Footprint ing Utilizing Superior Google Hacking Methods
• Attackers use search engines like google and yahoo to extract details about a goal, equivalent to employed expertise platforms, worker particulars, login pages, and intranet portals, which assist the attacker to carry out social engineering and different forms of superior system assaults
• Google hacking refers to the usage of superior Google search operators for creating complicated search queries to extract delicate or hidden info that helps attackers discover weak goal
Attackers can use superior search operators obtainable with these search engines like google and yahoo and create complicated queries to search out, filter, and kind particular info concerning the goal. Search engines like google and yahoo
are additionally used to search out different sources of publicly accessible info. For instance, you’ll be able to kind “prime job portals” to search out main job portals that present important details about the goal group.
Google hacking refers to the usage of superior Google search operators for creating complicated search queries to extract delicate or hidden info.
What can a Hacker Do with Google Hacking? An attacker can create complicated search-engine queries to filter giant quantities of search outcomes to acquire info associated to laptop safety. The attacker can use Google operators to find particular strings of textual content inside search outcomes. Thus, the attacker cannot solely detect web sites and internet servers which might be weak to exploitation but in addition find non-public and delicate details about the goal. As soon as a weak web site is recognized, attackers try and launch varied doable assaults, equivalent to buffer overflow and SQL injection, which compromise info safety. Examples of delicate info on public servers that an attacker can extract with the assistance of Google Hacking Database (GHDB) queries embody:
▪ Error messages that include delicate info
▪ Recordsdata containing passwords
▪ Delicate directories
▪ Pages containing logon portals
▪ Pages containing community or vulnerability knowledge, equivalent to IDS, firewall logs, and configurations
▪ Advisories and server vulnerabilities
▪ Software program model info
▪ Net utility supply code
▪ Related IoT gadgets and their management panels, if unprotected
▪ Hidden internet pages equivalent to intranet and VPN companies
Instance: Use Google Advance Operator syntax [intitle:intranet inurl:intranet +intext:”human resources”] to search out delicate details about a goal group and its staff. Attackers use the gathered info to carry out social engineering assaults.
An attacker may leverage AI-powered ChatGPT or different generative AI expertise to carry out this process by utilizing an acceptable immediate equivalent to: “Use filetype search operator to acquire pdf recordsdata on the goal web site eccouncil.org and retailer the end result within the recon1.txt file”
Shell-gpt / sgpt : https://github.com/tbckr/sgpt
The next shell command is designed to conduct superior Google hacking utilizing the “filetype” operator to particularly goal PDF recordsdata throughout the eccouncil.org area. The command
then saves the obtained outcomes to a file named “recon1.txt”:
- lynx –dump “http://www.google.com/search?q=web site:eccouncil.org+filetype:pdf” | grep “http” | reduce -d “=” -f2 | grep -o “http[^&]*” > recon1.txt
▪ `lynx –dump “http://www.google.com/search?q=web site:eccouncil.org+filetype:pdf”`: Initiates the Lynx internet browser in dump mode to entry Google’s search outcomes for PDF recordsdata throughout the eccouncil.org area.
▪ `| grep “http”`: Filters out traces containing the string “http” from the Lynx output. ▪ `| reduce -d “=” -f2`: Splits every line utilizing the “=” delimiter and selects the second subject.
▪ `| grep -o “http[^&]*”`: Searches for patterns beginning with “http” adopted by any characters besides “&”.
▪ `> recon1.txt`: Redirects the ultimate output to a file named “recon1.txt” for storage.
Google Hacking Database
Supply: https://www.exploit-db.com/google-hacking-database The GHDB is a subset of the Exploit-DB and focuses on utilizing Google search queries (sometimes called “Google Dorks”) to search out delicate info inadvertently uncovered on the net. These queries exploit superior Google search operators to uncover the next: ▪ Delicate recordsdata: Equivalent to configuration recordsdata, database dumps, and log recordsdata which will include usernames, passwords, or different confidential knowledge.
▪ Uncovered directories: Open directories on internet servers which may include delicate info.
▪ Error messages: Net server or utility error messages which will reveal server configurations or vulnerabilities.
▪ Weak gadgets: Figuring out particular forms of gadgets or software program variations recognized to have vulnerabilities.
Footprinting Utilizing Superior Google Hacking Methods
• Attackers use search engines like google and yahoo to extract details about a goal, equivalent to employed expertise platforms, worker particulars, login pages, and intranet portals, which assist the attacker to carry out social engineering and different forms of superior system assaults
• Google hacking refers to the usage of superior Google search operators for creating complicated search queries to extract delicate or hidden info that helps attackers discover weak targets
Google Hacking Database Supply: https://www.exploit-db.com/google-hacking-database The GHDB is a subset of the Exploit-DB and focuses on utilizing Google search queries (sometimes called “Google Dorks”) to search out delicate info inadvertently uncovered on the net. These queries exploit superior Google search operators to uncover the next:
- Delicate recordsdata: Equivalent to configuration recordsdata, database dumps, and log recordsdata which will include usernames, passwords, or different confidential knowledge.
- Uncovered directories: Open directories on internet servers which may include delicate info.
- Error messages: Net server or utility error messages which will reveal server configurations or vulnerabilities.
- Weak gadgets: Figuring out particular forms of gadgets or software program variations recognized to have vulnerabilities.
Attackers may use SearchSploit, which is a command-line search device for Exploit-DB that permits taking a replica of the Exploit database for distant use. It permits attackers to carry out detailed offline searches by way of their regionally checked-out copy of the repository. This functionality is especially helpful for safety assessments of segregated or air-gapped networks with out Web entry.
Google Dork.
VPN Footprinting by way of Google Hacking Database with AI
Footprinting by way of SHODAN Search Engine
Supply: https://www.shodan.io
Shodan is a search engine that allows attackers to carry out footprinting at varied ranges. It’s used to detect gadgets and networks with vulnerabilities. A search in Shodan for VoIP and VPN footprinting can ship varied outcomes, which is able to assist collect VPN-and VoIP-related info.
Different Methods for Footprinting by way of Search Engines
▪ Gathering Data Utilizing Google Superior Search, Superior Picture Search, and Reverse Picture Search
▪ Gathering Data from Video Search Engines
▪ Gathering Data from Meta Search Engines
▪ Gathering Data from File Switch Protocol (FTP) Search Engines
▪ Gathering Data from IoT Search Engines
shodan.io/search?question=SCADA
Mjor Search engines like google and yahoo:
Google, Bing, Yahoo!, Ask.com, Aol, Baidu, DuckDuckGo
Search by way of LLM
Straight asking search engine equivalent to : Give me an NMAP command to find out if there’s a firewall in the best way.
