Red Team Recon

CHALLENGE INFORMATION

	Platform: TryHackMe Path: Red Teaming Module: Initial Access Room: Red Team Recon

DESCRIPTION:

Learn how to use DNS, advanced searching, Recon-ng, and Maltego to collect information about your target.

Learning Objectives

• Types of reconnaissance activities
• WHOIS and DNS-based reconnaissance
• Advanced searching
• Searching by image
• Google Hacking
• Specialized search engines
• Recon-ng
• Maltego

Introduction

Reconnaissance (recon) is crucial for launching successful attacks. It involves gathering information about a target without alerting them, and it can be accomplished through various methods such as searching for publicly available information, discovering subdomains, finding email addresses, and locating leaked documents.

Here we focus on passive reconnaissance techniques that do not create noise or alert the target, with specific objectives including identifying subdomains, gathering host and IP address information, and finding login credentials.

Question 1: We suggest you start the AttackBox and experiment with every command and tool we demonstrate.

No answer needed

Taxonomy of Reconnaissance

Reconnaissance is divided into two categories: passive and active recon.

Passive recon

Involves gathering information from publicly available sources without interacting with the target, utilizing Open Source Intelligence (OSINT). This includes collecting domain names, IP address blocks, email addresses, employee names, and job posts through DNS record queries or social media profiles.

Active recon

Necessitates direct interaction with the target by sending requests and observing responses. Examples of active reconnaissance techniques include using Nmap to scan target subnets and hosts for live services, version numbers, and running servers.

Active reconnaissance can be further classified into:

• External recon: Performed from outside the network. For example, running Nikto scans from the Internet.
• Internal recon: Conducted within the target’s network. For example, using tools like Nessus on an exploited host inside the target network to scan their internal infrastructure.

Question 1: Ensure you have a clear understanding of the different types of recon activities before proceeding.

No answer needed

Built-in Tools

WHOIS queries

WHOIS is a protocol that follows RFC 3912 specifications for requesting and receiving domain registration data. Servers listen on TCP port 43 and store records maintained by registrars leasing the domain names.

WHOIS

• To query the WHOIS database.
• Command: whois.
• Example: whois thmredteam.com.

Potential information to find:

• Registrar’s WHOIS server and URL.
• Record creation and update dates.
• Contact details (registrant, admin, tech) including names, addresses, and email/phone numbers.
• Results may also reveal authoritative name servers for the queried domain.

DNS queries

NSLOOKUP

• Uses the default DNS server to fetch A and AAAA records for a given domain.
• Available on Unix-like systems, Windows, and macOS.
• Command: nslookup.
• Example: nslookup cafe.thmredteam.com.

DIG

• Domain Information Groper.
• Another Unix-like system tool that offers extensive query options and allows specifying alternative DNS servers.
• Command: dig.
• Example: dig @1.1.1.1 tryhackme.com (using Cloudflare’s DNS server).

HOST

• A versatile DNS lookup utility available on Unix-like systems.
• Command: host.
• Example: host cafe.thmredteam.com.

Route Tracing

TRACEROUTE/TRACERT

• For tracing the route taken by packets from your system to the target host.
• Helps identify intermediate routers (hops) connecting you to the target, though some non-responsive routers may be indicated with an asterisk (*).
• Command: traceroute or tracert (depending on the operating system).
• Example: traceroute cafe.thmredteam.com.

In summary, these tools enable querying WHOIS databases and DNS servers for valuable information without raising alarms.

Questions and Answers

Question 1: When was thmredteam.com created (registered)? (YYYY-MM-DD)

2021-09-24

Query the WHOIS database. The default queried server is whois.verisign-grs.com.

user@kali:~$ whois --verbose thmredteam.com
Using server whois.verisign-grs.com.
...
   Creation Date: YYYY-MM-DDTHH:MM:SSZ
...
user@kali:~$

For the following two questions, you could use any of the previously introduced tools that query DNS servers: namely, nslookup, dig, or host. We use host this time:

user@kali:~$ host clinic.thmredteam.com
clinic.thmredteam.com has address 104.21.93.169
clinic.thmredteam.com has address 172.67.212.249
clinic.thmredteam.com has IPv6 address 2606:4700:3034::6815:5da9
clinic.thmredteam.com has IPv6 address 2606:4700:3034::ac43:d4f9
user@kali:~$

Question 2: To how many IPv4 addresses does clinic.thmredteam.com resolve?

2

Question 3: To how many IPv6 addresses does clinic.thmredteam.com resolve?

