Category: Footprinting

Hello aspiring ethical hackers. In our previous blogpost, you learnt what is OSINT and its importance in ethical hacking, different types of OSINT etc. In this blogpost, you will learn about Sherlock, a OSINT tool.

Sherlock’s role in OSINT comes while gathering information from social media. It works by hunting for a particular username across various social networks. It does this by relying on social media site’s design feature to provide a URL with the username when a user registers an account on the social network.

Sherlock queries that URL and determines if the user has an account on that particular social network. It works by querying that URL and then uses that response to determine if there is a username. Sherlock can search for users on over 300 social networks that include Apple Developer, Arduino, Docker Hub, GitHub, GitLab, Facebook, Bitcoin Forum, CNET, Instagram, PlayStore, PyPi, Scribd, Telegram, TikTok, Tinder etc.

Let’s see how this tool works. For this I will be using Kali Linux which has Sherlock in its repository. You can install sherlock on Kali as shown below.

The simplest way to query a username with sherlock is by just supplying a username.

Searching on a particular social media site

Instead of searching for a username on all the social media accounts, you can search for a username’s presence even on a single site as shown below. For example let’s search for a username on site Twitch.

Searching for similar usernames

Sometimes, a username can be slightly different to a person we are searching for. We can also search for similar usernames with this tool as shown below.

Here, {?} will be replaced with – or hyphen or period (.).

Searching for multiple usernames at once

You can even search for multiple usernames with this tool as shown below. For example, let’s search for “hackercoolmagazine” and “hackercool” on Instagram.

Using a proxy while searching

You can even route your query through a proxy to remain anonymous.

Dump the entire HTTP response

We can even see the HTTP response of the site while searching using this option.

Time to call

By default, while querying for usernames, this tool waits for 60 seconds for response to the request it made. With this timeout option, this time can be changed as shown below. The value should be set in seconds.

Print all the output

By default, Sherlock only prints out the social network where the username was found. Using the option, we can see all the social networks this tool queries for and also the reason why it was not found.

Print only positives found

This option prints out all the social networks on which the username is found.

Browse

By setting this option, we can use Sherlock to view the job result page on browser.

Search NSFW sites too

By default, sherlock doesn’t query NSFW sites while searching for a username. When we set this option, it even queries NSFW sites for the particular username.

Writing the output to a file

Like any other tool, we can use Sherlock too to save the output to a file of our choice using the “-o” option as shown below.

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about OSINT. In this blogpost, you will learn about a tool called theharvester that is used to gather open source intelligence (OSINT) on a company or domain.

Using theHavester tool, we can gather information like subdomain names, email addresses, virtual hosts, open ports, banners and employee names of an organization from different public sources like search engines, pgp key servers, IP addresses and URLs.

theHarvester is installed by default on almost all pen testing distros. For this tutorial, we will be using Kali Linux. theHarvester is very simple to use but very powerful during footprinting stage of a red team assessment or a penetration test. It can take a domain or an organization as target as shown below.

theHarvester can list a lot of entries as part of performing OSINT. You can specify the limit to the number of entries you want to be displayed.

You can even start querying from particular entry form list of entries displayed. For example, you want to start querying from the 10th entry.

–shodan

theHarvester also has a option called “–shodan” that queries the Shodan search engine for any open ports or banners from discovered hosts. However, this requires api keys.

–screenshot

This command allows theHarvester to take screenshots of subdomains that are found.

–dns-brute

As the command explains, you can brute force DNS servers using this option.

–source

theHarvester uses many public sources to collect information. Some of them are anubis, baidu, bing, brave, censys, etc. We can even ask it to use a specific source using the “–source” command.

Learn how to perform OSINT using amass or Maltego or Spiderfoot.

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about network footprinting. It is performed to discover assets of the organization that are exposed to the internet. In this blogpost, you will learn about a tool. amass that can discover majority of any organization’s exposed assets.

OWASP Amass used mainly to find assets mapped to a particular domain, perform sub-domain enumeration, autonomous system numbers (ASNs) etc. Although there are many other tools that can enumerate sub-domains etc. (for example gobuster), this tool as you can see is backed by OWASP. Let’s see how to use this tool to discover assets of an organization.

Amass is installed by default in almost all pen testing distros. For this blogpost, we will be using Kali Linux. It doesn’t have a man page yet, but we can see all the options it supports using the help option.

Amass has 5 subcommands as shown below.

Each subcommand has its own help section. For example, let’s see the “intel” subcommand first.

amass intel

The ‘intel’ subcommand is used to discover targets to perform enumeration later. We can specify an IP address, IP address range, domain etc as targets to this command.

Apart from these, even ASN can also be specified as target.

amass enum

This sub command is used to perform enumeration and network mapping of the discovered targets.

Using it, we can perform DNS enumeration too. All the findings of “amass enum” command are stored in a graph database, which is located in the amass’s default output folder. To enumerate subdomains of a domain using amass enum, this is the command.

amass enum -d owasp.org -whois

Adding, “-ip” option to the above command, we can also get IP addresses for the sub domains discovered.

Amass queries more than 80 sources to collect information. All the sources it queries can be seen using the list flag.

Learn how to perform OSINT with theharvester tool.

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt what is OSINT in detail. In this blogpost, you will learn about Maltego, one of the most popular tools used to perform OSINT. Maltego is an open-source tool that is used for OSINT, forensics and other investigations. It is a link analysis software that offers real-time information gathering.

Maltego focuses on analyzing real world relationships between people, groups, webpages, domains, networks internet infrastructure and what not. Using maltego, we can extract information like DNS records, whois records, Phone numbers, email addresses, IP addresses and metadata etc.

Some of the most important data sources queried by Maltego include vulners, dorking, OpenPhish, Image Analyzer, Hunter, Censys, Google Social Network Tools, VirusTotal Premium, NIST, Pipl, Whois XML, Wayback machine, Phone Search, Shodan etc.

Maltego runs on Linux, MacOS and Windows. For this tutorial, we will be using Maltego on Kali Linux. Open terminal and type command “maltego”. The system will prompt you if you want to install maltego as shown below.

After the installation is finished, Maltego will prompt you to select a product. You need to have an account with Maltego to use it. Register for a free account. (Maltego CE (FREE) account by clicking on “Register”.

Accept the terms and click on “Next”.

(You can either create a account from this tool or create it from their website). Login into your account.

You will be taken to the browser. Login into your account created earlier.

After a few seconds, you will get a message that the authentication is complete.

Click on “Next”. Select “standard transform” option and click on “Next”.

Click on “Next”.

In the next window, make appropriate choice and click on “Next”.

Choose a browser and click on “Next”.

Click on “Next”.

Select the option “Open a blank graph and let me play around” option and click on “Finish”.

If you select the option “Open an example graph”. You will see this.

You will get to the interface of Maltego. Maltego calls the queries you search for as entities. These entities can be anything like name of a person, IP address, email address, domain etc. In the entity Palette, search for “email” as shown below and drag the result into the graph.

Click on the entity in the graph to change it to the email address you want to search for.

For example, let’s search for information related to our company.

In order to search for anything related to this email, right click on the entity.

There are various transforms you can search for like IP addresses, domains etc. Click on running on all transforms to see all the transforms available.

From here, you can select any transform you want. For example, run “to domains”.

As you can see, the domain related to this email is displayed. You have read just now that Maltego is a link building software. We can also run a transform on this resultant domain. For example, right click on the domain, and select To email addresses transform again.

Like this, we can search for related email addresses, Phone number, domain, DNS entries, usernames, social media accounts, etc. using this tool. Learn how to perform OSINT using SpiderFoot.