Google:
Bing:
Grok: https://x.ai/
Perplexity: https://www.perplexity.ai/
Operator:
https://www.shodan.io/search?question=webcam
inurl:webcam
Google Dork:
3. Footprinting by way of Web Analysis Companies
Discovering a Firm’s High-Degree Domains (TLDs) and Sub-domains
Instruments to Search Firm’s Sub-domains
▪ Netcraft Supply: https://www.netcraft.com
▪ DNSdumpster Supply: https://dnsdumpster.com
▪ Pentest-Instruments Discover Subdomains Supply: https://pentest-tools.com
Discovering a Firm’s High-Degree Domains (TLDs) and Sub-domains with AI
Attackers can leverage AI-powered applied sciences to boost and automate their footprinting duties. With assistance from AI, attackers can effortlessly discover the top-level domains and subdomains of the goal. Instance #1 An attacker can use ChatGPT to carry out this process by utilizing an acceptable immediate equivalent to:
- sgpt –chat area –shell “Uncover all of the subdomains of ‘google.com’ utilizing dig command.”
- sgpt –chat footprint –shell “Use Sublist3r to assemble an inventory of subdomains of the goal group eccouncil”
Extracting Web site Data from https://archive.org
Archive is an Web Archive Wayback Machine that explores archived variations of internet sites. Such exploration permits an attacker to assemble info on a corporation’s internet pages since its creation. As the web site https://archive.org retains monitor of internet pages from the time of their creation, an attacker can retrieve even info faraway from the goal web site, equivalent to internet pages, audio recordsdata, video recordsdata, pictures, textual content, and software program applications. Attackers use this info to carry out phishing and different forms of internet utility assaults on the goal group.
Footprinting by way of Folks Search Companies
You should utilize public report web sites to search out details about e mail addresses, telephone numbers, home addresses, and different info. Many people use on-line individuals search companies to search out details about different individuals. Typically, on-line individuals search companies equivalent to Spokeo, Intelius, pipl, BeenVerified, Whitepages, Prompt Checkmate, and PeekYou present individuals’s names, addresses, contact particulars, date of beginning, images, movies, occupation, particulars about their household and associates, social networking profiles, property info, and non-obligatory background on felony checks. Additional, on-line individuals search companies might usually reveal the occupation of a person, companies owned by an individual, upcoming initiatives and working surroundings, web sites and blogs, contact numbers, vital dates, firm e mail addresses, cellphone numbers, fax numbers, and private e-mail addresses. Utilizing this info, an attacker can attempt to get hold of financial institution particulars, bank card particulars, previous historical past, and so forth. This info proves to be extremely helpful for attackers to launch assaults. There are numerous obtainable on-line individuals search companies that assist in acquiring info concerning individuals.
▪ Folks Search Service – Spokeo
Supply: https://www.spokeo.com
Footprinting by way of Job Websites
Darkish Net Footprinting
▪ Tor Browser, Supply: https://www.torproject.org
Looking the Darkish Net with Superior Search Parameters
Figuring out the Working System
▪ Netcraft Supply: https://www.netcraft.com
▪ SHODAN Search Engine Supply: https://www.shodan.io
▪ Censys Supply: https://censys.io
Aggressive Intelligence Gathering
Aggressive intelligence helps in figuring out:
▪ What the rivals are doing?
▪ How rivals are positioning their services?
▪ What clients are saying about rivals’ strengths and weaknesses?
Data Useful resource Websites Data useful resource websites that assist to achieve aggressive intelligence embody: ▪ EDGAR Database Supply: https://www.sec.gov/edgar
▪ D&B Hoovers Supply: https://www.dnb.com
▪ LexisNexis Supply: https://www.lexisnexis.com
▪ Enterprise Wire Supply: https://www.businesswire.com
▪ Factiva Supply: https://www.dowjones.com
Aggressive Intelligence – What Are the Firm’s Plans? Data useful resource websites that assist attackers achieve an organization’s enterprise plans embody:
▪ MarketWatch Supply: https://www.marketwatch.com
▪ The Wall Avenue Transcript Supply: https://www.twst.com
▪ Euromonitor Supply: https://www.euromonitor.com
▪ Experian Supply: https://www.experian.com
▪ The Search Monitor
Aggressive Intelligence – What Skilled Opinions Say In regards to the Firm? Data useful resource websites that assist the attacker to acquire knowledgeable opinions concerning the goal firm embody:
▪ SEMRush Supply: https://www.semrush.com
▪ ABI/INFORM World Supply: https://www.proquest.com
▪ SimilarWeb Supply: https://www.similarweb.com
▪ SERanking Supply: https://seranking.com
Different Methods for Footprint ing by way of Web Analysis Companies
▪ Discovering the Geographical Location of the Goal
o Google Earth Supply: https://earth.google.com
▪ Gathering Data from Monetary Companies
o Google Finance Supply: https://www.google.com/finance
▪ Gathering Data from Enterprise Profile Websites
Attackers use enterprise profile websites equivalent to opencorporates, Crunchbase, and corporationwiki to assemble vital details about the goal organizations, equivalent to their location, addresses, contact info (equivalent to telephone numbers, e mail addresses), worker database, division names, kind of service offered, and kind of business.
▪ Monitoring Targets Utilizing Alerts
Instruments equivalent to Google Alerts, X Alerts, and Giga Alerts assist attackers to trace mentions of the group’s title, member names, web site, or any individuals or initiatives which might be vital. Attackers can collect up to date details about the goal periodically from the alert companies and use it for additional assaults.
o Google Alerts Supply: https://www.google.com/alerts
▪ Monitoring the On-line Popularity of the Goal
An attacker might use ORM monitoring instruments to: o Observe an organization’s on-line status o Accumulate an organization’s search engine rating info o Get hold of e mail notifications when an organization is talked about on-line o Observe conversations o Get hold of social information concerning the goal group Point out Supply: https://point out.com
▪ Gathering Data from Teams, Boards, and Blogs
Attackers can register with faux profiles in Google Teams, LinkedIn Teams, and so forth.
▪ Gathering Data from Public Supply-Code Repositories
Supply code–based mostly repositories are on-line companies or instruments obtainable on inside servers or may be hosted on third-party web sites equivalent to GitHub, GitLab, SourceForge, and BitBucket.
Attackers can use instruments equivalent to Recon-ng to find public source-code repositories. o Recon-ng Supply: https://github.com
4. Footprinting by way of Social Networking Websites
Folks Search on Social Networking Websites
Social networking websites equivalent to Fb, Twitter, LinkedIn, and Instagram help you discover individuals by title, key phrase, firm, faculty, associates, colleagues, and the individuals residing round them.
Gathering Inform at ion from LinkedIn •
• Attackers use theHarvester device to carry out enumeration on LinkedIn and discover staff of the goal firm together with their job titles
Attackers can use this info to assemble extra info, equivalent to present location and academic {qualifications}, and carry out social engineering or other forms of assaults
Gathering Data from LinkedIn
LinkedIn is a social networking web site for professionals. It connects the world’s human sources to assist productiveness and success. The positioning incorporates private info equivalent to title, place, group title, present location, academic {qualifications}, and so forth. Data gathered from LinkedIn helps an attacker in performing social engineering or other forms of assaults. Attackers can use theHarvester device to assemble info from LinkedIn based mostly on the goal group title:
▪ theHarvester Supply: https://github.com
theHarvester -d eccouncil -l 200 -b linkedin
Within the above command, -d specifies the area or firm title to go looking, -l specifies the variety of outcomes to be retrieved, and -b specifies the info supply as LinkedIn.