2

Advanced Searching

Popular Search Operators

• Find results with exact search phrase: "search phrase".
• Find files of type PDF related to a certain term (OSINT): OSINT filetype:pdf.
  • Other filetypes: doc, docx, ppt, pptx, xls, xlsx.
• Limit search results to a specific site: salary site:blog.tryhackme.com.
• Exclude a specific site from results: pentest -site:example.com.
• Find pages with a specific term in the page title: walkthrough intitle:TryHackMe.
• Find pages with a specific term in the page URL: challenge inurl:tryhackme.

Web Interface for Advanced Searches

• Google Advanced Search

Search Syntax

• Google Refine Web Searches
• DuckDuckGo Search Syntax
• Bing Advanced Search Options

Search engines index web pages continuously, potentially revealing confidential information such as internal documents, usernames, sensitive directories, server versions, and error messages.

The Google Hacking Database (GHDB) compiles search queries that expose such vulnerabilities:

• Footholds: To discover Nginx logs: intitle:"index of" "nginx.log".
• Files Containing Usernames: To discover files that leak juicy information: intitle:"index of" "contacts.txt".
• Sensitive Directories: To find out if a private RSA key is exposed: inurl:/certs/server.key.
• Web Server Detection: intitle:"GlassFish Server - Server Running".
• Vulnerable Files: intitle:"index of" "*.php".
• Vulnerable Servers: intext:"user name" intext:"orion core" -solarwinds.com.
• Error Messages: intitle:"index of" errors.log.

Social Media

Social media serves as an additional source for gathering information about a target without direct interaction. Users often share extensive details about themselves and their work – company employee names, password recovery questions, and targeted wordlists.

Technical staff posts might disclose information about the organization’s systems and vendors; for example, a network engineer recently certified by Juniper indicates Juniper networking infrastructure.

Job Ads

Job advertisements can reveal details like names, email addresses, and potential insights into the company’s systems and infrastructure, especially for technical positions. Popular job posts can differ by country, so it is beneficial to explore job listing sites in your client’s target regions. Examining the company’s official website for any published job openings may uncover additional intriguing details.

Note that the Wayback Machine can be helpful to retrieve previous versions of a job opening page on your client’s site.

Questions and Answers

Question 1: How would you search using Google for xls indexed for http://clinic.thmredteam.com?

filetype:xls site:clinic.thmredteam.com

Question 2: How would you search using Google for files with the word passwords for http://clinic.thmredteam.com?

passwords site:clinic.thmredteam.com

Specialized Search Engines

Beyond standard WHOIS and DNS tools, third-party paid services offer historical WHOIS data for comprehensive analysis. Free advanced DNS services are also available on various websites, which provide rich functionality and detailed information about domains.

WHOIS and DNS Related

ViewDNS.info

Offers reverse IP lookup, enabling users to find other domain names associated with specific IP addresses, even in cases of shared hosting. It helps determine that a single IP address may host multiple websites.

Threat Intelligence Platform

Requires a domain name or IP address input, launching tests for malware checks, WHOIS queries, and DNS lookups. It presents results in an easily readable format with additional information such as resolved Name Server (NS) records to their respective IPv4 and IPv6 addresses. It can also provide a list of other domains sharing the same IP address.

Specialized Search Engines

Censys

Offers detailed information about IP addresses and domains. By searching one of cafe.thmredteam.com’s resolving IP addresses, we can determine if it belongs to a third-party company (e.g., Cloudflare) rather than the target organization. This distinction is crucial for maintaining ethical scope during investigations.

Shodan

Can be used from the command line after creating an account and configuring Shodan with your API key using the command shodan init API_KEY. Different filters are available depending on your Shodan account type. The Shodan host <IP_ADDRESS> command retrieves geographical location data and open ports for a specified IP address.

Questions and Answers

Question 1: What is the shodan command to get your Internet-facing IP address?

shodan myip

The answer can be found in the linked Shodan CLI guide.

Recon-ng

Recon-ng is an open-source framework that automates OSINT tasks, offering various functionalities through modules from different authors. Some modules require keys to access online APIs.

