:40.480 And so there's a driver that actually that we use. 40:40.580 --> 40:43.000 You've got to bind the driver and send the packets out that way. 40:43.000 --> 40:46.640 It's a little bit more tricky, but it's not that much more Tricky. 40:48.280 --> 40:49.200 Okay. 40:49.360 --> 40:52.900 So basically these net blocks now come in from the previous Step. 40:52.900 --> 40:54.760 We select what ports we want to Scan. 40:54.760 --> 40:56.340 It's all configurable, of Course . 40:57.640 --> 41:02.120 In this case, we go with 22, 23, 25, and 443. 41:02.640 --> 41:05.500 And we basically just start it Up over here. 41:07.620 --> 41:11.700 The ports that are found open Is listed on that side. 41:11.700 --> 41:13.640 Showing an o for open port. 41:13.640 --> 41:15.660 Shows you the ip, shows you the port. 41:15.720 --> 41:21.740 And it also shows you the ttl, which gives you a kind of idea Of how far the machine is away from you. 41:21.740 --> 41:28.460 Although, you know, some stacks send their packets out with the Ttl of 128, others with other values. 41:28.460 --> 41:29.920 So it's not that useful. 41:29.920 --> 41:32.080 But, you know, we put it in there Now. 41:32.080 --> 41:40.520 You'll see as soon as we go into The 72 network, things start to go a little bit quicker in there Or we get more results coming back. 41:40.520 --> 41:41.400 There we go. 41:41.940 --> 41:42.640 Okay. 41:43.880 --> 41:47.540 Because there's lots of machines that's open on those ports. 41:47.540 --> 41:49.600 And you'll see we paused it there. 41:49.600 --> 41:50.700 So it's going to jump. 41:50.900 --> 41:51.340 Okay. 41:52.300 --> 41:54.420 And that's basically doing the port scan. 41:54.420 --> 41:54.780 Right ? 41:54.780 --> 42:01.040 basically doing the port scan On the net blocks and on the ports that we specified in the Previous section. 42:02.340 --> 42:03.220 Okay. 42:04.320 --> 42:05.360 All right. 42:05.920 --> 42:08.920 So if you look at the whole Footprinting thing, it looks like this. 42:09.340 --> 42:12.500 And you're not supposed to be able to read anything that's on The screen. 42:12.680 --> 42:18.420 It's just to give you some Idea of all the different steps and the complexity involved with This whole thing. 42:18.780 --> 42:18.860 Okay. 42:18.860 --> 42:20.740 We start off with a domain over there. 42:20.960 --> 42:24.340 We end up with a whole list of ip numbers on that side. 42:24.380 --> 42:27.380 We're doing whole lots of tricks in between to make it work. 42:28.800 --> 42:29.300 Okay. 42:29.300 --> 42:31.500 So footprinting, it's over. 42:31.540 --> 42:32.780 I know people don't like it. 42:32.780 --> 42:33.520 I dig it. 42:33.520 --> 42:34.900 But it's not over. 42:34.960 --> 42:35.520 Right? 42:35.680 --> 42:40.940 So within this thing, which steps are easy to automate and Which steps are really difficult to automate? 42:40.940 --> 42:45.380 The domain finding stuff is really difficult to automate. 42:45.400 --> 42:45.800 Okay . 42:45.800 --> 42:51.180 We wrote a paper on this two Years ago for black hat singapore. 42:51.400 --> 42:52.780 You can get it off the black hat site. 42:52.780 --> 42:54.760 You can see the methods that we use there. 42:55.320 --> 42:58.820 I know johnny is going to talk about some of those methods in His talk as well. 42:58.820 --> 42:59.720 But it's difficult. 42:59.720 --> 43:00.960 It's not nice. 43:00.960 --> 43:02.720 It's not a fun thing to do. 43:03.840 --> 43:06.080 And at the moment, we don't do it. 43:06.080 --> 43:10.480 You can learn a lot from the reverse entries like we found On spice tv.Com. 43:10.980 --> 43:12.480 But we don't do this. 43:12.680 --> 43:15.320 The subdomain finding, we got it. 43:15.320 --> 43:15.700 It's cool. 43:15.700 --> 43:17.360 Forwards, no problem. 43:17.400 --> 43:19.440 The net blocks, it's difficult. 43:19.560 --> 43:25.880 The as expansion technique that We have there don't always work on small networks. 43:25.880 --> 43:30.480 So , for instance, sense post has one class c. 43:30.620 --> 43:38.260 But if you do a whois, if you look at the as that's Basically attached to our net block, you would find that it Belongs to the isp. 43:38.260 --> 43:46.180 And if you look at all the Other routes within that as, you're going to get the net Blocks for the isp, which is not necessarily what you want To do, right? 43:47.600 --> 44:01.720 the other problem is that these Registrars like LACNIC and APNIC and those guys, RIPE and ARIN, don't have a way to search with a wild card for Names and get back net blocks. 44:01.720 --> 44:08.120 I mean, you can do it on ARIN And you can kind of do it on RIPE with a bit of trouble. 44:08.120 --> 44:13.060 But you can't do it on LACNIC and you can't do it on APNIC and you can't do it on any of the others. 44:13.060 --> 44:14.140 You just can't do it. 44:14.140 --> 44:17.120 So you can't get more net Block definitions from those guys. 44:18.040 --> 44:30.860 The reverse scans, oh, and the other thing is the whois Information is worthless on these small little networks, right, because they don't have the actual person that is The company that has that net block. 44:30.860 --> 44:34.000 They only have the isp or something like that in there. 44:34.000 --> 44:35.600 So that's useless as well. 44:35.700 --> 44:38.100 The reverse scans, that's Easy. 44:38.100 --> 44:38.720 We can do it. 44:38.720 --> 44:40.080 It's a no-brainer. 44:40.140 --> 44:42.040 The vitality stuff, easy. 44:42.240 --> 44:48.300 At the moment we only got the TCP stuff, but doing the rest Is really just an extension on that. 44:48.740 --> 44:51.220 So why do you care about footprinting? 44:52.420 --> 45:01.160 You know, because there's a difference between finding one Vulnerability on one machine versus finding one machine With one vulnerability. 45:01.840 --> 45:06.920 And I think actually Dan Kaminsky had this point that he made in his talk last night As well. 45:07.140 --> 45:13.280 It's easier finding one Vulnerability on a whole lot of machines than finding one Vulnerability on one machine. 45:14.300 --> 45:14.740 Okay. 45:14.740 --> 45:16.400 So we've done with that, right? 45:16.400 --> 45:17.660 we've done with that first Block. 45:17.660 --> 45:19.400 We're going to move on to Fingerprinting. 45:19.600 --> 45:23.420 Now, fingerprinting, we Actually want to do os detection, right? 45:23.420 --> 45:31.180 We want to be able to see, say, that is a windows machine Running windows 2000, service pack 3, whatever. 45:31.200 --> 45:36.380 It's really difficult to do this from the internet on a Machine that is tightly firewalled. 45:36.720 --> 45:37.280 Why? 45:37.280 --> 45:39.360 It's not technically difficult. 45:39.360 --> 45:43.280 It's not only technically Difficult, but it's conceptually difficult as well. 45:43.460 --> 46:03.420 So if you have an apache machine, all right, that's Protected with the firewall 1 running on windows, microsoft Windows, with one-to-one net back to that apache box, that Thing is going to report itself on a network level as a Windows machine, right? 