Harvesting Electronic mail Lists
Gathering e mail addresses associated to the goal group acts as an vital assault vector in the course of the later phases of hacking. Attackers can use automated instruments equivalent to theHarvester and Electronic mail Spider to gather publicly obtainable e mail addresses of the workers of the goal group. These instruments harvest e mail lists associated to a specified area utilizing search engines like google and yahoo equivalent to Google, Bing, and Yahoo. Attackers use these e mail lists and usernames to carry out social engineering and brute drive assaults on the goal group. ▪ theHarvester
Supply: https://github.com
Attackers use theHarvester device to extract e mail addresses associated to the goal area. For instance, attackers use the next command to extract e mail addresses of microsoft.com utilizing the Baidu search engine:
theharvester -d microsoft.com -l 200 -b baidu
Within the above command, -d specifies the area used for harvesting the emails, -l will restrict the outcomes to 200, and -b tells theHarvester to extract the outcomes from the Baidu search engine; alternatively, you need to use Google, Bing, and so forth.
Harvesting Electronic mail Lists with AI
Attackers can leverage AI-powered applied sciences to boost and automate their footprinting duties. With assistance from AI, attackers can effortlessly discover priceless e mail particulars of their goal group. For instance, An attacker can use ChatGPT to carry out this process by utilizing an acceptable immediate equivalent to: “Use theHarvester to assemble e mail accounts related to ‘microsoft.com’, limiting outcomes to 200, and leveraging ‘baidu’ as an information supply”
sgpt –chat fp –shell “Use theHarvester to assemble e mail accounts related to ‘microsoft.com’, limiting outcomes to 200, and leveraging ‘baidu’ as an information supply”
Analyzing Goal Social Media Presence
A number of on-line companies and sources can be found to assemble priceless details about a goal from a number of social media websites. These companies enable attackers to find most shared content material throughout social media websites by utilizing hashtags or key phrases, monitor accounts and URLs on varied social media websites, get hold of a goal’s e mail deal with, and so forth. This info helps attackers to carry out phishing, social engineering, and different forms of assaults. Attackers use instruments equivalent to BuzzSumo, Google Traits, Hashatit, and Ubersuggest to find info on social media websites:
▪ BuzzSumo Supply: https://buzzsumo.com
Instruments for Footprinting by way of Social Networking Websites
Attackers use varied instruments equivalent to Sherlock and Social Searcher to footprint social networking websites equivalent to Twitter, Instagram, Fb, and Pinterest to assemble delicate details about the goal such because the date of beginning, academic qualification, employment standing, title of family members, and details about the group that they’re working for, together with the enterprise technique, potential shoppers, and upcoming mission plans.
▪ Sherlock Supply: https://github.com
Sherlock “Elon Musk”
▪ Social Searcher Supply: https://www.social-searcher.com
Footprinting by way of Social Networking Websites with AI
For instance, An attacker can use ChatGPT to carry out this process by utilizing an acceptable immediate equivalent to: “Use Sherlock to assemble private details about Sundar Pichai and save the lead to recon2.txt”
sgpt –chat footprint –shell “Use Sherlock to assemble private details about Sundar Pichai and save the lead to recon2.txt”
5. Whois Footprinting
Whois Lookup
Three forms of knowledge fashions exist to retailer and lookup Whois info: ▪ Thick Whois (Distributed Mannequin) – Shops the entire Whois info from all of the registrars for a specific set of information.
▪ Skinny Whois (Centralized Mannequin) – Shops solely the title of the Whois server of the registrar of a site, which in flip holds full particulars on the info being appeared up.
▪ Decentralized Whois – Shops full WHOIS info and has a number of unbiased entities to handle the WHOIS database.
Whois question returns the next info: ▪ Area title particulars ▪ Area registrar ▪ Contact particulars of the area proprietor ▪ Area title servers ▪ NetRange ▪ When a site has been created ▪ Expiry data ▪ Information final up to date ▪ Area standing (obtainable, registered, or suspended) ▪ IP deal with info
Regional Web Registries (RIRs) The RIRs embody the next:
▪ American Registry for Web Numbers (ARIN) (https://www.arin.web)
▪ African Community Data Heart (AFRINIC) (https://www.afrinic.web)
▪ Asia Pacific Community Data Heart (APNIC) (https://www.apnic.web)
▪ Réseaux IP Européens Community Coordination Centre (RIPE) (https://www.ripe.web)
▪ Latin American and Caribbean Community Data Heart (LACNIC) (https://www.lacnic.web)
Whois companies equivalent to https://whois.domaintools.com and https://www.tamos.com
Batch IP Converter, obtainable at http://www.sabsoft.com
Discovering IP Geolocation Data
IP geolocation helps to acquire info concerning a goal equivalent to its nation, area/state, metropolis, latitude and longitude of its metropolis, ZIP/postal code, time zone, connection pace, ISP (internet hosting firm), area title, IDD nation code, space code, climate station code and title, cellular service, and elevation.
IP Geolocation Lookup Instruments
▪ IP2Location Supply: https://www.ip2location.com
6. DNS Footprintin
DNS Footprinting
After amassing the Whois data of the goal, the following section of the footprinting methodology is Area Identify System (DNS) footprinting. Attackers carry out DNS footprinting to assemble details about DNS servers, DNS data, and the forms of servers utilized by the goal group. This info helps attackers establish the hosts related within the goal community and additional exploit the goal group. This part describes the way to extract DNS info and carry out reverse DNS lookups utilizing varied DNS interrogation instruments
DNS footprinting helps in figuring out the next data concerning the goal DNS:
DNS Interrogation Instruments
Attackers use DNS interrogation instruments equivalent to SecurityTrails, Fierce, DNSChecker, zdns and DNSdumpster.com to carry out DNS footprinting. These instruments can extract a variety of IP addresses utilizing IP routing lookup. If the goal community permits unknown, unauthorized customers to switch DNS zone knowledge, it’s simple for an attacker to acquire DNS info with the assistance of a DNS interrogation device.
When an attacker queries a DNS server utilizing a DNS interrogation device, the server responds with a report construction that incorporates details about the goal DNS. DNS data present vital info concerning the areas and forms of servers.
▪ SecurityTrails Supply: https://securitytrails.com
▪ Fierce Supply: https://github.com
Attackers can use the next instructions to carry out DNS reconnaissance utilizing the Fierce device:
- Run the next command to start out a primary scan on the goal area (certifiedhacker.com) with none extra choices: fierce –area certifiedhacker.com
- Run the next command to scan the goal area to acquire particular subdomains (right here, subdomains containing phrases equivalent to write, admin, and mail): fierce –area certifiedhacker.com –subdomains write admin mail
- Run the next command to scan domains close to the found data of the focused area: fierce –area certifiedhacker.com –subdomains mail –traverse 10
- Run the next command to aim an HTTP connection on the found domains of the goal: fierce –area certifiedhacker.com –subdomains mail –join
- Run the next command to scan all of the found data of the goal area, i.e., a full detailed scan: fierce –area certifiedhacker.com –wid
DNS Lookup with AI
Attackers can leverage AI-powered applied sciences to boost and automate their footprinting duties. With assistance from AI, attackers can effortlessly carry out reverse DNS lookup actions on a goal and purchase priceless insights. For instance, Attackers can use ChatGPT to execute this process by utilizing an acceptable immediate equivalent to: “Set up and use DNSRecon to carry out DNS enumeration on the goal area www.certifiedhacker.com”
The next shell command is designed to carry out DNS enumeration utilizing the “dnsrecon” device on the www.certifiedhacker.com area:
sudo apt-get replace && sudo apt-get set up -y dnsrecon && dnsrecon -d certifiedhacker.com -t std Clarification of the command:
▪ sudo apt-get replace: Updates the package deal lists for upgrades and new package deal installations.
