Changes

SEC520/labs/Lab 2

14 bytes removed, 12:18, 31 January 2018

no edit summary

<h2> Introduction</h2>

<dl><dd><ul><li>This lab teaches various methods of gathering information from a targeted computer system. Normally, an individual or a company can be hired to perform Penetration Testing in order to detect weaknesses in an organization's computer system. The first phase (called the "reconnaissance phase"

is considered to be a "harmless activity", where a person can simply gather information to be used later in other aspects of penetration

testing (network scanning and enumeration).

</li></ul>

~~<tbody>~~<tr valign="top">

<td>Information Gathering</td>

<td>Foot-printing</td>

</td>

</tr>

~~</tbody>~~</table>

the above-mentioned techniques, there are other techniques and tools to

help gather useful server information of a targeted organization.

{{Admon/tip|sensepost.com|This is a website that is dedicated to internet security, and provides a platform to help gather information regarding a server. In fact,

examples from the textbook: Penetration Tester's Open Source Toolkit use examples from this website. We will be using this site for the majority of lab2...}}

search (i.e total number of links at the top of the search results), and record the total number of links for this type of search in

your lab logbook.</li>

<li>Now, enter the following directive in the Google search box: site:sensepost.com {{Admon/important|Enter Site Directive in Google Search Textbox|Don't enter the "site" directive in the URL textbox at the top of the web-browser - enter this directive in the Google SEARCH text; otherwise, the directive will not work. Also make certain remain in the google web-page when performing this operation...}}</li>

<li>You should notice a change in the display of links. How does this

search method differ from the previous search method using only the

just collected during this lab for penetration testing? (Record your

answer in your lab log-book)</li>

<li>Repeat the information-gathering process for the following URL: linux.senecac.on.ca for practice. {{Admon/tip|Gathering Information in your Own Server at Home|Just for Interest, it is not that difficult to obtain SOME information regarding your own computer system at home. First, determine your IP address by using the ifconfig command for Linux, or the ipconfig command in windows. One very quick way to determine your IP Address is to simply type IP Address in the URL Window of your web-browser. Knowing your own IP Address at home is useful during the link analysis and domain name expansion steps in the next task...}}</li>

<li>Proceed to Task #2 </li>

</ol>

categorize relationships between other websites, and the "target" website

called "sensepost.com". You will be downloading, installing and running

serveral open-source tools (a series of packages packaged as BiLE (which stands for: "Bi-directional Link Extraction" tools) to asssist in obtaining this information. <br~~></p~~> {{Admon/important|Installing Dependencies for BiLE.pl, BiLE-Weigh.pl|You may need to download the BiLE Utilities, consisting of useful Perl Scripts. Your Kali Linux distribution most likely comes with Perl already loaded. On the other hand, prior to running these Perl Scripts, you may be required to first install the application called HTTrack. You can do this by installing "httrack" via "apt-get" or use a graphical application (such as Synaptic Package Manager)}}

</li>

<li>Issue the command: which httrack to confirm that this dependent application has been installed (refer to warning message above).</li>

target website, as well as the output-file (generated by the BiLE.pl

Perl Script.</li>

<li>Issue the following command: perl BiLE-weigh.pl sensepost.com output.sensepost.com.mine (Assuming BiLE.pl Script and "output.sensepost.com" are contained in the current directory). {{Admon/important|Error: Sort: open failed: +1: No such file or directory|If you run the BiLE-Weigh.pl command, and encounter the above error, then make the following editing changes for this script: change following line:<nowiki> 'cat temp | sort -r -t ";" +1 -n > @ARGV[1].sorted';</nowiki> to read:<nowiki> `cat temp | sort -r -t ":" -k 2 -n > @ARGV[1].sorted`;</nowiki> (Note: ` in this case is "Left-Tick" representing command substitution - not to be confused with a single-quote. }} </li>

<li>View the contents of the file "output.sensepost.com.sorted" in your

current directory. Notice the ranking of the relavance of links

<li> Issue the command: perl tld-expand.pl sensepost.com.domains.txt sensepost.com.domains.variations.txt. What do these variations represent in terms of reconnaissance? Record your finds in your lab log-book.</li>

<li>Proceed to Task #3 </li>

</ol>

Answer Task #2 observations / questions in your lab log book.

<h2> Task #3: Foot-printing</h2>

As opposed to the Information Gathering phase (that collects information such as IP Addresses), the Foot-printing phase tends to gain a “clearer picture” of the structure of the organization's computer system. This can include relationships among servers, as well as noting IP Address ranges.

Footprinting (in simpler terms) means Network Mapping.

You will be using the information collected in Task #1 to assist with obtaining User information in this task.

{{Admon/important|Install metagoofil program| The harvester program is already installed in your Kali system, but you will need to install the program metagoofil. Issue the command (as root): apt-get install metagoofil }} ~~</li>~~

INSTRUCTIONS:

<ol>

<li>Issue the command theharvester --help, to learn how to run this script again with the following options:<ul><li>Domain: sensepost.com</li><li>Number of limited results: 100</li><li>Data Source: google</li><li>Output filename: ~/sensepost.user </li></ul></li>

<li>Record any user information that you consider relevant (for penetration testing) in your lab log-book.</li>

<h2> Task #5: Verification / The "Tank" Server</h2>

{{Admon/important|Location of dnsmap Utility in Kali Linux|The dnsmap utility is a time-saving method of determining reverse dns lookups in a batch mode involving an input file of collected dns entries. This utility is contained in your Kali Linux boot media under the file pathname: /pentest/enumeration/dns/dnsmap}}

It is important to "double-check" the validity of your collected information - in particular, your IP addresses. If any servers are no longer running, this can waste a tremendous amount of time during the scanning process. Remember: the longer a scan takes to execute, the more vulnerable you are as the penetration tester to detection.

Nathan.misener

53

edits

CDOT Wiki β

Changes

SEC520/labs/Lab 2

CDOT Wiki ^β