46:03.420 --> 46:05.460 because you're talking to the Windows stack. 46:05.840 --> 46:12.020 But on application level, it's Going to return itself back as a apache machine. 46:12.340 --> 46:18.160 So not just is it difficult to find that stuff, it's also Difficult to kind of decide which one will it be. 46:18.740 --> 46:21.760 So with bdblah, we don't try to do os detection. 46:21.760 --> 46:23.280 We don't even try to. 46:23.280 --> 46:25.200 What we do is we do banner Scanning. 46:25.200 --> 46:31.800 And i know, i know, everybody Tells me you can change the banner, but how many people Actually is changing their banners? 46:31.800 --> 46:34.220 not a whole lot of People are changing their banners, right? 46:34.300 --> 46:35.820 So we're saying, okay, that's fine. 46:35.820 --> 46:38.860 Let's just do banner scanning, let's see what we get. 46:39.600 --> 46:42.280 And we do it asynchronously again. 46:42.280 --> 46:45.020 And the asynchronous banner scanning stuff is quite cool. 46:45.780 --> 46:49.340 You can do asynchronous banner scanning for any kind of Banner. 46:49.900 --> 46:57.940 But the more complex it Becomes in terms of negotiation, like ssl, for instance, the More tricky it becomes to do it asynchronously. 46:57.940 --> 47:02.080 So we've done it with the ssl stuff. 47:02.080 --> 47:03.460 We've done it multithreaded. 47:03.520 --> 47:07.920 And with the rest of the stuff, We did it with the other ports, we've done it asynchronously. 47:07.920 --> 47:09.020 How does it work? 47:09.400 --> 47:09.980 okay. 47:10.060 --> 47:17.580 Basically, the same way that we had a asynchronous port Scanner, it works in the same way. 47:18.820 --> 47:20.440 So we got a sniffer. 47:20.440 --> 47:22.400 We're sending sins on this Sound. 47:22.400 --> 47:24.920 We have a sniffer that checks The source port, right? 47:25.220 --> 47:30.860 normally, if the port is open, It's going to come back with a sin. 47:33.560 --> 47:35.720 So normally it's going to go into this thing. 47:35.720 --> 47:36.460 It's going to get a sin. 47:37.000 --> 47:39.040 We've got to act that packet Back. 47:39.200 --> 47:40.340 So we send an act. 47:42.340 --> 47:45.120 We check if it's port 80 that we're testing. 47:45.300 --> 47:46.760 It could be other ports as well. 47:49.620 --> 47:54.540 And if it is, we send back a get Http1.0. 47:55.120 --> 47:59.280 Now we're going to get an act Back into this tree. 47:59.420 --> 48:02.720 If it's port 80, we extract it From the http header. 48:03.220 --> 48:06.180 If it's not port 80, we simply Extract the banner. 48:06.180 --> 48:09.460 Then it's a 25 or a 21 or any Of those, right? 48:10.600 --> 48:16.980 and we have to close the Session because otherwise our web servers are going to keep On sending the stuff back. 48:17.080 --> 48:18.680 So we have to send a fin. 48:19.660 --> 48:22.340 If there's a fin, we have to fin act that. 48:22.920 --> 48:26.260 Now, who can tell me for a t-shirt, 48:34.820 --> 48:37.900 what is the thing That's going to bite us? 48:38.020 --> 48:43.840 this works, but we have to do Something else to make this work. 48:44.320 --> 48:45.980 Who can tell me what the Problem is here? 48:46.700 --> 48:47.380 yes, sir? 48:50.580 --> 48:51.300 Yeah. 48:58.720 --> 49:02.820 I think you're right, but we Haven't seen a lot of that. 49:05.580 --> 49:07.680 No, no, no, no, no, no. 49:07.680 --> 49:09.300 That's not the problem either. 49:09.500 --> 49:11.220 Look, i mean, think about this. 49:11.220 --> 49:14.800 This stuff happens, right, on User level. 49:14.800 --> 49:16.400 Doesn't happen through the Kernel. 49:16.900 --> 49:18.720 Doesn't happen through the stack. 49:19.280 --> 49:21.820 The stack doesn't know about this happening. 49:22.320 --> 49:25.160 So we're sending out a fin, right? 49:25.160 --> 49:25.920 No problem. 49:25.920 --> 49:27.420 Our stack can send it out. 49:28.500 --> 49:29.220 Okay? 49:29.440 --> 49:32.800 so we get back a fin act. 49:32.800 --> 49:33.360 Right? 49:35.460 --> 49:37.660 and now, what's my stack going to Do? 49:37.720 --> 49:39.420 in comes a fin act packet. 49:40.760 --> 49:42.020 Who said reset? 49:42.020 --> 49:42.980 thank you, sir. 49:44.840 --> 49:46.620 So that's exactly the problem. 49:46.660 --> 49:48.860 Now, our fin act packet is Coming back into our stack. 49:48.860 --> 49:51.880 Our stack says, hey, i don't Know what you did. 49:54.800 --> 49:59.120 So the stack says, hey, hang on A bit, here's a fin act coming back to me. 49:59.120 --> 50:00.600 I never send out the fin. 50:01.000 --> 50:03.940 It doesn't know about that, so It's going to reply with a reset. 50:04.360 --> 50:06.880 So we've got to cut those resets off somewhere. 50:07.260 --> 50:10.440 In this case, you can do it in an upstream firewall. 50:11.060 --> 50:15.140 What we usually do is we, you know, we have a personal Firewall on the machine. 50:15.140 --> 50:16.900 We cut the resets off there. 50:16.900 --> 50:19.160 So there's no reset that your machine can send out. 50:19.160 --> 50:20.420 Not reset coming back. 50:20.420 --> 50:21.800 Reset's going out. 50:22.680 --> 50:23.280 Okay? 50:23.300 --> 50:28.820 this thing, this asynchronous Banners, a grabber can really work very fast. 50:29.180 --> 50:34.640 So we can do about 2,000 banners in three minutes that we can grab. 50:36.000 --> 50:39.520 What i want to show you is how it actually works. 50:39.520 --> 50:50.460 When we start out, we do the, we first do multi-threaded Work on the hdps to get that, because we can do it Asynchronously, but, hey, it's a lot of work. 50:50.460 --> 50:54.520 So let's go on and see. 50:54.520 --> 50:56.280 So those are the port scans. 50:56.720 --> 50:58.120 You go to the banners. 50:58.220 --> 51:00.620 You basically import that Stuff in there. 51:02.300 --> 51:03.340 Okay. 51:03.680 --> 51:05.460 Select the interface. 51:06.180 --> 51:07.120 Right. 51:09.460 --> 51:11.540 We start, it's starting there at the bottom. 51:11.540 --> 51:13.880 You can see it's starting on the ssl. 51:13.880 --> 51:18.500 It's doing 15 threads at the same time to find the banners For the ssl stuff. 51:18.500 --> 51:19.960 So that's not really fast. 51:21.620 --> 51:22.500 Right. 51:23.240 --> 51:26.420 And you will see there's a delay In there. 51:26.420 --> 51:30.980 The moment we're sending it out At 302 milliseconds delay between packets. 51:30.980 --> 51:34.900 But you can actually drop it off as, hang on, hang on, hang On. 51:34.900 --> 51:35.440 Hang on. 51:35.440 --> 51:35.960 Okay. 51:35.960 --> 51:38.840 You can drop it off as low as You want to. 51:38.840 --> 51:39.400 Right. 51:39.400 --> 51:41.500 You'll see there's additional weight in there. 51:41.500 --> 51:47.720 That's basically, you know, those smtp servers when you Connect to it, it doesn't do anything. 51:47.840 --> 51:49.540 And it waits and waits and waits. 