▪ &&: Concatenates instructions to execute them sequentially.
▪ sudo apt-get set up -y dnsrecon: Installs the dnsrecon device with computerized “sure” to all prompts.
▪ dnsrecon -d certifiedhacker.com -t std: Initiates the dnsrecon device to carry out DNS enumeration on the certifiedhacker.com area utilizing customary enumeration methods.
Reverse DNS Lookup
DNS lookup is used to search out the IP addresses for a given area title, and a reverse DNS operation is carried out to acquire the area title of a given IP deal with. When in search of a site by coming into the area title in a browser, the DNS converts the area title into an IP deal with and forwards the request for additional processing. This conversion of a site title into an IP deal with is carried out utilizing a report. Attackers carry out a reverse DNS lookup on the IP vary to find a DNS PTR report for such IP addresses.
Attackers use varied instruments equivalent to DNSRecon, Reverse Lookup, puredns, Reverse IP Area Test, and Reverse IP Lookup to carry out reverse DNS lookup on the goal host. After we get hold of an IP deal with or a variety of IP addresses, we will use these instruments to acquire the area title.
▪ DNSRecon
Supply: https://github.com
As proven within the screenshot, attackers use the next command to carry out a reverse DNS lookup on the goal host:
dnsrecon -r 162.241.216.0-162.241.216.255
Within the above command, the -r possibility specifies the vary of IP addresses (first to final) for a reverse lookup by brute drive.
▪ Reverse Lookup Supply: https://mxtoolbox.com
7. Community and Electronic mail Footprinting
Community and Electronic mail Footprinting
The following step after retrieving DNS info is to assemble network-related info and monitor e mail communications. This part describes the tactic to find the community vary, traceroute evaluation, and traceroute instruments. It additionally describes the way to monitor e mail communications, the way to acquire info from e mail headers, and e mail monitoring instruments.
Acquiring non-public IP addresses may be helpful to attackers. The Web Assigned Numbers Authority (IANA) has reserved the next three blocks of IP deal with house for personal internets: 10.0.0.0–10.255.255.255 (10/8 prefix), 172.16.0.0–172.31.255.255 (172.16/12 prefix), and 192.168.0.0–192.168.255.255 (192.168/16 prefix).
Traceroute
Discovering the route of the goal host on the community is critical to check towards man-in-the-middle assaults and different associated assaults. Most working methods include a Traceroute utility to carry out this process. It traces the trail or route by way of which the goal host packets journey within the community. Traceroute makes use of the ICMP protocol and Time to Dwell (TTL) subject of the IP header to search out the trail of the goal host within the community.
TCP Traceroute
Many gadgets in any community are typically configured to dam ICMP traceroute messages. On this state of affairs, an attacker makes use of TCP or UDP traceroute, which is also referred to as Layer 4 traceroute. Go to the terminal in Linux working system and kind the tcptraceroute command together with the vacation spot IP deal with or area title as follows:
sudo tcptraceroute www.google.com
UDP Traceroute
Like Home windows, Linux additionally has a built-in traceroute utility, but it surely makes use of the UDP protocol for tracing the path to the vacation spot. Go to the terminal within the Linux working system and kind the traceroute command together with the vacation spot IP deal with or area title as follows: traceroute www.google.com
Traceroute with AI
Attackers can leverage AI-powered applied sciences to boost and automate their footprinting operations. With assistance from AI, attackers can effortlessly carry out tracerouting on a goal. For instance, Attackers can use ChatGPT to execute this process by utilizing an acceptable immediate equivalent to: “Carry out community tracerouting to find the routers on the trail to a goal host www.certifiedhacker.com”
The next shell command is designed to carry out community tracerouting utilizing the “traceroute” device to find the routers on the trail to the www.certifiedhacker.com host: traceroute www.certifiedhacker.com
Clarification of the command: ▪ traceroute www.certifiedhacker.com: Initiates the traceroute device to find the routers on the trail to the www.certifiedhacker.com host by sending packets to the vacation spot with rising time to reside (TTL) values and analyzing the responses obtained from intermediate routers.
Traceroute Instruments
Traceroute instruments equivalent to NetScanTools Professional, PingPlotter, Traceroute NG, and tracert are helpful for extracting details about the geographical location of routers, servers, and IP gadgets in a community. Such instruments assist us to hint, establish, and monitor the community exercise on a world map. A few of the options of those instruments are as follows: ▪ Hop-by-hop traceroutes ▪ Reverse tracing ▪ Historic evaluation ▪ Packet loss reporting ▪ Reverse DNS
▪ Ping plotting ▪ Port probing ▪ Detect community issues ▪ Efficiency metrics evaluation ▪ Community efficiency monitoring
▪ NetScanTools Professional Supply: https://www.netscantools.com
▪ PingPlotter Supply: https://www.pingplotter.com
Monitoring Electronic mail Communications
Electronic mail monitoring screens the e-mail messages of a specific person. This type of monitoring is feasible by way of digitally time-stamped data that reveal the time and date when the goal receives and opens a selected e mail. Electronic mail monitoring instruments enable an attacker to gather info equivalent to IP addresses, mail servers, and repair suppliers concerned in sending the e-mail. Attackers can use this info to construct a hacking technique and to carry out social engineering and different assaults. Examples of e mail monitoring instruments embody IP2LOCATION’s Electronic mail Header Tracer, MxToolbox, DNS Checker Electronic mail Header Analyzer, and Social Catfish.
Gathering Data from Electronic mail Header An e mail header incorporates the small print of the sender, routing info, addressing scheme, date, topic, and recipient. Electronic mail headers additionally assist attackers to hint the routing path taken by an e mail earlier than it’s delivered to the recipient. Every e mail header is a helpful supply of data for an attacker to launch assaults towards the goal. The method of viewing the e-mail header varies with completely different e mail applications. Generally used e mail applications: ▪ eM Shopper ▪ Mailbird ▪ Hiri ▪ Mozilla Thunderbird ▪ Spike ▪ Claws Mail
▪ SmarterMail Webmail ▪ Outlook ▪ Apple Mail ▪ ProtonMail ▪ AOL Mail ▪ Tuta
The e-mail header incorporates the next info: ▪ Sender’s mail server ▪ Date and time of receipt by the originator’s e mail servers ▪ Authentication system utilized by the sender’s mail server ▪ Knowledge and time of sending the message ▪ A singular quantity assigned by mx.google.com to establish the message ▪ Sender’s full title ▪ Sender’s IP deal with and deal with from which the message was despatched
The attacker can hint and acquire all this info by performing an in depth evaluation of the entire e mail header.
