Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.
Christian Martorella
Source Conference Barcelona 2009
Tactical
          Information Gathering




Christian Martorella
Source Conference Barcelona 2009
Who am i ?

Christian Martorella
   Security Services S21sec
   CISSP, CISA, CISM, OPST, OPSA, C|EH
   OWASP WebSlayer Pro...
Information Gathering


 “Is the collection of information before the attack.

 The idea is to collect as much information...
Tactical

 “Designed or implemented to gain a temporary
 limited advantage”
                               Wikipedia
I.G Why use it?
 It’s what the real attackers are doing
 Attackers doesn’t have a restricted scope
 Knowing what informati...
I.G what for?
 Infrastructure:
 Information for discovering new targets, to get a
 description of the hosts (NS,MX, AS,etc...
Typical Pentesting Methodology


                                    Post-     Cover     Write
 I.G   Scan   Enumerate   E...
What everyone focus on:


             Enumera             Post-     Cover     Write
I.G   Scan             Exploit
      ...
Real world Methodology
      I.G

  Discover what
makes the company
     money

                    Do whatever it
       ...
Types	 of I.G
Types	 of I.G


   Passive                  Active




             Semi Passive
Where / how can we obtain
this kind of info?
Obtaining info - Old School way


 DNS Zone Transfer (active)
 DNS Reverse Lookup             Search engines
 (active)    ...
Obtaining info - Old School way
      Active                      Passive


 DNS Zone Transfer (active)
 DNS Reverse Looku...
New sources for I.G
Obtaining - New sources

Web 2.0 - Social Networks and Search engines (passive)


Metadata (passive)


Private data (passi...
Obtaining people info - New sources

 Professional and Business Social networks
Obtaining people info -
New sources
Obtaining people info -
New sources




    Current Job
     Pasts Jobs
     Education
   Job description
        Etc...
Obtaining employees names
from a company
Obtaining employees names
from a company
Linkedin I.G example
Linkedin I.G example



              I L
          FA
Obtaining people info -
New sources
Obtaining Emails from a
company
Obtaining Emails from a
company
Google Finance & Reuters
People information:
People search
People search
People search
   Name
 Username
   Email
  Phone
 Business
Nick name / username
verification
Nick name / username
verification
Nick name / username
verification
Nick name / username
verification
Private data - pay per view
Microblogs



 Small posts up to 140 characters
Microblogs



 Small posts up to 140 characters
Bookmarks
Bookmarks
Bookmarks
Bookmarks



             A IL
            F
Reverse Image search




Pic from
“Novartis”
search on
TwwepSearch
Reverse Image search




Pic from
“Novartis”
search on
TwwepSearch
WikiScanner

When you edit the wikipedia:
  You can edit leaving your username
  You can edit anonymous using your IP addr...
WikiScanner
Company IP ranges
Anonymous Wikipedia edits, from interesting
organizations
Provide an ip for a wikipedia user...
WikiScanner - IP ranges
WikiScanner - Wikipedia edits
Poor Man Check User
Provide an ip for a wikipedia username
New sources - Metadata


Metadata: is data about data.
New sources - Metadata


Metadata: is data about data.

Is used to facilitate the understanding, use and
management of dat...
Obtaining more data - Metadata



Provides basic information such as the author of a
work, the date of creation, links to ...
Metadata - Dublin Core (schema)
Content & about the   Intellectual Property   Electronic or Physical
     Resource        ...
Metadata example
Metadata example
Metadata - Images
EXIF Exchangeable Image
File Format
• GPS coordinates
• Time
• Camera type
• Serial number
• Sometimes u...
Metadata - Images
EXIF Exchangeable Image
File Format
• GPS coordinates
• Time
• Camera type
• Serial number
• Sometimes u...
Metadata - example
Metadata - example
     logo-Kubuntu.png
                                    logo-Ubuntu.png




software - www.inkscape.o...
Metadata - example
     logo-Kubuntu.png
                                         logo-Ubuntu.png




software - www.inksc...
Metadata - EXIF- Harry Pwner




     Deathly EXIF?
Cat Schwartz - Tech TV
Cat Schwartz - Tech TV
Cat Schwartz - Tech TV
Cat Schwartz - Tech TV



              I L
          FA
Washington Post

Botmaster location exposed by the Washington Post
Washington Post

Botmaster location exposed by the Washington Post

 SLUG: mag/hacker
 DATE: 12/19/2005
 PHOTOGRAPHER: Sar...
Washington Post

Botmaster location exposed by the Washington Post

 SLUG: mag/hacker
 DATE: 12/19/2005
 PHOTOGRAPHER: Sar...
Metadata


 Ok, I understand metadata... so what?
Metagoofil

 Metagoofil is an information gathering tool
 designed for extracting metadata of public
 documents (pdf,doc,xls...
Metagoofil

 Metagoofil is an information gathering tool
 designed for extracting metadata of public
 documents (pdf,doc,xls...
Metagoofil

 Metagoofil is an information gathering tool
 designed for extracting metadata of public
 documents (pdf,doc,xls...
Metagoofil

 Metagoofil is an information gathering tool
 designed for extracting metadata of public
 documents (pdf,doc,xls...
Metagoofil
Metagoofil