51:49.540 --> 51:52.100 And then finally you get the Banner coming back. 51:52.100 --> 51:55.600 That's the time that we've got To wait for those stuff coming back. 51:55.640 --> 52:01.560 Now, what you will see here is i'm going to drop that delay There down to 2 milliseconds. 52:02.000 --> 52:08.640 And what's interesting is note The scroll bar on the right-hand side as i drop it. 52:13.900 --> 52:14.620 Okay. 52:14.860 --> 52:15.580 Zip. 52:17.820 --> 52:18.260 Okay. 52:18.260 --> 52:20.240 And those are all the banners That we could get there. 52:21.160 --> 52:23.340 So it's kind of fast. 52:23.780 --> 52:24.060 Okay. 52:24.060 --> 52:27.220 And now we're just waiting for Other banners to come in if there's anything. 52:28.840 --> 52:29.200 Okay. 52:29.200 --> 52:29.500 Cool. 52:29.500 --> 52:30.480 I'm going to go on. 52:31.860 --> 52:32.300 Right. 52:32.300 --> 52:34.120 So this is what we do for Banner scanning. 52:34.700 --> 52:35.560 What's the next step? 52:35.560 --> 52:37.140 We want to be able to do targeting. 52:37.740 --> 52:51.440 Now, the thing there is if you have a lot and lots and lots of Potential targets, you want something that can easily say, Oh, well, i want to identify everything that's running on Port 22 and i want to only test against those. 52:51.440 --> 52:57.060 Or i want to have only machines that have open ports within a Certain net block and i want to test those. 52:57.260 --> 52:59.700 Or you get the idea, right? 53:00.160 --> 53:03.360 so this is what the targeting Stuff looks like. 53:03.960 --> 53:06.840 We basically have the banners Now for everything. 53:06.980 --> 53:11.880 We can click on targeting and We basically get our net blocks definitions in there. 53:11.880 --> 53:15.740 We can drop down to those, see the machines that are in there. 53:15.740 --> 53:27.300 The machines in there has either a dns name or reverse or Forward or it's the mx record or it's the ns record for a domain Or it has an open port. 53:27.400 --> 53:32.100 Once it's got an open port, That's something that we would want to see in there, right? 53:32.100 --> 53:37.020 A machine that's totally dead with no forward or reverse Entries are kind of boring to us. 53:37.400 --> 53:43.960 Machines with dns information or open ports are interesting to Us and we can get the banners in there as well. 53:44.560 --> 53:49.960 What's interesting about the banner scanning is if you get a Reset coming from the host, what do you know? 53:50.380 --> 53:51.760 You know that it's wrapped, right? 53:51.760 --> 53:53.280 It's a tcp wrapped port. 53:53.280 --> 54:01.520 So it actually accepted the Entire conversation and then it sent back a reset to close the Connection afterwards. 54:02.040 --> 54:13.980 So we can do a search for Instance for open ssl and we're going to get all the machines That has a banner that contains the word open ssl in the banner. 54:14.780 --> 54:17.660 And then we can just simply say, okay, make those targets. 54:17.660 --> 54:23.460 I want to attack those machines with open ssl and immediately Goes off to the target section. 54:24.040 --> 54:25.040 Okay, cool. 54:26.480 --> 54:30.120 There we're doing a scan for machines on tcp 22. 54:30.120 --> 54:31.680 Anything that's open on 22? 54:34.520 --> 54:35.380 all right. 54:35.380 --> 54:40.780 So you see all the banners coming back there and i can Again just say make those machines targets. 54:40.780 --> 54:42.580 I want to attack it in the next stage. 54:46.270 --> 54:47.070 Okay. 54:47.350 --> 54:48.710 I think we get the idea. 54:49.430 --> 54:49.870 Right. 54:49.870 --> 54:53.130 So now we have our targets Defined. 54:53.410 --> 54:55.470 Remember we went through the Whole thing. 54:55.470 --> 54:56.550 We went through the whole thing. 54:56.550 --> 55:00.650 At this stage we have the machines that we're going to Attack. 55:00.850 --> 55:01.210 Okay. 55:01.210 --> 55:03.230 We went through the targeting, all of that. 55:03.230 --> 55:04.750 We have the machines that we want to attack. 55:04.970 --> 55:05.850 Right. 55:05.890 --> 55:07.530 So what's the next step? 55:07.530 --> 55:09.250 We want to do vulnerability discovery. 55:09.270 --> 55:12.430 We're going to find what vulnerabilities are on these Machines. 55:12.930 --> 55:19.570 So we're not going to write a Vulnerability scanner because there's a lot of people that Wrote vulnerability scanners. 55:19.570 --> 55:26.330 We're going to use something That's really solid, we hope, and widely used, and that is Nessus . 55:26.330 --> 55:29.950 So what we need to do is we Need to write a nessus client. 55:31.630 --> 55:32.190 Okay. 55:32.190 --> 55:33.790 We need to write a nessus client. 55:33.930 --> 55:43.730 And what we want to do is we want to give the user the Ability to select the plug-ins that he wants to use just as a Normal nessus client and say, well, i want to test this Particular bug. 55:44.330 --> 55:44.650 Okay. 55:44.650 --> 55:46.450 Remember what i said previously. 55:46.450 --> 55:52.090 It's easier to find a single Bug on a whole lot of machines than finding the one bug on one Machine. 55:52.270 --> 56:06.790 So, for instance, if we want to Check which machines on an entire class b has snmp Community strings enabled, you know, we put one plug-in into Nessus and we scan it across the whole class a and we find the Stuff really quick. 56:07.070 --> 56:07.770 Okay. 56:10.350 --> 56:14.710 So this is basically what we use for plug-in selection. 56:17.650 --> 56:19.290 It's really easy. 56:19.290 --> 56:21.310 You can decide which plug-ins You want to use. 56:21.330 --> 56:27.290 You can move them from the one End to the other end and you can save that information afterwards. 56:27.390 --> 56:29.150 It actually just saves the plug-in i.D. 56:29.150 --> 56:34.830 So you can have Your list of plug-in i.D.s wherever you want to have it. 56:34.830 --> 56:43.850 You can put it in a text file and you can use whatever kind of Selector you want to basically select these plug-ins. 56:43.850 --> 56:47.270 It's just a list of nessus plug-ins, right, i.D.s. 56:48.270 --> 56:52.670 Afterwards we're going to save that and i can give it a name. 56:52.670 --> 56:57.070 Those are the plug-in i.D.s on the left-hand side and i can call That thing whatever i want. 56:57.090 --> 57:00.610 I'm going to call it black hat Demo.PLG. 57:01.090 --> 57:02.390 That's a plug-in set. 57:02.390 --> 57:04.330 You're going to see i'm going to use it later on. 57:06.810 --> 57:11.550 So in the next step we actually want to now run vulnerability Scans, right? 57:11.550 --> 57:15.930 we're going to run the nessus Scan against our target on a particular plug-in set. 57:18.890 --> 57:20.910 So there's the sense for stuff. 57:20.910 --> 57:22.210 There's the net blocks. 57:22.750 --> 57:24.730 There's all the reverse entries. 57:25.090 --> 57:25.810 Click. 57:26.290 --> 57:27.070 Yeah. 57:27.630 --> 57:29.410 There's the port scan. 57:30.210 --> 57:31.530 The banners. 