Electronic mail monitoring instruments equivalent to IP2LOCATION’s Electronic mail Header Tracer, MxToolbox, eMailTrackerPro, Holehe, DNS Checker Electronic mail Header Analyzer, and Social Catfish enable an attacker to trace an e mail and extract info equivalent to sender identification, mail server, sender’s IP deal with, location, and so forth. Attackers use the extracted info to trace the e-mail path from the attacker’s location to the goal mail server utilizing IP addresses within the e mail header.
▪ eMailTrackerPro Supply: http://www.emailtrackerpro.com
▪ IP2LOCATION’s Electronic mail Header Tracer Supply: https://www.ip2location.com
8. Footprint ing by way of Social Engineering
Social engineers try to assemble
• Bank card particulars and social safety quantity • Usernames and passwords • Safety merchandise in use • Working methods and software program variations • Community structure info • IP addresses and names of servers
Social engineering methods embody
• Eavesdropping • Shoulder browsing • Dumpster diving • Impersonation
Footprinting by way of Social Engineering
Gathering Data Utilizing Eavesdropping, Shoulder Browsing, Dumpster Diving, and Impersonation
Eavesdropping, shoulder browsing, dumpster diving, and impersonation are social engineering methods broadly used to gather info from individuals.
▪ Eavesdropping Eavesdropping is the act of intercepting communication in any kind, equivalent to audio, video, or textual content, with out the consent of the speaking events. It additionally contains studying confidential messages from communication media equivalent to prompt messaging or fax transmissions. The attacker can achieve info by tapping telephone conversations or intercepting audio, video, or written communications.
▪ Shoulder Browsing
Shoulder browsing is a way whereby attackers secretly observe the goal to achieve important info. Within the shoulder browsing method, an attacker stands behind the sufferer and secretly observes the sufferer’s actions on the pc, equivalent to keystrokes whereas coming into usernames, passwords, and so forth. The method is efficient in gaining passwords, private identification numbers, safety codes, account numbers, bank card info, and related knowledge. Attackers can simply carry out shoulder browsing in a crowded place, as it’s comparatively simple to face behind and watch the sufferer with out his or her data.
▪ Dumpster Diving
This uncouth method, also referred to as trashing, includes the attacker rummaging for info in rubbish bins. The attacker might achieve important info equivalent to telephone payments, contact info, monetary info, operations-related info, printouts of supply codes, printouts of delicate info, and so forth from the goal firm’s trash bins, printer waste bins, sticky notes at customers’ desks, and so forth. The attacker might also collect account info from ATM trash bins. The data can assist the attacker to commit assaults.
▪ Impersonation
Impersonation is a way whereby an attacker pretends to be a professional or licensed particular person. Attackers carry out impersonation assaults personally or use telephones or different communication media to mislead targets and trick them into revealing info. The attacker would possibly impersonate a courier/supply particular person, janitor, businessman, consumer, technician, or he/she might faux to be a customer. Utilizing this system, an attacker gathers delicate info by scanning terminals for passwords, looking vital paperwork on desks, rummaging bins, and so forth. The attacker might even attempt to overhear confidential conversations and “shoulder surf” to acquire delicate info.
9. Automate Footprinting Duties utilizing Superior Instruments and AI
Footprint ing Instruments: Maltego and Recon-ng
Maltego
Maltego can be utilized to find out the relationships and actual world hyperlinks between individuals, teams of individuals, organizations, web sites, Web infrastructure, paperwork, and so forth.
Maltego is an automatic device that can be utilized to find out the relationships and real-world hyperlinks between individuals, teams of individuals, organizations, web sites, Web infrastructure, paperwork, and so forth. Attackers can use completely different entities obtainable within the device to acquire info equivalent to e mail addresses, an inventory of telephone numbers, and a goal’s Web infrastructure (domains, DNS names, Netblocks, IP addresses info).
Recon-ng
Recon-ng is a Net Reconnaissance framework with unbiased modules and database interplay, which gives an surroundings during which open supply, web-based reconnaissance may be carried out
FOCA
FOCA (Fingerprinting Organizations with Collected Archives) is a device used primarily to search out metadata and hidden info within the paperwork it scans
Fingerprinting Organizations with Collected Archives (FOCA) is a device used primarily to search out metadata and hidden info within the paperwork that its scans. FOCA is able to scanning and analyzing all kinds of paperwork, with the most typical ones being Microsoft Workplace, Open Workplace, or PDF recordsdata. Options:
o Net Search – Searches for hosts and domains by way of URLs related to the principle area. Every hyperlink is analyzed to extract info from its new host and domains.
o DNS Search – Checks every area to determine the host names configured in NS, MX, and SPF servers to find the brand new host and domains.
o IP Decision – Resolves every host title by comparability with the DNS to acquire the IP deal with related to this server title. To carry out this process precisely, the device performs evaluation towards the group’s inside DNS.
o PTR Scanning – Finds extra servers in the identical section of a decided deal with; IP FOCA executes a PTR log scan
o Bing IP – Launches FOCA, which is a search course of for brand new domains related to that IP deal with for every IP deal with found.
o Widespread Names – Carry out dictionary assaults towards the DNS.
subfinder
subfinder is a subdomain discovery device that helps attackers discover legitimate subdomains for web sites. It helps a number of output codecs (JSON, file, stdout).
Footprint ing Instruments: OSINT Fram ework
• OSINT Framework is an open supply intelligence gathering framework that’s targeted on gathering info from free instruments or sources
•It gives a easy internet interface that lists varied OSINT instruments organized by classes and is proven as OSINT tree construction on the net interface
• Instruments listed contains the next indicators: ▪ (T) – Signifies a hyperlink to a device that have to be put in and run regionally ▪ (D) – Google Dork ▪ (R) – Requires registration
▪ (M) – Signifies a URL that incorporates the search time period and the URL itself have to be edited manuall
Different Instruments:
Sudomy https://github.com
BillCipher https://github.com
BillCipher is an info gathering device for a web site or IP deal with. It may well work on any working system that helps Python 2, Python 3, and Ruby. This device contains varied choices equivalent to DNS lookup, Whois lookup, port scanning, zone switch, host finder, and reverse IP lookup, which assist to assemble important info.
whatweb https://github.com
Raccoon https://github.com
Recon-Canine https://github.com
Recon-Canine is an all-in-one device for all primary info gathering wants. It makes use of APIs to gather details about the goal system. Options:
o Censys: Makes use of censys.io to assemble an enormous quantity of details about an IP deal with.
o NS lookup: Performs title server lookup o Port scan: Scans most typical TCP ports o Detect CMS: Can detect 400+ content material administration methods o Whois lookup: Performs a Whois lookup o Detect honeypot: Makes use of shodan.io to examine if the goal is a honeypot
o Discover subdomains: Makes use of findsubdomains.com to search out subdomains
o Reverse IP lookup: Performs a reverse IP lookup to search out domains related to an IP deal with
o Detect applied sciences: Makes use of wappalyzer.com to detect 1000+ applied sciences o All: Runs all utilities towards the goal
Net Test https://web-check.xyz
OSINT.SH https://osint.sh
AI-Powered OSINT Instruments
AI has revolutionized open-source intelligence (OSINT) by considerably enhancing investigative capabilities by way of superior knowledge assortment, evaluation, and prediction. AI automates knowledge processing, extracts related insights, delivers actionable intelligence extra effectively than conventional strategies, and enhances the OSINT instruments. AI-powered instruments supply quite a few benefits for OSINT. The next are some key use circumstances during which AI can considerably profit OSINT researchers. ▪ Net Scraping: AI methods make the most of on-line knowledge from sources equivalent to social media, blogs, boards, and deep internet databases. This knowledge allows the monitoring of entities over time or the monitoring of public habits. Machine-learning fashions can automate the extraction of particular info equivalent to social media feedback and replies.
