Simple DNS Lookups
*Host name to IP lookup:
nslookup www.irongeek.com
*Reverse lookup:
nslookup 208.97.169.250

DNS Record Types
Just a few record types cribbed from:
http://en.wikipedia.org/wiki/List_of_DNS_record_types
A
AAAA
MX
CNAM
PTR
AXFR

Getting a list of host names
*Zonetransfers
*Nmap -sL <some-IP-range>
*Serversniff
http://serversniff.net/subdomains.php

DIGing for data
dig irongeek.com any
dig @ns1.dreamhost.com irongeek.com any

Zone Transfer:Give me all your records!
Zone Transfer: NSLOOKUP
(Windows version)
C:\Documents and Settings\Adrian>nslookup
Default Server: resolver1.opendns.com
Address: 208.67.222.222

> set type=ns
> irongeek.com
Server: resolver1.opendns.com
Address: 208.67.222.222

Non-authoritative answer:
irongeek.com nameserver = ns1.dreamhost.com
irongeek.com nameserver = ns2.dreamhost.com
irongeek.com nameserver = ns3.dreamhost.com
> server ns1.dreamhost.com
Default Server: ns1.dreamhost.com
Address: 66.33.206.206

> ls irongeek.com
[ns1.dreamhost.com]
*** Can't list domain irongeek.com: Query refused
> exit

Zone Transfer: Can you DIG it?
dig issa-kentuckiana.org ns
dig @dns3.doteasy.com issa-kentuckiana.org axfr
dig louisvilleinfosec.com ns
dig @dns3.doteasy.com louisvilleinfosec.com axfr
dig ugent.be ns
dig @ugdns1.ugent.be ugent.be axfr

Zone Transfer: Others
*ServerSniff:
http://serversniff.net/nsreport.php
http://serversniff.net/content.php?do=subdomains 
*Fierce
http://ha.ckers.org/fierce/
./fierce.pl -dns irongeek.com
*GUI Dig for Windows
http://nscan.org/dig.html 

Nmap Demo
nmap -sL <some-IP-range>

Whois: Whooo, are you? Who-who-who-who.
*Great for troubleshooting, bad for privacy
*Who owns a domain name or IP
*E-mail contacts
*Physical addresses
*Name server
*IP ranges
*Who is by proxy?

Whois Demo
whois irongeek.com
whois 208.97.169.250

Whois Tools
*nix Command line
Nirsoft's
http://www.nirsoft.net/utils/whois_this_domain.html
http://www.nirsoft.net/utils/ipnetinfo.html 
Pretty much any network tools collection
Windows Mobile:
http://www.cam.com/vxutil_pers.html 
Whois and domain tools sites
*http://www.domaintools.com/
*http://samspade.org
*http://www.serversniff.net

Traceroute
(ok, not really a DNS tool, but I was too lazy to make another section)
*Windows (ICMP):
tracert irongeek.com
**nix (UDP by default, change with -I or -T):
traceroute irongeek.com
*Just for fun:
http://www.nabber.org/projects/geotrace/ 

Finding general Information about an organization via the web
So, you have a job posting for an Ethical Hacker huh?

Sites about the organization
*The organization's website (duh!)
*Wayback Machine
http://www.archive.org 
*Monster (and other job sites)
http://www.monster.com/ 
*Zoominfo
http://www.zoominfo.com/
*Google Groups (News groups, Google Groups and forums)
http://groups.google.com/ 
*Board reader
http://boardreader.com 
*LinkedIn
http://www.linkedin.com/ 

Tools
*Maltego
http://www.paterva.com/maltego/community-edition/
*Covers a large cross section of what this presentation is about.