57:32.230 --> 57:36.330 And what we want to do now is Run a nessus scan against those machines. 57:36.970 --> 57:38.930 But we have to target them first. 57:38.930 --> 57:43.910 So i'm going to click on Targeting and i'm going to say that first, you see that first Class c over there? 57:44.130 --> 57:45.710 there's a couple of machines in There. 57:45.710 --> 57:50.210 It's in our lab situation that We want to scan, right? 57:51.350 --> 58:00.950 i can right-click on any of those And say select it as a target or what i can do is i can Simply say anything that's in that block that's got an open Port, make it a target. 58:01.350 --> 58:03.950 So immediately i get a list of Machines there. 58:03.990 --> 58:07.190 Those machines are now my Because they're live, right? 58:07.190 --> 58:09.630 they responded to any of those scans. 58:10.370 --> 58:16.010 And i go to the nessus tab over there and i basically import Those by just clicking on the import button. 58:16.550 --> 58:16.830 Okay. 58:16.830 --> 58:18.910 I select the set that i want to Use. 58:20.970 --> 58:24.250 And i click on start. 58:25.010 --> 58:25.650 Right. 58:25.650 --> 58:30.450 Now, with ntp, the nessus Protocol, you have to get all the plug-ins. 58:30.550 --> 58:33.010 You have to load the plug-ins before you can actually run the Scan. 58:33.010 --> 58:33.750 It's kind of weird. 58:33.750 --> 58:41.230 Even if you know exactly what plug-ins you want to use, you Have to select, you have to get all the plug-in information Coming back. 58:41.670 --> 58:43.430 Now, there you can see the Scan is now running. 58:43.430 --> 58:47.010 It started with the port scan As per normal on all those ip addresses. 58:47.490 --> 58:56.150 You can set your nessus server up as you want to, to, you know, Scan more machines at a time or more threads at a time or any of That stuff at a time. 58:56.310 --> 59:00.970 It really depends on your nessus Server how fast that scan is going to happen. 59:00.970 --> 59:08.790 At any time, we can just click on the update tree button and we Can see how far the scan has gone and what we've done there And, you know, get the output back. 59:08.790 --> 59:11.190 It's, you know, the same old, same old. 59:11.190 --> 59:12.610 We've all seen this before. 59:13.190 --> 59:17.630 It's just a different flavor, Different interface, but it's not doing anything else. 59:19.510 --> 59:21.830 And it will tell you when the scan is done. 59:22.150 --> 59:25.150 You can see there's still a bug there at the bottom as well. 59:25.150 --> 59:26.730 We sorted that out as well. 59:27.070 --> 59:33.870 But i thought, you know, let me Rather have the bug in there and you can see that it's really Running and not a video recording somewhere. 59:34.850 --> 59:38.030 It also now shows you the actual issues. 59:39.110 --> 59:39.670 Right . 59:40.050 --> 59:40.990 Okay. 59:40.990 --> 59:45.210 So let's move on. 59:45.890 --> 59:47.850 We've done the vulnerability discovery. 59:47.850 --> 59:52.310 The only thing that's left to do is basically exploit those Vulnerabilities, right? 59:52.830 --> 59:56.990 now, again, we don't want to Reinvent the wheel here. 59:58.310 --> 01:00:04.290 So we have this thing talk to a Nice exploitation framework, which is metasploit. 01:00:04.310 --> 01:00:05.910 There's a couple of others as well. 01:00:05.970 --> 01:00:07.830 But metasploit is quite neat. 01:00:08.650 --> 01:00:09.710 So what do we have to do? 01:00:09.710 --> 01:00:12.130 We write a metasploit client. 01:00:13.190 --> 01:00:19.830 Now, the problem with Metasploit, it's actually not a problem with metasploit, it's a Problem with us, okay, is that it's very operating 01:00:23.650 --> 01:00:32.070 Specific, which is this exploit will work against, you know, Windows 2k service pack 2. 01:00:33.810 --> 01:00:35.850 We don't have that information, Right? 01:00:35.850 --> 01:00:38.610 we don't have that kind of Level of information about our targets. 01:00:38.610 --> 01:00:41.790 If we were internal to the network, we can do funky stuff. 01:00:41.870 --> 01:00:42.630 But we're not. 01:00:42.630 --> 01:00:43.630 We're external. 01:00:43.690 --> 01:00:44.830 So we don't have the information. 01:00:44.830 --> 01:00:49.230 So what do we do is we select The target number zero and we hope for the best. 01:00:49.250 --> 01:00:52.290 Because a lot of the metasploit plug-ins actually does a brute Force. 01:00:52.290 --> 01:00:53.990 So we don't have to supply it. 01:00:54.370 --> 01:00:56.830 What else is it that we have to supply to metasploit? 01:00:56.830 --> 01:00:59.590 We have to supply the remote port, right? 01:00:59.850 --> 01:01:02.750 But the remote port we can pick up from the nasus scan. 01:01:03.250 --> 01:01:08.770 Because let's say your server was running on, your web server Was running on port 27, right? 01:01:09.630 --> 01:01:12.330 the nasus would pick it up as on Port 27. 01:01:12.330 --> 01:01:14.070 And we have that port, right? 01:01:14.070 --> 01:01:16.630 We know when stuff is ssl as well. 01:01:16.870 --> 01:01:20.770 So we can specify in metasploit if it's got to use ssl or not. 01:01:22.190 --> 01:01:25.590 And we have the local ip address as well. 01:01:25.590 --> 01:01:28.990 If we have, if we're doing, for instance, a reverse shell. 01:01:28.990 --> 01:01:30.910 Because that's our ip address. 01:01:31.310 --> 01:01:33.110 So most of the stuff we have. 01:01:33.130 --> 01:01:43.210 The only thing that we don't have is we don't have a way to Tie up a metasploit exploit with the nasus id, right? 01:01:43.210 --> 01:01:48.450 So basically saying we use nasus to identify the weakness. 01:01:48.950 --> 01:01:51.030 And we use metasploit to exploit it. 01:01:51.030 --> 01:01:52.830 But how do you tie the two together? 01:01:53.490 --> 01:01:55.350 So what we've done, where's gareth? 01:01:56.230 --> 01:02:10.570 What gareth has done there, gareth phillips, right in front Of the camera, he's been a week basically, you know, tying these Two things up, saying here's a metasploit exploit, okay? 01:02:10.570 --> 01:02:14.590 Is there a nasus plug-in that will identify this particular Problem? 01:02:14.850 --> 01:02:18.930 and if he can find it, he Basically writes it down in a little list. 01:02:18.930 --> 01:02:21.110 Says this exploit, that plug-in. 01:02:21.210 --> 01:02:26.090 And if there's multiple plug-ins For a specific exploit, he's got them listed there. 01:02:26.090 --> 01:02:35.290 And if there's no nasus plug-in for the metasploit exploit, That's, a, scary, right? 01:02:37.050 --> 01:02:39.450 and so, b, he would write some Of them. 01:02:39.450 --> 01:02:40.650 So how many did we write? 01:02:40.910 --> 01:02:43.030 We write about four, five. 01:02:43.630 --> 01:02:51.910 And i think at the moment, in Terms of tying the stuff together, we need another 13 of The 70, how many, 70? 01:02:52.410 --> 01:02:53.050 78. 01:02:53.270 --> 01:02:54.450 78 exploits. 