![Penetration Testing
OSINT is a key component
of the Penetration Testing
Execution Standard
(PTES).
[Image from https://www.trustedsec.com/penetration-testing/]](https://image.slidesharecdn.com/jerodbrennenwhatyouneedtoknowaboutosint-brennen-160408010515/85/Jerod-Brennen-What-You-Need-to-Know-About-OSINT-7-320.jpg)
Jerod Brennen - What You Need to Know About OSINT
- 1. Detecting the Undetectable: What You Need to Know About OSINT
- 2. Hack all the things! Jerod Brennen, CISSP, GWAPT You can find me at: Twitter: @slandail LinkedIn: /in/slandail
- 4. Want Answers? Start With the Right Questions. ◉What the heck is OSINT? ◉What’s your process? ◉What OSINT tools should I know about? ◉How do I defend myself?
- 5. 1. What the heck is OSINT? Let’s begin at the beginning.
- 7. Penetration Testing OSINT is a key component of the Penetration Testing Execution Standard (PTES). [Image from https://www.trustedsec.com/penetration-testing/]
- 8. 2. What’s your process? Wash. Rinse. Repeat.
- 9. EDGAR U.S. Securities and Exchange Commission. Over 20 million filings for publicly traded companies. You can also split your content Google Finance Leadership, performance, news stories, external links. Step 1: Profile the Company LinkedIn Company page. Products, services, 30k foot view. Company Website Careful, here. Visits from your laptop = a record of your IP touching their web infrastructure.
- 10. LinkedIn Employee names, titles, history with the company, and technologies that the IT staff uses. You can also split your content Facebook What do they eat for lunch? (More importantly, the answers to their secret questions.) Step 2: Profile the People Twitter Who do they talk to? What do they talk about? Search Engines Google, Bing, Duck Duck Go Individual Internet footprint
- 11. In two or three columns The Wall of Shame U.S. Department of Health and Human Services Office for Civil Rights Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. Breaches Affecting 500 or More Individuals PrivacyRights.org Chronology of Data Breaches (2005 – present). Filter by source (if known), industry, and/or year. PasteBin / Cryptbin Designed to let programmers share and troubleshoot snippets of code, they’ve also become repositories for proof of breach. For example. “Here are 1,000 passwords. Send xxx bitcoins to this address for the other 49,000. Step 3: Research Previous Breaches
- 12. Mobile Apps Start with Google Play and iTunes. Download the app file (.apk, .ipa) to your testing machine, unzip it, and start poking around. If they have an app in Google Play, reverse the app back to it’s original Java source code. You can also split your content Web Infrastructure Lots to cover here, folks. Let’s save the details for the next section. Step 4: Profile the Internet-Facing Infrastructure
- 13. 3. What OSINT tools do I need to know about? Automation, folks. That’s where it’s at.
- 14. Tell Me About Your Web Apps ◉ Netcraft Site Report http://toolbar.netcraft.com/site_report ◉ ICANN WHOIS https://whois.icann.org/en ◉ ARIN WHOIS-RWS https://whois.arin.net/ui/advanced.jsp ◉ Hurricane Electric BGP Toolkit http://bgp.he.net/
- 15. These Are a Few of My Favorite Things ◉ Qualys SSL Labs – SSL Server Test https://www.ssllabs.com/ssltest/ ◉ PunkSPIDER https://www.punkspider.org/ ◉ UltraTools DNS Zone Transfer Lookup https://www.ultratools.com/tools/zoneFileDump ◉ SHODAN https://www.shodan.io/
- 17. ““Automation, folks. That’s where it’s at.” – Jerod Brennen, just a few minutes ago
- 18. ◉Maltego https://www.paterva.com/w eb6/products/maltego.php ◉ recon-ng https://bitbucket.org/LaNMaSt eR53/recon-ng Replace Yourself With a Very Small Shell Script
- 19. 4. How do I defend myself? Sitting under your desk and crying is not an option.
- 20. Riddle Me This, Batman… How much of what we’ve discussed would trigger an alert in your IDS/IPS?
- 21. ◉ Unauthorized ports open on Shodan? Close them. ◉ Web app vulnerabilities on PunkSPIDER? Fix them. ◉ Zone transfers were successful? Disable them. ◉ Passwords on Pastebin? Change them. ◉ Users oversharing on social media? Train them. Let’s Not Overcomplicate Things
- 22. Would You Like to Know More? ◉Online Strategies http://www.onstrat.com/osint/ ◉Penetration Testing Execution Standard http://www.pentest-standard.org/index.php/Main_Page ◉IT Security Career http://www.itsecuritycareer.com/blog/what-you-dont-know- about-osint-can-hurt-you/
- 23. Thanks! ANY QUESTIONS? You can find me at: Twitter: @slandail LinkedIn: /in/slandail