               Workers
 User names                 Server names
               names


                        ...
Metagoofil

               Workers
 User names                 Server names
               names


 Computer               ...
Metagoofil
Metagoofil
      site:nasa.gov filetype:ppt
Metagoofil
      site:nasa.gov filetype:ppt
Metagoofil
Downloaded files
Metagoofil
Downloaded files

     ppt 1

     pptx 2
                   parsers /
                                 Results.h...
Metagoofil - results
Metagoofil - results
Metagoofil - results
Metagoofil - results
Metagoofil - results
Metagoofil - results
Metadata - The Revisionist

         Tool developed by Michal Zalewski, this tool will
         extract comments and “Trac...
Metagoofil & Linkedin results


 Now we have a lot of information, what can i do?
 • User profiling
Using results
Using results
User profiling

• User list creation John Doe

                john.doe
                     jdoe
           ...
Using results
User profiling

• User list creation John Doe

                john.doe
                     jdoe
           ...
Using results
User profiling

• User list creation John Doe

                john.doe
                     jdoe
           ...
Using results
Using results
Password profiling

Dictionary creation: words from the different user sites



                 magic
      ...
Using results
Password profiling

Dictionary creation: words from the different user sites



                 magic
      ...
Using results
Password profiling

Dictionary creation: words from the different user sites



                 magic
      ...
One password to rule them
all
Maltego the ultimate I.G Tool
Maltego the ultimate I.G Tool
Maltego the ultimate I.G Tool
Maltego the ultimate I.G Tool
Other examples
Phone in sick and treat himself to a day in bed.




Kyle Doyle's Facebook profile makes it quite
obvious he was not off wo...
Phone in sick and treat himself to a day in bed.




                            I L
                  FA
Kyle Doyle's Fac...
Was shown the door after posting that her job was
        'boring' on her Facebook page
I L
                   FA
Was shown the door after posting that her job was
        'boring' on her Facebook page
More than meet the eyes
More than meet the eyes
More than meet the eyes
Daily life I.G
Looking for a Housekeeper on Craiglist, 3 interesting
resumes came up:
Daily life I.G
Looking for a Housekeeper on Craiglist, 3 interesting
resumes came up:

  Myspace page, applicant drinking ...
Daily life I.G
Looking for a Housekeeper on Craiglist, 3 interesting
resumes came up:

  Myspace page, applicant drinking ...
Daily life I.G
Looking for a Housekeeper on Craiglist, 3 interesting
resumes came up:

  Myspace page, applicant drinking ...
Final thoughts
Be careful what you post/send, all stay online
Think twice what you post
Check the privacy configuration of ...
References
www.edge-security.com

blog.s21sec.com

www.s21sec.com

carnal0wnage.blogspot.com

www.gnunet.org/libextractor
...
?
Thank you for coming



cmartorella@s21sec.com          http://laramies.blogspot.com
cmartorella@edge-security.com   http:...
References www.edge-security.com blog.s21sec.com www.s21sec.com carnal0wnage.blogspot.com
References www.edge-security.com blog.s21sec.com www.s21sec.com carnal0wnage.blogspot.com
References www.edge-security.com blog.s21sec.com www.s21sec.com carnal0wnage.blogspot.com
References www.edge-security.com blog.s21sec.com www.s21sec.com carnal0wnage.blogspot.com
Prochain SlideShare
Chargement dans…5
×

References www.edge-security.com blog.s21sec.com www.s21sec.com carnal0wnage.blogspot.com Tactical Information Gathering

65 352 vues

Publié le

References
www.edge-security.com

blog.s21sec.com

www.s21sec.com

carnal0wnage.blogspot.com

www.gnunet.org/libextractor
lcamtuf.coredump.cx/strikeout/
www.paterva.com
http://sethgodin.typepad.com/seths_blog/2009/02/personal-branding-in-the-age-
of-google.html
laramies.blogspot.com
http://www.eweek.com/c/a/Security/Washington-Post-Caught-in-Metadata-Gaffe/
Chris Gates Carnal0wnage Brucon 2009 Presentation

http://www.neuroproductions.be/twitter_friends_network_browser/

Publié dans : Technologie, Voyages, Formation
  • DOWNLOAD FULL BOOKS, INTO AVAILABLE FORMAT ......................................................................................................................... ......................................................................................................................... 1.DOWNLOAD FULL. PDF EBOOK here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB Ebook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. doc Ebook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. PDF EBOOK here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB Ebook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. doc Ebook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Répondre 
    Voulez-vous vraiment ?  Oui  Non
    Votre message apparaîtra ici
  • DOWNLOAD FULL eBOOK INTO AVAILABLE FORMAT ......................................................................................................................... ......................................................................................................................... 1.DOWNLOAD FULL. PDF eBook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB eBook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. doc eBook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. PDF eBook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB eBook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... 1.DOWNLOAD FULL. doc eBook here { https://tinyurl.com/y3nhqquc } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, CookeBOOK Crime, eeBOOK Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Répondre 
    Voulez-vous vraiment ?  Oui  Non
    Votre message apparaîtra ici
  • Confused..
       Répondre 
    Voulez-vous vraiment ?  Oui  Non
    Votre message apparaîtra ici
  • Nice Information..
       Répondre 
    Voulez-vous vraiment ?  Oui  Non
    Votre message apparaîtra ici

×