01:02:54.450 --> 01:02:57.270 That was, you know, the Adding to it the whole time. 01:02:57.350 --> 01:03:00.350 The rest of the stuff is pretty Much mapped, okay? 01:03:00.350 --> 01:03:11.130 and what we're hoping to do, And i'll beg hd for this, is to see if we can get it so That when they write new exploits for metasploit, they Include a nasus id in there. 01:03:11.150 --> 01:03:15.030 And if there's no nasus id, Then they basically write a nasus check for it. 01:03:15.870 --> 01:03:21.610 Because then we can just query, you know, the framework and get The ids out of it dynamically, and we don't have to keep this List. 01:03:21.610 --> 01:03:23.630 And we're not going to keep This list current, okay? 01:03:23.630 --> 01:03:25.030 that's not what we do. 01:03:25.750 --> 01:03:26.210 Okay. 01:03:26.210 --> 01:03:28.470 So let's see, let's see how it works. 01:03:29.630 --> 01:03:30.090 Okay. 01:03:30.090 --> 01:03:33.850 So for this instance, we're Looking at a vmware server, right? 01:03:33.850 --> 01:03:37.090 We're not, this is just a vmware server. 01:03:38.770 --> 01:03:46.190 Now, what's interesting here is, when we now do our nasus Scan, right, why do we have to check for all the nasus ids? 01:03:47.010 --> 01:03:53.130 We only check for the ones that's got related metasploit Exploits, right? 01:03:53.250 --> 01:03:59.210 we check for those 72 minus 13 nasus ids that we already got. 01:03:59.230 --> 01:04:13.470 So what i'm doing here is i'm basically running a nasus scan Against the ip address and only using the, i'm only using the List of nasus ids with related metasploit plug-ins. 01:04:13.910 --> 01:04:16.330 And you can see it, it can do it rather quickly. 01:04:16.910 --> 01:04:18.490 So there, it's done. 01:04:18.490 --> 01:04:20.530 And we found three issues. 01:04:21.190 --> 01:04:24.930 You click on it, you'll basically see, it should be all Red, right? 01:04:24.930 --> 01:04:27.050 the last one, i don't know, It's a bug. 01:04:27.950 --> 01:04:31.830 Basically tells you these are The three heavy issues that we found on this machine. 01:04:31.830 --> 01:04:33.090 You can look at them. 01:04:34.730 --> 01:04:42.430 And when you go to metasploit, What you do is you click on that little button over there, And that loads the definitions in. 01:04:42.430 --> 01:04:43.130 Hang on. 01:04:44.470 --> 01:04:50.590 That basically loads the Definitions in that says this is the nasus id that matches with This metasploit id. 01:04:50.650 --> 01:04:55.350 Once we have that, we can Simply click on a thing that says find the matching target. 01:04:55.530 --> 01:04:58.970 So now it will go through the entire nasus scan, right? 01:04:58.970 --> 01:05:09.010 Of all the machines that we want to scan, and it's going to Pick out the ones that has related metasploit ids and say These are potential targets. 01:05:09.010 --> 01:05:13.210 If you run the metasploit exploit Against this, you have a good chance that it's going to work. 01:05:14.610 --> 01:05:18.070 And those are, that's obviously the same machine, right? 01:05:18.070 --> 01:05:19.610 It's all the same machine. 01:05:19.710 --> 01:05:25.130 And there's identified four Problems, four possible exploits that we can run against that machine. 01:05:25.130 --> 01:05:28.810 We now have to configure our exploits. 01:05:30.170 --> 01:05:34.110 So we're going to go for, which one is it, the decom one? 01:05:34.110 --> 01:05:34.650 No. 01:05:35.090 --> 01:05:35.790 Yes. 01:05:35.790 --> 01:05:37.810 It will tell you what the exploit is all about. 01:05:37.870 --> 01:05:40.290 Now you've got to select what you want to do with that thing. 01:05:40.550 --> 01:05:42.490 So you configure the exploit. 01:05:42.610 --> 01:05:43.290 Click. 01:05:44.590 --> 01:05:53.050 And it basically dynamically queries the framework and tells You for that exploit, these are the different payloads that you Can have, right? 01:05:53.410 --> 01:05:54.810 that's the reverse. 01:05:54.810 --> 01:06:03.990 And the stuff that you have to fill out, okay, the stuff that You have to fill out, you can fill out, right? 01:06:03.990 --> 01:06:09.050 The rest of the stuff is automatically populated with all The information that we know at this stage. 01:06:09.750 --> 01:06:10.230 Okay. 01:06:10.230 --> 01:06:14.390 So i'm going to bring up the Vmware machine. 01:06:14.590 --> 01:06:15.370 There we go. 01:06:15.370 --> 01:06:20.570 I've configured the rest of the exploits as well, but i didn't Want to go through that. 01:06:20.610 --> 01:06:21.910 And you can save it as well. 01:06:22.150 --> 01:06:24.850 And i start the metasploit framework on this side. 01:06:24.850 --> 01:06:29.530 It could be sitting on any box, right, at this stage it's just Sitting on your local machine. 01:06:29.690 --> 01:06:33.530 But you can have it speak to a Metasploit framework on a remote machine as well. 01:06:34.170 --> 01:06:35.530 And that's it . 01:06:35.530 --> 01:06:36.690 We click on start. 01:06:37.530 --> 01:06:40.370 And now it's basically running those exploits against the machines. 01:06:41.250 --> 01:06:44.610 Remember, those machines could be a whole lot of machines. 01:06:45.030 --> 01:06:50.490 If you're scanning a large organization, again, you know, Through the whole thing . 01:06:51.090 --> 01:06:51.530 Okay. 01:06:51.530 --> 01:06:56.230 And when it's done, what we expect is that in the framework We're going to have those shells. 01:06:57.550 --> 01:07:03.190 And lo and behold, if you click on sessions, hey, there you go. 01:07:03.190 --> 01:07:04.390 There's your shells. 01:07:05.270 --> 01:07:05.810 Okay. 01:07:05.810 --> 01:07:09.530 And, you know, i think you all know what this looks like, right? 01:07:09.730 --> 01:07:14.270 If you don't know, we're going to click on a session there just So that you also see it's not bullshit. 01:07:20.320 --> 01:07:21.160 Okay. 01:07:21.800 --> 01:07:23.100 You can do it. 01:07:24.100 --> 01:07:24.680 All right. 01:07:24.680 --> 01:07:25.960 That's this metasploit. 01:07:25.960 --> 01:07:26.420 Okay . 01:07:26.420 --> 01:07:30.540 Now, think about a large network. 01:07:30.540 --> 01:07:31.100 Okay . 01:07:31.860 --> 01:07:36.280 Let's say you're even sitting Internal on a network. 01:07:38.440 --> 01:07:40.180 Let me show you something. 01:07:40.500 --> 01:07:42.720 This was done on an internal network. 01:07:43.080 --> 01:07:46.740 I can't tell you who's network there. 01:07:48.320 --> 01:07:51.100 I'm going to just load that data set in. 01:07:54.000 --> 01:07:56.100 That's the one that says can't say who. 01:07:56.100 --> 01:07:57.460 It's all text files. 01:07:57.460 --> 01:07:58.900 It saves it in text files. 01:07:59.760 --> 01:08:00.340 Okay. 01:08:00.500 --> 01:08:01.640 This is the net blocks. 01:08:01.640 --> 01:08:03.960 You check all the ten dot somethings in there. 01:08:04.220 --> 01:08:10.160 And if we go to nesis, you'll find that there's lots of Issues with these machines. 