Searching Shodan For Fun And Profit

SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners.

Web search engines, such as Google and Bing, are great for finding websites. But what if you're interested in finding computers running a certain piece of software (such as Apache)? Or if you want to know which version of Microsoft IIS is the most popular? Or you want to see how many anonymous FTP servers there are? Maybe a new vulnerability came out and you want to see how many hosts it could infect? Traditional web search engines don't let you answer those questions.

So what does SHODAN index then? Good question. The bulk of the data is taken from 'banners', which are meta-data the server sends back to the client. This can be information about the server software, what options the service supports, a welcome message or anything else that the client would like to know before interacting with the server.

The following paper has been written by Sajal Verma, that covers the important aspect of shodan and it also includes the tutorial to use shodan via metasploit and Maltego.

Read more

by Malik korrich ~ lundi 1 décembre 2014 0 commentaires

[Kali Linux] Maltego - Infrastructure Information Gathering

In this tutorial, i'm going to show you how to gather information using Maltego in Kali Linux.

Firstly, open up Maltego.

Applications>Kali Linux>Top 10 Security Tools>Maltego

If this is your first time using it, you need to complete the registration. Once the registration complete. Click on the menu button and select new.

A blank screen will appear. Later, click on pallete. In this tutorial i'm going to show how to gather information from infrastructure. So, click infrastructure, drag and drop "Domain" into your project.

You will see a earth icon with a domain name. Double click on it and change the domain name to your target. In this tutorial, my target is www.papagomo.com. 

Close that window and let's start gathering information. Right click on the earth icon, choose Run Transform and then All transform , followed by your choice. In this case, i will use  To phone number [using search engine].

If the result was found, it will produce output like this picture.If nothing appear, that mean not result found.

There are 4 phone numbers, but it doesn't mean all of them belongs to the webmaster, but you can make a try. Now i'm going to use the phone number to get more information. So i will use the phone number to transform it into url. 

After i transform it into URL using search engine, i got a Facebook page. Maybe it's belong to the phone number owner and the webmaster.

I think that's all for now. I hope you understand how to use Maltego. 

Read more

by Malik korrich ~ jeudi 24 juillet 2014 0 commentaires

OSINT Tools Worth Sharing

Open source intelligence is the next big thing, it will change the processes and systems of current intelligence structure. By looking at broader perspective, we can easily find the application of OSINT from business intelligence to security agencies, in short marketing firms, media houses, hackers, security and military agencies blah blah blah can get benefits out of from OSINT. But how, when and where to use OSINT ? This is actually a topic to discuss because if you have a weapon but you don't know how, when and where to use, then believe me this weapon is useless.

The answer of how to use open source intelligence is hidden on the tools and techniques, so in this article we will cover some great tools that are available in the market; and you can utilize them to make your hacking practice efficient (if you know what I mean). Some of the tools listed below are available on Kali Linux (the successor of backtrack) but if you are using any other distribution or even Windows OS then you can download and use them.

Maltego

Maltego is the tool that can gather information (believe me, it can gather). Maltego is a unique platform developed to deliver a clear threat picture to the environment that an organization owns and operates. Maltego’s unique advantage is to demonstrate the complexity and severity of single points of failure as well as trust relationships that exist currently within the scope of your infrastructure. 

• Maltego- Information Gathering ToolTutorial
• Maltego Information Gathering Backtrack5
• Maltego Tutorial - Mesh Analysis

SHODAN

SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners.

theHarvester

theHarvester is intended to help Penetration testers in the early stages of the penetration test in order to understand the customer footprint on the Internet. It is also useful for anyone that wants to know what an attacker can see about their organization.
The objective of this program is to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database.

• Theharvester Backtrack 5- Information Gathering Tutorial

Now we want to know about your favorite tool, it might be possible that you would not find your tool in the list aforementioned list; but it is not a big deal because it is not a final list. You can share the best tools other than mentioned one. I personally like and enjoy thehavester and maltego, what do you like most ?