Google Hacking
More than just turning off safe search (though that's fun too)
So, do you really know what's shared online about your organization?
*PII (Personally identifiable information)
*Email address
*User names
*Vulnerable web services
*Web based admin interfaces for hardware
*Much more....
*YOU HAVE TO USE YOUR IMAGINATION

Google Advance Operators
site:
inurl:/allinurl:
intitle:/allintitle:
cache:
ext:/filetype:
info:
link:
inanchor:

More Operators
-
~
[#]..[#]
*
+
OR
|

Examples
*inurl:nph-proxy
*intitle:index.of.etc
*intitle:index.of site:irongeek.com
*filetype:pptx site:irongeek.com
*"vnc desktop" inurl:5800
*adrian crenshaw -site:irongeek.com

Examples
*SSN filetype:xls | filetype:xlsx
*"dig @* * axfr"
*inurl:admin
*inurl:indexFrame.shtml Axis
*inurl:hp/device/this.LCDispatcher
*"192.168.*.*" (but replace with your IP range)

Google Hacking DB
*http://johnny.ihackstuff.com/ghdb.php 

Google Hacking Tools
*Metagoofil
./metagoofil.py -d irongeek.com -l 1000 -f all -0 output.html -t temp
*Online Google Hacking Tool
http://www.secapps.com/a/ghdb 
*Spiderfoot
http://www.binarypool.com/spiderfoot/
*Goolag
http://goolag.org 

More Google Hacking Tools
*Gooscan
Should be on BackTrack CD/VM
*Wikto
http://www.sensepost.com/research/wikto/ 
*SiteDigger
http://www.foundstone.com/us/resources/proddesc/sitedigger.htm 
*BiLE
http://www.sensepost.com/research_misc.html 
*MSNPawn
http://www.net-square.com/msnpawn/index.shtml 

Google SOAP API Proxys
*EvilAPI
http://evilapi.com/ (defunct?)
*Aura
http://www.sensepost.com/research/aura/ 

Metadata
Data about data

Pwned by Metadata
Examples of file types that contain metadata
*JPG
EXIF (Exchangeable image file format)
IPTC (International Press Telecommunications Council)
*PDF
*DOC
*DOCX
*EXE
*XLS
*XLSX
*PNG
*Too many to name them all.

Metadata Tools
*Strings
*Metagoofil
http://www.edge-security.com/metagoofil.php 
*EXIF Tool
http://www.sno.phy.queensu.ca/~phil/exiftool/ 
*EXIF Viewer Plugin
https://addons.mozilla.org/en-US/firefox/addon/3905 
*Jeffrey's Exif Viewer
http://regex.info/exif.cgi 
Metadata Tools
*EXIF Reader
http://www.takenet.or.jp/~ryuuji/minisoft/exifread/english/
*Flickramio
http://userscripts.org/scripts/show/27101 
*Pauldotcom
http://www.google.com/search?hl=en&q=metadata+site%3Apauldotcom.com&btnG=Search

Other odds and ends
Stuff that does not quite fit anywhere else

Mail Header Fun

Robots.txt
User-agent: *
Disallow: /private
Disallow: /secret
IGiGLE and WiGLE

More Links
*Recon Sites and Tools
http://www.binrev.com/forums/index.php?showtopic=40526 
*Pauldotcom
http://mail.pauldotcom.com/pipermail/pauldotcom/2009-March/000960.html 
*VulnerabilityAssessment.co.uk - An information portal for Vulnerability Analysts and Penetration Testers
http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html 

Events
*Free ISSA classes
*ISSA Meeting
http://issa-kentuckiana.org/ 
*Louisville Infosec
http://www.louisvilleinfosec.com/ 
*Phreaknic/Notacon/Outerz0ne
http://phreaknic.info 
http://notacon.org/
http://www.outerz0ne.org/ 

Thanks
*Brian
http://www.pocodoy.com/blog/ 
*Kelly for getting us the room and organizing things
*Jonathan Cran
http://hexesec.wordpress.com/
http://www.0x0e.net/ghg/ 
*Folks at Binrev and Pauldotcom
*Louisville ISSA
*Russ Mcree
http://holisticinfosec.org 
*iamnowonmai for helping me "zone out"
*Larry "metadata" Pesce
http://pauldotcom.com 
*John for the extra camera

Questions?
42