▪ Sample Recognition: Machine studying (ML) methods can establish entities inside giant datasets and analyze recordsdata to establish the relationships between completely different entities. These entities embody names, firm particulars, addresses, emails, telephone numbers, and related knowledge.
▪ Content material Summarization: NLP algorithms can summarize giant volumes of information. OSINT gatherers can make the most of this functionality to extract pertinent info from in depth datasets. For instance, an AI summarization device can extract firm names from a set of PDF recordsdata spanning a whole bunch of pages.
▪ Sentiment Evaluation: AI expertise can interpret human feelings by way of textual content evaluation, which is especially helpful for understanding public sentiment. OSINT researchers can use AI to evaluate the emotional state of customers based mostly on social media posts and feedback or to foretell client habits based mostly on evaluations.
▪ Picture Recognition: Laptop imaginative and prescient, a subset of AI, can analyze digital media recordsdata equivalent to pictures and movies. In OSINT investigations, laptop imaginative and prescient can help in:
o Face Recognition: Figuring out and monitoring people throughout completely different media. o Metadata Evaluation: Extracting metadata from digital recordsdata.
o Reverse Picture Search: Enhancing reverse picture search capabilities and detecting deepfake pictures.
▪ AI Detection: AI may establish content material generated by different AI instruments, which is essential for detecting malicious actions facilitated by AI.
AI-Powered OSINT Device: Taranis AI Supply: https://taranis.ai
Taranis AI is a complicated OSINT device makes use of AI to boost info gathering and situational analyses. It makes use of NLP and AI to enhance the standard of information obtained from knowledge sources, equivalent to web sites, to assemble unstructured information articles. Analysts then remodel these AI-enhanced articles into organized studies which might be used as the idea for deliverables equivalent to PDF recordsdata which might be ultimately revealed.
AI-Powered OSINT Device: OSS Perception Supply: https://ossinsight.io
OSS Perception leverages AI to delve deep into the GitHub ecosystem by analyzing an intensive dataset of over 5 billion GitHub occasions. This functionality allows it to supply complete insights and instruments to boost the understanding and navigation of the open-source world. From detailed repository analytics encompassing metrics equivalent to stars, forks, and commits to insights into developer productiveness and collaboration patterns, OSS Perception is provided with highly effective sources for knowledgeable decision-making and strategic planning in open-source software program growth.
Extra AI-Powered OSINT Instruments
AI OSINT instruments that leverage synthetic intelligence to boost the effectivity and accuracy of open-source intelligence gathering are as follows: ▪ DorkGPT Supply: https://dorkgpt.com DorkGPT is an AI-powered device designed to help Google Dorking, a way used to search out info that’s not simply accessible by way of common search queries. It leverages the capabilities of GPT (Generative Pre-trained Transformer) fashions to generate and refine search queries, serving to customers uncover delicate info, hidden pages, and different knowledge which may be related to cybersecurity, moral hacking, or analysis functions.
▪ DorkGenius Supply: https://dorkgenius.com DorkGenius is an AI-powered device that automates Google Dorking and helps customers
generate superior search queries to search out particular info on the web. It’s helpful for uncovering hidden recordsdata, directories, delicate info, and safety vulnerabilities, significantly within the case of moral hackers.
▪ Google Phrase Sniper Supply: https://googlewordsniper.eu
Google Phrase Sniper helps to refine search queries for more practical Google outcomes. It identifies focused key phrases and phrases, making it simpler to search out particular info, hidden content material, and area of interest knowledge. This device is efficacious for researchers, entrepreneurs, and cybersecurity professionals, because it enhances their skill to uncover priceless buried info in search outcomes.
▪ Cylect.io Supply: https://cylect.io
Cylect.io is a complicated AI-powered OSINT device that integrates a number of databases right into a user-friendly interface, offering an enormous assortment of sources for moral hackers and enabling environment friendly and assured OSINT investigations. Developed to deal with the inefficiencies of conventional search engines like google and yahoo, Cylect.io simplifies the search course of and enhances the pace and accuracy of information assortment in investigative contexts.
▪ ChatPDF Supply: https://chatpdf.com
ChatPDF is an OSINT device that leverages AI to investigate and extract info from PDF paperwork by way of a conversational interface. Customers can add PDF recordsdata and work together with the device to shortly retrieve particular knowledge, summaries, and insights, making it a priceless useful resource for moral hacking.
▪ Bardeen.ai Supply: https://www.bardeen.ai
Bardeen.ai is an automation device that can be utilized for OSINT by enabling customers to streamline and automate knowledge assortment and evaluation processes from varied on-line sources. This enhances the pace and accuracy of OSINT actions, making them helpful belongings for cybersecurity professionals, researchers, and investigators.
▪ DarkGPT Supply: https://github.com/luijait/DarkGPT
DarkGPT is an AI assistant that makes use of GPT-4-200K to question leaked databases, aiding in environment friendly and focused searches inside compromised knowledge sources. This permits customers to extract important info and insights, enhancing the OSINT capabilities of cybersecurity analysts and researchers.
▪ PenLink Cobwebs Supply: https://cobwebs.com
PenLink Cobwebs is a complicated AI-powered OSINT device that focuses on gathering and analyzing knowledge from varied on-line sources. It provides complete capabilities for amassing, processing, and visualizing info to assist cybersecurity investigations.
▪ Discover AI Supply: https://exploreai.vercel.app
Discover AI is an AI-powered YouTube search engine that makes use of synthetic intelligence to seek for and extract info from YouTube movies, making it simpler to entry info for moral hacking functions.
▪ AnyPicker Supply: https://app.anypicker.com
AnyPicker is a strong visible internet scraper and AI OSINT device designed to extract knowledge from web sites with out requiring coding abilities. This device helps scraping a number of pages concurrently and gives a real-time preview of the extraction outcomes, providing flexibility and effectivity in internet knowledge assortment.