Start Recon-ng:

recon-ng
# OR
recon-ng -w <WORKSPACE_NAME>
# to start with the specific workspace

Create a workspace for your project:

workspaces create <WORKSPACE_NAME>

# example
workspaces create thmredteam

Input starting information into the database:

# insert a domain
db insert domains

# check info in db
db schema

Search the marketplace for a module and review its details before installation:

# list all of the available modules
marketplace search

# search for available modules with keyword
marketplace search KEYWORD

# provide information about the module
marketplace info MODULE
marketplace info google_site_web

# install the specified module
marketplace install MODULE
marketplace install google_site_web

# uninstall the specified module
marketplace remove MODULE

# module grouping categories: discovery, import, recon, reporting

# search for modules containing "domains-"
marketplace search domains-

# * in D > Dependency | * in K > require a key

List installed modules and load one for use:

# list all the installed modules
modules search

# load a specific module to memory
modules load MODULE
modules load viewdns_reverse_whois

# unloads the module
CTRL + C

# review the loaded module's info
info

Execute the loaded module to perform OSINT tasks:

# list the options for the loaded module
options list

# set the value of the option
options set <option> <value>

# run the module
run

# when the module is run, it will read values from the database, get new kinds of information, and add them to the database

Keys (optional):

# lists the keys
keys list

# add the key
keys add <KEY_NAME KEY_VALUE>

# remove the key
keys remove <KEY_NAME>

Questions and Answers

Question 1: How do you start recon-ng with the workspace clinicredteam?

recon-ng -w clinicredteam

To answer the following questions, first we need to fire up Recon-ng.

user@kali:~$ recon-ng

Then we specify our target domain – thmredteam.com – and add it to our information database with db insert domains.

[recon-ng][default] > db insert domains
domain (TEXT): thmredteam.com
notes (TEXT):
[*] 1 rows affected.
[recon-ng][default] >

Question 2: How many modules with the name virustotal exist?

2

Then we search for modules with virustotal in their names using marketplace search virustotal, which results in:

[recon-ng][default] > marketplace search virustotal
[*] Searching module index for 'virustotal'...

  +---------------------------------------------------------------------------------+
  |               Path               | Version |     Status    |  Updated   | D | K |
  +---------------------------------------------------------------------------------+
  | recon/hosts-hosts/virustotal     | 1.0     | not installed | YYYY-MM-DD |   | * |
  | recon/netblocks-hosts/virustotal | 1.0     | not installed | YYYY-MM-DD |   | * |
  +---------------------------------------------------------------------------------+

  D = Has dependencies. See info for details.
  K = Requires keys. See info for details.

[recon-ng][default] >

Question 3: There is a single module under hosts-domains. What is its name?

migrate_hosts

We do the same, but this time we search for hosts-domains using marketplace search hosts-domains. This brings us to the answer:

[recon-ng][default] >  marketplace search hosts-domains
...
  | recon/hosts-domains/migrate_hosts | 1.1     | not installed | YYYY-MM-DD |   |   |
...
[recon-ng][default] >

Question 4: censys_email_address is a module that retrieves email addresses from the TLS certificates for a company. Who is the author?

Censys Inc

Check the module information with marketplace info censys_email_address. Remove the comma for the answer.

[recon-ng][default] >  marketplace info censys_email_address
...
  | author        | Censys, Inc. 
...
[recon-ng][default] >

Maltego

Maltego is an OSINT tool that combines mind-mapping with various transforms to gather information. Key features include:

• Starting entities: Users input a domain, company name, person’s name, or email address to initiate the process.

• Transforms: These are pieces of code that query APIs for related entity data, potentially returning zero or more entities.

• Transform types: Some transforms may actively connect to target systems, so users should understand their functionality before use, especially for passive reconnaissance.

• Workflow: Users can apply multiple transforms to generate new entities, such as IP addresses from DNS names and vice versa; Maltego organizes the results in a graph format.

• Transform categories: Transforms are grouped by data type, pricing, and target audience; some require a paid subscription, while others are available for free with Maltego Community Edition (CE).

• Activation: Even CE requires activation, which can be done through the Maltego Transform Hub or by installing and activating Maltego CE on a personal system.

• Integration: Maltego transforms can extract and arrange information from various sources like WHOIS databases and nslookup results.

Questions and Answers

Question 1: What is the name of the transform that queries NIST’s National Vulnerability Database?

NIST NVD

Without a Maltego installation available, we resorted to the techniques introduced in Task 4. A quick Google search – site:maltego.com NIST transform – provides us with the answer.

Question 2: What is the name of the project that offers a transform based on ATT&CK?

MISP Project

We do the same here, with only a slight modification to our search query: site:maltego.com ATT&CK transform.

Summary

The primary objective of reconnaissance in cyber attacks is to gather detailed information about the target. This intelligence can then be used to inform and refine subsequent attack strategies, making them more effective.

By collecting data on hosts, contacts, and other relevant details, attackers can identify vulnerabilities and launch targeted phishing campaigns.

The more intelligence gathered during this phase, the more precise and successful their attack is likely to be.

Question 1: The different tools and websites presented in this room provide the basics necessary to tackle further reconnaissance work.

No answer needed