-: Information Gathering and Aggregation;
so now, we've gotten an IP addresses,
we've gotten domain names, what else can we find out there?
Well, when we do information gathering, we are gonna do this
in many different ways; one of the ways is doing it
through packet captures, where we actually capture
the network packets that are on that network.
This is gonna require an intruder to break into
a company's network to gather this type of information,
and this will give you a treasure-trove of information
if you can get to it, because you're gonna be able
to figure out what hosts are on the network,
you're gonna figure out what operating systems their using.
You're gonna be able to use what shares
they're using, alright?
All of this can be done using a tool like Wireshark
if you can get onto the network;
so how do you get on the network?
Well, that's where you get into Wi-Fi hacking
or use social engineering to get your way in,
or you get an implant, right?
We'll talk about that in other courses
when we talk about attacks; right now, we're thinking about
from a threat perspective, is what information is out there?
And that's what we're talking about here
in threat management; so, when we talk about Information
Aggregation, it's taking all that information
from various tools and putting them together with
a single tool for better analysis.
There's lots of programs out there; one of the ones I like
is called theHarvester, and it will actually gather emails,
domains, host names, employee names, open ports,
banner grabs and other things,
and it's a text-based tool that's inside of Kali Linux
that you can run, and it will aggregate
all this data together from multiple sources,
to make up a nice, easy-to-read analysis report for me
to go through and figure out what I can find
on your organization.
Now, another one out there is called Maltego,
and Maltego is a great combination tool,
because it's gonna build relationship maps
between people and sources, so you can actually see here
on the screen, where you have this one person
based on their social media profile,
we can see all the people they've connected to,
so maybe I can't get to you directly,
but I can get to you through your Mom or through
your brother, or through your friend,
or your husband, right?
Well, it's the same thing when we start talking
about an employee network; if I'm trying to get to the CEO
of the corporation, I might not be able to get to the CEO,
but he's connected to the manager, and the manager
is connected to the worker bees,
and the worker bees are connected to the guy
in the mail room, and maybe the guy in the mail room
will be stupid enough to click on my link that I send
in a spear-phishing email.
Which gets me into the network, and then I can
work my way back up; Maltego helps show me all those
relationships based on things we find in social media,
files we've collected or internet sources that we've done
through the information gathering piece.
Now, another one out there that does this type of thing
is called Shodan, and Shodan is actually a search engine
for internet connected devices and their vulnerabilities;
you can find it at shodan.io, and it's kind of interesting,
because all those internet-of-things devices out there,
things like print servers, things like webcams,
things like security cameras, all of these things
are internet-of-things devices.
Your TV, for instance, they have vulnerabilities,
and how often do you patch and update your TV?
Not very, probably, right?
So Shodan actually goes through, and you can search
for something like in this case, I searched for the word
"webcam," and I found that there was 95 billion
related items with webcams, so they found a ton
of webcams out there that match my thing,
and I can start looking at it based on country,
and you can actually start getting into some
of these things, and if you can find it down to the one
in your company that you're looking at,
maybe there's a webcam that you can see the person
typing in their password, alright?
That's the idea here in Shodan, is finding these internet
connected devices as a way in for penetration testing,
so that's just a real brief overview
of information gathering and aggregation;
for the exam, that's really what you need to know
as far as CSA+.
Now if you're doing this from a management perspective
and you want to think bigger, you need to start thinking
what are the things out there that you have information on?
Which of your files are out there on the internet
that are telling more about your company?
Start doing Google searches, start doing Shodan searches;
see what you can find on your own organization,
because that is where your threat is,
is how much are you being shown to the outside world
that they can then use against you?
So think about it from the attacker's perspective,
and that's gonna help you minimize that threat
and lower the risk.