01:08:11.260 --> 01:08:13.680 A lot of them have the same Issue, right? 01:08:14.280 --> 01:08:19.740 but some have some interesting Issues in there, like dot printer and those kind of Overflows. 01:08:19.900 --> 01:08:21.760 In metasploit, look at this. 01:08:21.860 --> 01:08:22.340 Okay. 01:08:22.340 --> 01:08:28.340 If you click on matching Targets, it's kind of funny. 01:08:29.760 --> 01:08:32.020 That's worm territory, man. 01:08:32.900 --> 01:08:33.380 Okay. 01:08:33.920 --> 01:08:39.040 So in a perfect world, sorry, yes. 01:09:10.570 --> 01:09:11.310 Okay. 01:09:11.310 --> 01:09:13.770 Can we take this offline Afterwards? 01:09:13.990 --> 01:09:14.670 okay. 01:09:15.930 --> 01:09:18.170 So but i will speak to you. 01:09:18.270 --> 01:09:19.390 So are we done? 01:09:19.390 --> 01:09:20.610 In a perfect world, we're done. 01:09:20.610 --> 01:09:22.450 In a perfect world, we're done. 01:09:22.450 --> 01:09:25.350 And we, you know, we've done our assessment and this. 01:09:25.350 --> 01:09:31.310 But if you're doing assessments, can i just see in this room Here who actually has to write reports? 01:09:32.270 --> 01:09:32.970 Aha. 01:09:33.070 --> 01:09:34.690 I thought so much. 01:09:34.910 --> 01:09:37.550 So in a perfect world, you have to write reports. 01:09:37.630 --> 01:09:39.130 You don't have to write reports. 01:09:39.130 --> 01:09:42.210 In a perfect world, there's no False positives. 01:09:42.470 --> 01:09:43.270 Nowhere. 01:09:43.390 --> 01:09:45.010 Nesis never makes a mistake. 01:09:46.270 --> 01:09:47.270 Well, guess what? 01:09:47.270 --> 01:09:48.330 It does, right? 01:09:48.330 --> 01:09:51.090 and sometimes the stuff that It gives you is just not relevant. 01:09:51.090 --> 01:09:55.450 So what we've done is we have this thing. 01:09:56.410 --> 01:10:05.270 To start off with, you know, within the nesis scan, you can Mark something as a false positive, right? 01:10:05.590 --> 01:10:07.190 If you really want to. 01:10:09.190 --> 01:10:16.650 And you can basically say mark This as a false positive across the entire range of scans that You've done. 01:10:17.130 --> 01:10:19.270 And you can comment on the Stuff. 01:10:19.670 --> 01:10:28.970 And what's nice about this is That when you go back to your targeting section, you can Basically then go and say, well, let's find wherever i put that Comment in. 01:10:29.090 --> 01:10:38.090 Or you can basically say, let's Search all the machines that nesis croaked about on, i don't Know, usable name server, for instance, right? 01:10:38.090 --> 01:10:44.170 And i want to find those machines because those are the Machines i need to attack or defend. 01:10:44.170 --> 01:10:47.650 I need to patch these machines or i need to attack these Machines, right? 01:10:47.770 --> 01:10:53.090 so you can very easily do That kind of advanced targeting. 01:10:55.050 --> 01:10:57.330 Supposed to be one. 01:10:57.670 --> 01:10:58.110 Okay? 01:10:59.170 --> 01:11:07.890 And what's nice about this thing as well is the last tag on this Thing basically does a lot of the reporting work for you, Okay? 01:11:07.890 --> 01:11:10.530 so you have to write these Things out for your boss. 01:11:10.690 --> 01:11:12.650 You have to give it out to a Client . 01:11:13.750 --> 01:11:20.750 It would go a long, long way To basically help you not to have to write that report. 01:11:20.910 --> 01:11:26.710 The reason why we do this, the reason why we use this tool and Develop this tool was that we use it internally, right? 01:11:26.710 --> 01:11:29.750 And we want to spend our time doing interesting stuff. 01:11:29.750 --> 01:11:29.950 Okay? 01:11:29.950 --> 01:11:33.210 we want to do the more Interesting work of an assessment. 01:11:33.210 --> 01:11:41.610 We don't want to spend time writing reports and basically Having to copy and paste from a nesis report into a real report. 01:11:41.610 --> 01:11:45.570 You know, that stuff, we want to play with the interesting stuff. 01:11:45.570 --> 01:11:52.410 And that's why we have this particular, it's just going on There, but i can't forward the video, actually. 01:11:53.530 --> 01:11:53.950 There we go. 01:11:53.950 --> 01:11:54.950 There's the reporting. 01:11:58.370 --> 01:12:00.270 I'm just doing the host tables now. 01:12:00.370 --> 01:12:02.070 So basically we have all the information, right? 01:12:02.070 --> 01:12:02.830 We have the forwards. 01:12:02.830 --> 01:12:03.710 We have the reverse. 01:12:03.830 --> 01:12:04.870 We have the domains. 01:12:04.950 --> 01:12:05.690 We have the banners. 01:12:05.690 --> 01:12:06.530 We have the open ports. 01:12:06.530 --> 01:12:07.490 We have the issues. 01:12:07.490 --> 01:12:08.850 We have the severity of the issues. 01:12:08.850 --> 01:12:10.150 We have all of these things. 01:12:10.370 --> 01:12:17.010 So we can basically take one host and build up a kind of a Host table that says this is the entire machine. 01:12:17.010 --> 01:12:19.130 This is what the machine looks like, right? 01:12:20.290 --> 01:12:21.470 It's an mx record. 01:12:21.950 --> 01:12:23.730 It has this ip address. 01:12:23.730 --> 01:12:24.870 It has these ports open. 01:12:24.870 --> 01:12:26.210 It has these banners. 01:12:27.610 --> 01:12:28.390 Okay? 01:12:28.390 --> 01:12:31.810 and it has these nesis ids with Whatever impact. 01:12:32.270 --> 01:12:35.470 And that happens all Automatically because we don't want to do it. 01:12:35.470 --> 01:12:41.630 All the comments that we put in there, if there's a comment that We wanted to put in there, then that comment is also retained. 01:12:42.150 --> 01:12:44.810 So you can see there it says analyst comment. 01:12:45.390 --> 01:12:48.530 That's a comment that we put in there in the past. 01:12:48.530 --> 01:12:51.530 It's really nice for banners as well. 01:12:51.530 --> 01:13:01.090 So if you do banner scanning and then you sort by banner, you can See immediately these are all my is5 machines or this is the Target's is5 machines. 01:13:01.270 --> 01:13:02.330 This is the target's this. 01:13:02.330 --> 01:13:04.730 All of those things come out quite neatly. 01:13:05.190 --> 01:13:05.570 Okay. 01:13:05.570 --> 01:13:07.010 So what's the bottom line? 01:13:07.390 --> 01:13:14.490 The bottom line is this tool is basically doing 80 of the work In 20 of the time that it takes us to do. 01:13:14.570 --> 01:13:20.710 Which leaves us with 80 of the time that we can play with more Interesting things. 01:13:20.850 --> 01:13:21.370 Okay? 01:13:22.450 --> 01:13:26.250 Some of the steps of the methodology is really hard to Automate. 01:13:26.430 --> 01:13:28.930 And it's usually where there's Exceptions. 01:13:28.930 --> 01:13:30.770 You know, there's exception to The rule. 01:13:30.770 --> 01:13:32.450 Makes it very hard to automate. 01:13:33.550 --> 01:13:38.850 Hopefully it will also raise the bar on people that, you know, Do penetration. 