Passive Information Gathering Flashcards
What is whois?
Whois is a TCP service, tool, and a type of database that can provide information about a domain name, such as the name server and registrar. This information is often public since registrars charge a fee for private registration.
How to gather basic information about website “megacorpone.com” using whois?
whois megacorpone.com
How to do whois reverse lookup?
whois ip address
How to search with site operator “megacorpone.com”?
site: megacorpone.com
How to declare PHP filetype for searching in google?
filetype:php
How to search in google for php file on domain megacorpone.com?
site:megacorpone.com filetype:php
What SIEM mean?
Security Information and Event Management.
What is SIEM tools designed for?
Monitor applications and network traffic for malicious activities. Usually these tools are only available on internal networks.
How to find interesting non-HTML pages on megacorpone.com?
site:megacorpone.com -filetype:html
What is the exclude operator in Google Hacking?
-
How to use Google to find directory listings?
intitle: “index of” “parent directory”
What is GHDB?
Google Hacking Database
What is netcraft?
Netcraft is an Internet services company based in England offering a free web portal that performs various information gathering functions. The use of services such as those offered by Netcraft is considered a passive technique since we never interact with our target directly.
What is recon-ng?
recon-ng is a module-based framework for web-based information gathering. Recon-ng displays the results of a module to the terminal but it also stores them in a database. Much of the power of recon-ng lies in feeding the results of one module into another, allowing us to quickly expand the scope of our information gathering.
How to start recon-ng?
recon-ng
How to search recon-ng marketplace for GitHub modules?
marketplace search github
How to get information on a module with path recon/domains-hosts/google_site_web on recon-ng?
marketplace info recon/domains-hosts/google_site_web
How to install a module on recon-ng with path recon/domains-hosts/google_site_web?
marketplace install recon/domains-hosts/google_site_web
How to load module in recon-ng with path recon/domains-hosts/google_site_web?
[recon-ng][default] > modules load recon/domains-hosts/google_site_web
How to set a source “megacorpone.com” in recon-ng?
[recon-ng][default][google_site_web] > options set SOURCE megacorpone.com
SOURCE => megacorpone.com
How to run a module in recon-ng?
[recon-ng][default][google_site_web] > run
How to show hosts in recon-ng?
[recon-ng][default] > show hosts
How to obtain module information for recon/hosts-hosts/resolve?
[recon-ng][default] > marketplace info recon/hosts-hosts/resolve
How to install the resolve module with path recon/hosts-hosts/resolve?
[recon-ng][default] > marketplace install recon/hosts-hosts/resolve
How to install and view recon/hosts-hosts/resolve?
[recon-ng][default] > modules load recon/hosts-hosts/resolve
[recon-ng][default][resolve] > info
How to show hosts after multiple modules using recon-ng?
[recon-ng][default][resolve] > show hosts
What is shodan?
Shodan is a search engine that crawls devices connected to the Internet including but not limited to the World Wide Web. This includes the servers that run websites but also devices like routers and IoT devices.
How to search MegaCorp One’s domain with Shodan?
hostname:megacorpone.com
How to check if MegaCorp One servers running SSH using Shodan?
hostname: megacorpone.com port:”22”
What Security Headers do?
Analyze HTTP response headers and provide basic, analysis of the target site’s security posture.
What SSL Server Test do?
This tool analyzes a server’s SSL/TLS configuration and compares it against current best practices. It will also identify some SSL/TLS related vulnerabilities, such as Poodle or Heartbleed.
What is Pastebin?
Pastebin is a website for storing and sharing text. Many people use Pastebin because it is ubiquitous and simple to use. But since Pastebin is a public service, we can use it to search for sensitive information.
What theHarvester do?
Gathers emails, names, subdomains, IPs, and URLs from multiple public data sources.
What option ‘-d’ do in theHarvester?
Specify target domain.
What option ‘-b’ do in theHarvester?
Set the data source to search.
How to run theHarvester on megacorpone.com and set the data source to search as google?
theharvester -d megacorpone.com -b google
How to use theHarvester to enumerate emails addresses for megacorpone.com?
theHarvester -d megacorpone.com -b google.com
What is TLD?
Top Level Domain
How to use harvester to search megacorpone.com through baidu?
theHarvester -d megacorpone.com -b baidu
How to use harvester to search megacorpone.com through LinkedIn?
theHarvester -d megacorpone.com -b linkedin
How to use harvester to search megacorpone.com through twitter?
theHarvester -d megacorpone.com -b twitter
How to use harvester to search megacorpone.com through virustotal?
theHarvester -d megacorpone.com -b virustotal
How to use harvester to search megacorpone.com through netcraft?
theHarvester -d megacorpone.com -b netcraft
How to use harvester to search megacorpone.com through yahoo?
theHarvester -d megacorpone.com -b yahoo
What is Social-Searcher?
Social-Searcher is a search engine for social media sites. A free account will allow a limited number of searches per day. Social-searcher can be a quick alternative to setting up API keys on multiple more specialized services.
What Twofi do?
Twofi scans a user’s Twitter feed and generates a personalized wordlist used for password attacks against that user. While we will not run any attacks during passive information gathering, we can run this tool against any Twitter accounts we have identified to have a wordlist ready when needed. Twofi requires a valid Twitter API key.
What is linkedin2username?
linkedin2username is a script for generating username lists based on LinkedIn data. It requires valid LinkedIn credentials and depends on a LinkedIn connection to individuals in the target organization. The script will output usernames in several different formats.
What is Stack Overflow?
Stack Overflow is a website for developers to ask and answer coding related questions.
What OSINT Framework includes?
OSINT Framework includes information gathering tools and websites in one central location. Some tools listed in the framework cover more disciplines than information security.
What is Maltego?
Maltego is a very powerful data mining tool that offers an endless combination of search tools and strategies.
What Maltego do?
Maltego searches thousands of online data sources, and uses extremely clever “transforms” to convert one piece of information into another.