Read more

by Malik korrich ~ samedi 15 février 2014 0 commentaires

Maltego Tutorial - Mesh Analysis

Maltego is the famous and the best tool that would really helpful in the process of penetration testing and ethical hacking, Maltego is powerful tool that help to gather information from various resources and by using various methods. Information gathering or foot-printing is the first step of hacking so the tools that would help you in this process are generally the important tools. We have discussed maltego before on backtrack 5 and other ways. So in this article we will discuss about Maltego Mesh attack.

Maltego Information Gathering Backtrack 5

Maltego- Information Gathering Tool Tutorial

FootPrinting-Information Gathering Tutorial

FootPrinting-First Step Of Ethical Hacking

Dnsmap- DNS Network Mapper

Backtrack 5- DNSenum Information Gathering Tool

Maltego Mesh is a firefox plugin that helps analysts in quickly find usefull information within a page, essentially it views the page you are looking at and tries to identify text within it that fits preset regular expressions. 

Usage 

To activate Maltego Mesh, either click View->Sidebar->Maltego Mesh or press Ctrl + Shift + M

Once an entity has been found on a page it will be within the sidebar on the right hand side of the browse.

Maltego Mesh Tutorial 

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ jeudi 10 novembre 2011 0 commentaires

Maltego Information Gathering Backtrack 5

Information gathering or foot-printing is generally a first step of Ethical hacking/penetration testing process. The more information you have the more chance of success, information gathering is the important phase because all of the process of hacking based on information that you have. Backtrack and specially Backtrack 5 contain a list of tools that will help you to gather information as DNSenum for DNS information gathering.

Maltego is an intelligent application that will help you to gather maximum information about people about networks and more, it has a broad features to discuss but the main aim of writing this article is not to discuss the feature of maltego but the aim is to demonstrate maltego on the platform of backtrack5. 

Maltego tutorial has been discussed before on ubuntu with videos click here to learn.

• For bt5, go to Applications-->Backtrack-->Information Gathering-->Network Analysis-->DNS Analysis-->Maltego
• The first windows will ask you to register your product. 

• After registration you will able to use maltego, if you will not register your product than you will not able to use it.
• On the top there is a two tabs, Investigate and Manage
• Go on manage tab than open a new page

• There are a lot of different entities available on the screen but the main option is Palette option that is available on left side, if you will not register the product than you would not recognize it.
• Now at this point everything is same as discussed on the previous maltego tutorial, follow the tutorial to run and use it.

FootPrinting-Information Gathering Tutorial

FootPrinting-First Step Of Ethical Hacking

Dnsmap- DNS Network Mapper

Backtrack 5- DNSenum Information Gathering Tool

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ mardi 26 juillet 2011 0 commentaires

Maltego- Information Gathering Tool Tutorial

This article is link with our series article on footprinting (Information gathering) for previous story click here.

Now beside whois,Nslookup and tracert command there are some tools that available on market to perform footprinting professionally, these tools provide a wide range of option and techniques to perform a valuable footprinting.  

In this article we will talk about Maltego, Maltego is an open source forensic application that are used to gather maximum information for the purpose of forensic and pen testing, it can represent a result in a very formal and easy to understand format. It is available in two flavours one is community edition and other is commercial version.

You can download Maltego on your windows based operating system and for Linux based operating system. Click here to grab your copy.

Tutorial

 This is the top and main navigation bar, there are two tabs one is investigate and the other is manage tab.

Now we are on the manage tab, where we can see different entities and transforms, but the point of consideration is Palette option turn it on.

Palette option is the main option from you have to drag your main task, for example if you want to gather a information about a person than drag the person option and enter the name of the person to whom you are going to gather information.

After all right click on a person and suppose we have to find the email addresses of a related person, than in the email option click all in the set and your scan will began. Output is depend on your computer processing speed and your internet speed.

Now we have found a related email addresses. Is this enough? No there are more amazing options present on maltego like to your can gather information about DNS server. For this purpose see the video demonstration of maltego.

Video Tutorial

FootPrinting-Information Gathering Tutorial

FootPrinting-First Step Of Ethical Hacking

Dnsmap- DNS Network Mapper

Note: If you enjoyed this post, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ dimanche 6 mars 2011 0 commentaires