01:13:38.850 --> 01:13:41.890 I'm a penetration testing Specialist kind of dude. 01:13:42.790 --> 01:13:52.770 Because these things, i mean, The report that you get out of this is just about the same Report as these people are doing in a long, long, long time and Charging a lot of money for it. 01:13:53.830 --> 01:13:56.270 So that's hopefully what we're Going to get out of it. 01:13:56.630 --> 01:14:03.250 In terms of release of this Tool, there's always a problem here, right? 01:14:03.370 --> 01:14:08.510 We've got the gentleman in front that's going to tell me, you're Not going to release this, right? 01:14:08.550 --> 01:14:13.610 I mean, this is point and click, you know, weapons of mass Destruction. 01:14:15.290 --> 01:14:17.330 You're not going to release it, Right? 01:14:17.750 --> 01:14:22.090 and then we've got the other Side, which i guess is the rest of the class. 01:14:22.950 --> 01:14:25.650 That's saying, okay, where do we download it? 01:14:27.170 --> 01:14:31.470 So we build this version, which is a cripple version. 01:14:31.470 --> 01:14:33.710 It's only crippled in two ways. 01:14:33.710 --> 01:14:34.190 Okay? 01:14:34.190 --> 01:14:37.650 It runs for 20 minutes, and you can't save your data. 01:14:37.650 --> 01:14:40.150 The rest of the stuff is exactly the same. 01:14:40.670 --> 01:14:41.070 Okay ? 01:14:41.950 --> 01:14:46.750 i just want to see, harun, are We do we have time left? 01:14:46.910 --> 01:14:48.450 how much time do we have left? 01:14:48.950 --> 01:14:49.890 30 minutes? 01:14:49.890 --> 01:14:56.770 okay, what we're going to do Now is we're going to play with it a bit and see how it works in Real life, okay? 01:14:57.030 --> 01:15:07.950 keep in mind, we're doing it Via the wireless, and the wireless is kind of, you know, Flaky because of the fact that we kind of ride next door to The wi-fi shootout room. 01:15:09.070 --> 01:15:16.570 So if it's not handling itself Well, then you know why. 01:15:17.130 --> 01:15:17.870 Okay. 01:15:20.700 --> 01:15:23.340 So this is what the tool looks like. 01:15:25.800 --> 01:15:26.540 All right. 01:15:26.540 --> 01:15:32.820 It's a, the new release is a Little bit more friendlier and so forth and so on. 01:15:32.820 --> 01:15:34.080 Okay. 01:15:34.960 --> 01:15:36.060 So are we good? 01:15:36.380 --> 01:15:36.600 Okay. 01:15:36.600 --> 01:15:38.840 Let's just see if i can get out To the net. 01:15:40.440 --> 01:15:40.940 Okay. 01:15:40.940 --> 01:15:48.040 As you can see, it's kind of, you know, yeah. 01:15:48.100 --> 01:15:48.880 Okay. 01:15:48.920 --> 01:15:49.580 Okay. 01:15:49.580 --> 01:15:50.740 So but let's give it a go. 01:15:50.740 --> 01:15:50.980 Okay. 01:15:50.980 --> 01:15:58.440 So for subdomains, remember i told you subdomains, Subdomains, but it actually gets really interesting. 01:15:58.440 --> 01:16:00.840 So i want to put a domain in there. 01:16:00.840 --> 01:16:05.700 So if you're from this organization, keep in mind that We're only mining subdomains. 01:16:05.700 --> 01:16:07.200 We're not attacking your Network. 01:16:07.680 --> 01:16:09.900 We're not going to go further Than subdomains. 01:16:10.560 --> 01:16:11.040 Okay. 01:16:11.440 --> 01:16:13.500 So i'm going to put in there a domain. 01:16:16.630 --> 01:16:17.170 Right. 01:16:17.170 --> 01:16:18.730 I don't know if you can see That. 01:16:25.210 --> 01:16:31.680 If you can't, remember, it's Only subdomain mining. 01:16:31.680 --> 01:16:33.320 It's not anything else. 01:16:33.320 --> 01:16:34.420 We're not attacking the network. 01:16:34.420 --> 01:16:36.660 We're not sending a single Packet to that network. 01:16:37.300 --> 01:16:38.000 Okay. 01:16:38.000 --> 01:16:43.160 And you can see that it's basically pulling down a whole Lot of subdomains there. 01:16:44.020 --> 01:16:44.580 Okay. 01:16:45.960 --> 01:16:46.920 Right. 01:16:48.400 --> 01:16:57.320 We got some interesting things In there and e-mail addresses that we can mine as well if we Want to use it for later use. 01:16:57.900 --> 01:16:58.500 Okay. 01:16:58.500 --> 01:17:00.280 I'm going to stop this now. 01:17:01.840 --> 01:17:04.500 So let me just find the stop Button. 01:17:04.880 --> 01:17:10.860 And then, of course, you can Go to the forwards and you can simply input that and start Doing all the forwards on that, which i'm not going to do. 01:17:10.960 --> 01:17:11.400 Right . 01:17:12.180 --> 01:17:21.260 We actually have the permission To look at some of the other network, good friends at Electronic arts. 01:17:21.740 --> 01:17:22.640 Is frank here? 01:17:22.640 --> 01:17:23.400 Frank? 01:17:23.760 --> 01:17:24.620 frank? 01:17:25.540 --> 01:17:26.980 Frank is not here. 01:17:27.260 --> 01:17:34.180 But he said to us it's okay if We show some of the stuff that we've done on there. 01:17:34.180 --> 01:17:35.500 So i'm going to put in the ea. 01:17:35.500 --> 01:17:36.940 You know ea, ea sports. 01:17:36.940 --> 01:17:38.100 It's in the game. 01:17:42.680 --> 01:17:43.380 Okay. 01:17:43.380 --> 01:17:47.960 We're going to quickly go through there, see how that Works. 01:17:48.740 --> 01:17:51.420 It's actually works quite nice. 01:17:55.590 --> 01:17:56.170 Okay. 01:17:56.170 --> 01:18:03.490 So there you can see some Burnout3.Ea and earth and beyond.Ea.Com. 01:18:03.650 --> 01:18:07.490 And freedomfighters.Ea.Com. 01:18:07.490 --> 01:18:10.030 Those are all subdomains that Actually belong to them. 01:18:10.150 --> 01:18:12.570 And it's just adding to the list As we go along. 01:18:12.670 --> 01:18:17.510 It's actually a uefa Championsleaguegame.Ea.Com. 01:18:18.010 --> 01:18:20.890 Once we have this stuff, i'm Not going to go through all of this. 01:18:21.170 --> 01:18:23.810 It's going to take a while to finish this up. 01:18:23.810 --> 01:18:26.310 Takes about five minutes to run through one of these domains. 01:18:26.770 --> 01:18:27.350 Okay. 01:18:27.390 --> 01:18:29.070 We can go to the forwards. 01:18:30.190 --> 01:18:35.170 And basically just do this mouse is not working on this. 01:18:35.170 --> 01:18:39.370 Come back here to import, right? 01:18:39.770 --> 01:18:44.230 and then we're going to start Looking at the dns information at the forwards, right? 01:18:44.230 --> 01:18:45.750 So those are what you see there. 01:18:45.750 --> 01:18:47.150 You can't see them, right? 01:18:47.150 --> 01:18:52.010 Let me just um... those are the mx records and The ns records. 01:18:52.690 --> 01:19:01.810 And as we go through there, we Basically find trip w, obviously, ftp1, ftp, mail. 01:19:03.270 --> 01:19:04.770 No, no, no, no, no, no. 01:19:06.530 --> 01:19:06.970 Okay. 01:19:06.970 --> 01:19:09.770 Next one we find, i'm going to move over to the next tab. 01:19:12.450 --> 01:19:16.370 Testing for cisco e-commerce. 01:19:16.650 --> 01:19:17.190 There we go. 01:19:17.190 --> 01:19:19.070 Corporate.Ea.Com. 01:19:19.850 --> 01:19:22.170 And it's actually got two ip Addresses. 01:19:22.710 --> 01:19:24.270 So i'm going to stop it over There . 01:19:25.410 --> 01:19:28.470 I'm going to go to the net Blocks, import the net blocks there. 