Create and Run Customized Python Script to Automate Footprinting Duties with AI
Attackers can leverage AI-powered applied sciences to boost and automate their footprinting duties. With assistance from AI, attackers can effortlessly create and run customized footprinting scripts and purchase priceless insights about their targets. By creating customized scripts empowered by synthetic intelligence (AI), attackers can effectively execute a sequence of web site footprinting instructions to assemble details about a goal area for cybersecurity assessments. For instance, Attackers can use ChatGPT to information the event of such a script by utilizing an acceptable immediate equivalent to: “Develop a Python script which is able to settle for the area title www.microsoft.com as enter and execute a sequence of web site footprinting instructions, together with DNS lookups, WHOIS data retrieval, e mail enumeration, and extra, to assemble details about the goal area.”
10. Footprinting Countermeasures
Footprint ing Counterm easures
- Prohibit the workers’ entry to social networking websites from the group’s community
- Configure internet servers to keep away from info leakage
- Educate staff to make use of pseudonyms on blogs, teams, and boards
- Don’t reveal important info in press releases, annual studies, product catalogues, and so forth.
- Restrict the quantity of data revealed on a web site or the Web
- Use footprinting methods to find and take away any delicate info that’s publicly obtainable
- Forestall search engines like google and yahoo from caching an internet web page and use nameless registration companies
- Develop and implement safety insurance policies equivalent to info safety and password insurance policies to control the data that staff can reveal to 3rd events.
- Implement multi-factor authentication mechanisms to boost the safety of the group’s methods and sources.
- Set aside inside and exterior DNS or use break up DNS, and limit zone switch to licensed servers.
- ▪ Disable listing listings within the internet servers. ▪ Conduct safety consciousness coaching periodically to teach staff about varied social engineering methods and dangers.
- ▪ Go for privateness companies on a Whois lookup database. ▪ Keep away from domain-level cross-linking for important belongings. ▪ Encrypt and password-protect delicate info. ▪ Implement captchas and price limiting on public-facing companies to stop automated instruments from amassing info at a speedy tempo.
- ▪ Don’t allow protocols that aren’t required. ▪ All the time use TCP/IP and IPsec filters for protection in depth. ▪ Configure Web Data Companies (IIS) to keep away from info disclosure by way of banner grabbing.
- ▪ Disguise the IP deal with and associated info by implementing a VPN or preserving the server behind a safe proxy.
- ▪ Request archive.org to delete the historical past of the web site from the archive database. ▪ Maintain the area title profile non-public. ▪ Place important paperwork equivalent to enterprise plans and proprietary paperwork offline to stop exploitation.
- ▪ Practice staff to thwart social engineering methods and assaults. ▪ Sanitize the small print offered to the Web registrars to cover the direct contact particulars of the group.
- ▪ Disable the geo-tagging performance on cameras to stop geolocation monitoring. ▪ Keep away from revealing one’s location or journey plans on social networking websites. ▪ Flip off geolocation entry on all cellular gadgets when not required. ▪ Be sure that no important info, equivalent to strategic plans, product info, or gross sales projections, is displayed on discover boards or partitions.
- ▪ Disable or delete the accounts of staff who left the group. ▪ Configure mail servers to disregard mails from nameless people. ▪ Deploy honeypots or honeynets throughout the community to draw and detect attackers that may divert potential footprinters away from important methods.
State of affairs
Reconnaissance refers to amassing details about a goal, which is step one in any assault on a system. It has its roots in army operations, the place the time period refers back to the mission of amassing details about an enemy. Reconnaissance helps attackers slim down the scope of their efforts and aids within the collection of weapons of assault. Attackers use the gathered info to create a blueprint, or “footprint,” of the group, which helps them choose the best technique to compromise the system and community safety.
Equally, the safety evaluation of a system or community begins with the reconnaissance and footprinting of the goal. Moral hackers and penetration (pen) testers should acquire sufficient details about the goal of the analysis earlier than initiating assessments. Moral hackers and pen testers ought to simulate all of the steps that an attacker often follows to acquire a good thought of the safety posture of the goal group. On this state of affairs, you’re employed as an moral hacker with a big group. Your group is alarmed on the information tales regarding new assault vectors plaguing giant organizations world wide. Moreover, your group was the goal of a significant safety breach previously the place the private knowledge of a number of of its clients have been uncovered to social networking websites.
You could have been requested by senior managers to carry out a proactive safety evaluation of the corporate. Earlier than you can begin any evaluation, it’s best to talk about and outline the scope with administration; the scope of the evaluation identifies the methods, community, insurance policies and procedures, human sources, and every other part of the system that requires safety analysis. You must also agree with administration on guidelines of engagement (RoE)—the “do’s and don’ts” of evaluation. Upon getting the mandatory approvals to carry out moral hacking, it’s best to begin gathering details about the goal group. When you methodologically start the footprinting course of, you’ll get hold of a blueprint of the safety profile of the goal group. The time period “blueprint” refers back to the distinctive system profile of the goal group as the results of footprinting.
The labs on this module offers you a real-time expertise in amassing a wide range of details about the goal group from varied open or publicly accessible sources.
Goal
The target of the lab is to extract details about the goal group that features, however shouldn’t be restricted to:
-
Group Data Worker particulars, addresses and get in touch with particulars, associate particulars, weblinks, internet applied sciences, patents, logos, and so forth.
-
Community Data Domains, sub-domains, community blocks, community topologies, trusted routers, firewalls, IP addresses of the reachable methods, the Whois report, DNS data, and different associated info
-
System Data Working methods, internet server OSes, location of internet servers, person accounts and passwords, and so forth.
Footprinting refers back to the strategy of amassing details about a goal community and its surroundings, which helps in evaluating the safety posture of the goal group’s IT infrastructure. It additionally helps to establish the extent of threat related to the group’s publicly accessible info.
Footprinting may be categorized into passive footprinting and energetic footprinting:
-
Passive Footprinting: Includes gathering info with out direct interplay. Any such footprinting is principally helpful when there’s a requirement that the information-gathering actions are to not be detected by the goal.
-
Energetic Footprinting: Includes gathering info with direct interplay. In energetic footprinting, the goal might acknowledge the continuing info gathering course of, as we overtly work together with the goal community.
Lab Duties
Moral hackers or pen testers use quite a few instruments and methods to gather details about the goal. Advisable labs that can help you in studying varied footprinting methods embody:
-
Carry out footprinting by way of search engines like google and yahoo
- Collect info utilizing superior Google hacking methods
-
Carry out footprinting by way of Web Analysis Companies
- Discover the corporate’s domains, sub-domains, and Hosts utilizing Netcraft and DNSdumpster
-
Carry out footprinting by way of social networking websites
- Collect private info from varied social networking websites utilizing Sherlock
-
Carry out Whois footprinting
- Carry out Whois lookup utilizing DomainTools
-
Carry out DNS footprinting
- Collect DNS info utilizing nslookup command line utility and on-line device
-
Carry out community footprinting
- Carry out community tracerouting in Home windows and Linux Machines
-
Carry out e mail footprinting
- Collect details about a goal by tracing emails utilizing eMailTrackerPro
-
Carry out footprinting utilizing varied footprinting instruments
- Footprinting a goal utilizing Recon-ng
-
Carry out Footprinting utilizing AI
- Footprinting a goal utilizing Shellgpt
Within the search bar seek for intitle:login web site:eccouncil.org. This search command makes use of intitle and web site Google superior operators, which limit outcomes to pages on the eccouncil.org web site that include the login pages.