01:19:29.210 --> 01:19:32.210 I'm not going to spend a whole lot of time on the net block Definitions. 01:19:32.450 --> 01:19:35.350 You can see they've got a class b Network, right? 01:19:35.670 --> 01:19:38.810 if i get the who's information On this, it will tell me so. 01:19:44.370 --> 01:19:46.610 And, of course, you can do this For any domain, right? 01:19:46.610 --> 01:19:47.110 there we go. 01:19:47.150 --> 01:19:48.170 Electronic arts. 01:19:48.770 --> 01:19:49.990 You can see that it's a class b. 01:19:49.990 --> 01:19:51.770 I'm not going to make it a class b now. 01:19:51.890 --> 01:19:53.190 I'm just going to keep it there. 01:19:54.010 --> 01:19:55.430 Import it there. 01:19:55.430 --> 01:19:57.490 Here's our matching filters That we've got. 01:19:57.790 --> 01:20:01.590 I want to change all of those Matching filters just to be ea.Com. 01:20:04.460 --> 01:20:05.160 Okay. 01:20:05.160 --> 01:20:08.420 And we're doing multi-threaded, 25 Threads at a time. 01:20:09.020 --> 01:20:10.120 Reverse scan. 01:20:10.120 --> 01:20:20.400 There we've got smtp-eu1.Ea.Com, which is your, i Think it's the european smtp gateway. 01:20:21.080 --> 01:20:22.100 Okay. 01:20:23.160 --> 01:20:24.720 You get the idea, right? 01:20:24.720 --> 01:20:34.480 With them, it's really interesting when you start Looking at the reverses because in the reverse of some of these Blocks, you would find that they have a whole lot of domains. 01:20:35.340 --> 01:20:38.540 For just about every game that they make, they have a domain For it. 01:20:38.900 --> 01:20:45.040 And they have reverse dns Entries that points to those ip address, from those ip Addresses that point outwards. 01:20:45.240 --> 01:20:46.560 So you can get a whole lot of Domains. 01:20:46.560 --> 01:20:48.780 I've collected all of the Information earlier. 01:20:49.040 --> 01:20:53.340 I'll show you the full, you Know, the complete, what the complete thing looks like. 01:20:53.340 --> 01:20:54.280 Okay. 01:20:54.280 --> 01:20:56.560 So let's just stop this here. 01:20:57.100 --> 01:20:58.580 We go to the port scanner. 01:20:58.660 --> 01:21:00.820 Basically import that stuff Straight in there. 01:21:00.820 --> 01:21:01.800 Those are the blocks. 01:21:01.860 --> 01:21:05.980 I promise you there's more blocks, but, you know, let's Keep it sweet and short for now. 01:21:06.540 --> 01:21:07.900 I'm going to bind my driver. 01:21:09.140 --> 01:21:11.140 I'm going to say use that interface. 01:21:12.400 --> 01:21:14.660 And let's see what ports do you want to scan. 01:21:14.660 --> 01:21:16.480 I'm not going to scan a whole lot of ports. 01:21:16.620 --> 01:21:20.200 Let's just do 443, 80 and 25. 01:21:20.860 --> 01:21:21.840 See how it works. 01:21:21.840 --> 01:21:23.440 Hopefully it will be good. 01:21:23.660 --> 01:21:24.140 Okay. 01:21:24.520 --> 01:21:28.260 You can see at the bottom the speed at which this thing is Scanning. 01:21:29.180 --> 01:21:30.680 It's quite fast. 01:21:38.080 --> 01:21:41.280 And those are the machines that's basically coming back to it. 01:21:41.420 --> 01:21:43.300 You'll see there's some duplicates in there. 01:21:43.560 --> 01:21:47.400 What happens is the machine, that fin that i'm sending out, i Was just kidding. 01:21:47.400 --> 01:21:48.700 I'm not sending the fin. 01:21:49.200 --> 01:21:51.580 So the machines respond a couple of times. 01:21:51.980 --> 01:21:55.440 It's just something i still need to sort out. 01:21:56.520 --> 01:21:57.300 Okay. 01:21:57.300 --> 01:21:59.020 So there's a couple of 25s in There. 01:21:59.020 --> 01:22:00.240 There's a 443. 01:22:04.020 --> 01:22:07.960 And we're almost a third of the way in the port scan. 01:22:09.880 --> 01:22:13.780 I'm not going to take your time looking at a progress bar. 01:22:13.780 --> 01:22:14.840 So let's move on to the next one. 01:22:14.840 --> 01:22:15.800 You get the idea. 01:22:15.860 --> 01:22:18.480 You can go through all of these machines. 01:22:18.480 --> 01:22:20.120 There's a couple of nice ones. 01:22:20.960 --> 01:22:21.740 Okay. 01:22:21.740 --> 01:22:23.200 There we go. 01:22:23.200 --> 01:22:23.900 Okay. 01:22:23.900 --> 01:22:26.300 That starts looking better and better. 01:22:26.760 --> 01:22:27.040 Okay . 01:22:27.040 --> 01:22:31.080 Let's just keep it running for a Little bit longer. 01:22:32.520 --> 01:22:33.420 Okay. 01:22:33.420 --> 01:22:34.980 And i'm going to stop it over there. 01:22:34.980 --> 01:22:35.720 All right. 01:22:35.720 --> 01:22:38.000 So let's pull it in from the Banners . 01:22:38.440 --> 01:22:40.080 Basically do this. 01:22:40.760 --> 01:22:43.060 We bind our driver again. 01:22:43.080 --> 01:22:46.080 And we go to this one. 01:22:46.580 --> 01:22:48.740 And let's do a scan. 01:22:48.780 --> 01:22:51.320 And there you can see the Banners coming back in. 01:22:51.880 --> 01:22:53.340 Kind of quick, right? 01:22:54.540 --> 01:22:55.280 Okay. 01:22:57.240 --> 01:22:58.960 We've already sent out the Packets. 01:22:58.960 --> 01:23:01.300 These are just packets coming Back at this stage. 01:23:03.980 --> 01:23:06.840 Got a 25-second wait for this Thing. 01:23:08.780 --> 01:23:12.280 And there's not a lot more Coming back at this stage, right? 01:23:12.640 --> 01:23:16.300 So already at this stage what i can do is i can go to the Targeting. 01:23:16.380 --> 01:23:17.940 I can update the tree. 01:23:17.940 --> 01:23:20.720 I can say, well, i want to find apache boxes. 01:23:21.540 --> 01:23:22.040 Okay. 01:23:22.040 --> 01:23:23.120 Search the tree. 01:23:24.100 --> 01:23:25.760 And make those targets. 01:23:25.760 --> 01:23:29.080 Those are the apache boxes in That range that we scanned, right? 01:23:29.080 --> 01:23:29.880 Not a lot. 01:23:30.800 --> 01:23:33.240 I wonder if there's any Microsoft boxes in there. 01:23:33.240 --> 01:23:34.320 Clear the selection. 01:23:38.560 --> 01:23:41.280 It says microsoft is in the banner, right? 01:23:41.880 --> 01:23:43.380 I think so, yeah. 01:23:43.680 --> 01:23:44.600 Clear the selection. 01:23:44.600 --> 01:23:45.220 Search. 01:23:45.220 --> 01:23:46.400 We've got some. 01:23:46.760 --> 01:23:47.980 Make them targets. 01:23:47.980 --> 01:23:48.460 There we go. 01:23:48.460 --> 01:23:51.040 Those are the microsoft boxes in that network. 01:23:51.360 --> 01:23:53.660 How long did it take me to get that information? 01:23:53.860 --> 01:23:55.000 What, three minutes? 01:23:55.380 --> 01:23:56.060 okay. 01:23:56.200 --> 01:23:58.140 We can go into the nasa scan. 01:24:04.420 --> 01:24:05.500 Maybe not. 01:24:05.500 --> 01:24:07.440 Maybe some other day. 01:24:10.280 --> 01:24:11.080 No. 01:24:11.360 --> 01:24:12.200 No, no, no, no. 01:24:12.200 --> 01:24:13.600 It's not all in the game. 01:24:16.580 --> 01:24:17.120 Okay. 01:24:17.120 --> 01:24:18.220 I thank you very much. 01:24:18.220 --> 01:24:20.240 And you've still got 20 minutes to catch the next talk. 01:24:20.240 --> 01:24:20.700 Thanks.