Equally, kind the command EC-Council filetype:pdf ceh within the search bar to go looking your outcomes based mostly on the file extension and the key phrase (right here, ceh).
-
Other than the aforementioned superior Google operators, you may also use the next to carry out a complicated search to assemble extra details about the goal group from publicly obtainable sources.
-
cache: This operator means that you can view cached model of the net web page. [cache:www.eccouncil.org]- Question returns the cached model of the web site www.eccouncil.org
-
allinurl: This operator restricts outcomes to pages containing all of the question phrases specified within the URL. [allinurl: EC-Council career]—Question returns solely pages containing the phrases “EC-Council” and “profession” within the URL
-
inurl: This operator restricts the outcomes to pages containing the phrase specified within the URL [inurl: copy site:www.eccouncil.org]—Question returns solely pages in EC-Council web site during which the URL has the phrase “copy”
-
allintitle: This operator restricts outcomes to pages containing all of the question phrases specified within the title. [allintitle: detect malware]—Question returns solely pages containing the phrases “detect” and “malware” within the title
-
inanchor: This operator restricts outcomes to pages containing the question phrases specified within the anchor textual content on hyperlinks to the web page. [Anti-virus inanchor:Norton]—Question returns solely pages with anchor textual content on hyperlinks to the pages containing the phrase “Norton” and the web page containing the phrase “Anti-virus”
-
allinanchor: This operator restricts outcomes to pages containing all question phrases specified within the anchor textual content on hyperlinks to the web page. [allinanchor: best cloud service provider]—Question returns solely pages during which the anchor textual content on hyperlinks to the pages include the phrases “finest,” “cloud,” “service,” and “supplier”
-
hyperlink: This operator searches web sites or pages that include hyperlinks to the desired web site or web page. [link:www.eccouncil.org]—Finds pages that time to EC-Council’s house web page
-
associated: This operator shows web sites which might be related or associated to the URL specified. [related:www.eccouncil.org]—Question gives the Google search engine outcomes web page with web sites much like eccouncil.org
-
data: This operator finds info for the desired internet web page. [info:eccouncil.org]—Question gives details about the www.eccouncil.org house web page
-
location: This operator finds info for a selected location. [location: EC-Council]—Question provide you with outcomes based mostly across the time period EC-Council
Activity 1: Discover the Firm’s Domains, Subdomains and Hosts utilizing Netcraft and DNSdumpster
-
Launch any internet browser, and go to https://www.netcraft.com (right here, we’re utilizing Mozilla Firefox).
-
Click on on menu icon from the top-right nook of the web page and navigate to the Assets -> Analysis Instruments. Within the Instruments | Netcraft web page, click on on Web site Report possibility.
-
Open a brand new tab in Firefox browser and go to https://dnsdumpster.com/. Seek for certifiedhacker.com within the search field.
Activity 1: Collect Private Data from Varied Social Networking Websites utilizing Sherlock
Run sherlock “Elon Musk” command and you’ll get all of the URLs associated to Elon Musk, as proven within the screenshot. Scroll-down to view all the outcomes.
You may as well use instruments equivalent to Social Searcher (https://www.social-searcher.com) to assemble extra info associated to the goal firm and its staff from social networking websites.
Activity 1: Carry out Whois Lookup utilizing DomainTools
go to https://whois.domaintools.com
You may as well use different Whois lookup instruments equivalent to SmartWhois (https://www.tamos.com), Batch IP Converter (http://www.sabsoft.com), and so forth. to extract extra goal Whois info.
Activity 1: Collect DNS Data utilizing nslookup Command Line Utility and On-line Device
-
Within the nslookup interactive mode, kind set kind=a and press Enter. Setting the kind as “a” configures nslookup to question for the IP deal with of a given area.
-
set kind =cname
-
set kind =
Go to http://www.kloth.web/companies/nslookup.php
Activity 1: Carry out Community Tracerouting in Home windows and Linux Machines
Run tracert www.certifiedhacker.com command to view the hops that the packets made earlier than reaching the vacation spot.
Run tracert /? command to view the completely different choices for the command, as proven within the screenshot.
Run tracert -h 5 www.certifiedhacker.com command to carry out the hint, however with solely 5 most hops allowed.
You may as well use different traceroute instruments equivalent to PingPlotter (https://www.pingplotter.com/), Traceroute NG (https://www.solarwinds.com), and so forth. to extract extra community info of the goal group.
Activity 1: Collect Details about a Goal by Tracing Emails utilizing eMailTrackerPro
run recon-ng command to launch the applying.
Run market set up all command to put in all of the modules obtainable in recon-ng.
After the set up of modules, run modules search command. This shows all of the modules obtainable in recon-ng.
Run workspaces command to view the instructions associated to the workspaces.
To create the workspace, run workspaces create CEH command. This creates a workspace named CEH.
Enter workspaces record. This shows an inventory of workspaces (together with the workspace added within the earlier step) which might be current throughout the workspaces databases.
To resolve hosts utilizing the Bing module, use the next instructions:
- again
- modules load recon/domains-hosts/bing_domain_web
- run
As soon as executed with the reverse lookup course of, run the present hosts command. This shows all of the hosts which might be harvested thus far, as proven within the screenshot.
Activity 1: Footprinting a Goal utilizing ShellGPT
-
After incorporating the ShellGPT API in Parrot Safety machine, we are going to use ShellGPT for harvesting emails pertaining to a goal group. To take action, run sgpt –chat footprint –shell “Use theHarvester to assemble e mail accounts related to ‘microsoft.com’, limiting outcomes to 200, and leveraging ‘baidu’ as an information supply” command.
Within the immediate kind E and press Enter to execute the command.
-
ShellGPT will harvest the emails utilizing theHarvester device and shows the e-mail and host record.
-
We are going to carry out footprinting by way of social networking websites utilizing ShellGPT, to take action run sgpt –chat footprint –shell “Use Sherlock to assemble private details about ‘Sundar Pichai’ and save the lead to recon2.txt” command.
Within the immediate kind E and press Enter to execute the command.
-
After the execution of the command, within the terminal run ls command to view the contents within the current working listing.
-
We will see that recon2.txt file is created by earlier command. Within the terminal window, run pluma recon2.txt command to view its contents. Shut the textual content editor window.
ls -
We are going to carry out DNS lookup utilizing ShellGPT, to take action, run sgpt –chat footprint –shell “Set up and use DNSRecon to carry out DNS enumeration on the goal area www.certifiedhacker.com” command.
Within the immediate kind E and press Enter to execute the command.
-
Within the terminal run sgpt –chat footprint –shell “Carry out community tracerouting to find the routers on the trail to a goal host www.certifiedhacker.com” command to carry out Traceroute to a goal.
Within the immediate kind E and press Enter to execute the command.
-
Now run sgpt –chat footprint –shell “Develop a Python script which is able to settle for area title microsoft.com as enter and execute a sequence of web site footprinting instructions, together with DNS lookups, WHOIS data retrieval, e mail enumeration, and extra to assemble details about the goal area” command to run a python script to automate footprinting duties.
ls
