First thing first, we're going to open up our word document here.
Now, normally I do use my book and keep hand notes of everything.
But since we're doing this together over the video, I want to make sure that we
are
all playing along at home or it can at least see what's actually going on.
Now, what you see here is the beginning of my log, where we timestamp when we
actually made content, we selected, we made contact with the owner and we got
permission
received and this can be correlated with the actual text that I received on the
actual phone
itself.
And the reason that I point that out is because some of these timestamps are a
little off by a
minute or two.
So that's going back into that timescued that we talked about in the previous
skill.
But because we're there, it's going to be a discrepancy in terms of like a few
seconds here and there.
But to make it as accurate as possible, we should go in here and edit this
because we have
physical and digital evidence of when this actually happened.
So the hybrid school of wrestling was selected as recon target at 1300 and
owner
contacted in terms of what's going to happen during the recon and all that
happened when
in the course of a minute, he actually replied pretty quick.
And I'm going to delete the seconds here so that way we don't get too nitty
gritty on that.
Now, with all that out of the way, we understand our scope, let's go ahead and
start doing
some recon. And I have a separate browser here opened up.
And the first thing that we need to do is understand where this is at because
we are
not in San Antonio.
Now, I have to know this is in San Antonio and there we go.
Sorry.
Google is being a little weird with me.
So this you can pretend this is a pit test that's geo dislocated.
Between two points and that's kind of exactly what it is.
Now, when we do a search for the hybrid school of wrestling, we get everything
that you see here
along with the actual information of where it's located at.
So at this point, you want to say, go back into your log, put a timestamp on
there,
all control one based on our macro that we made inside of here and say recon
started.
Now, there's other information that you can put in here as well.
So we're going to copy the, we're going to copy the address.
And you can see here that there's also business hours as well too.
So you know when people are there and not there and that's important in case we
want to do
some physical scoping if we were down at San Antonio.
So for me, I'm just going to put a note here real quick that that's the actual
location
and then go ahead and identify it.
And then also we will go back and make a note of all the business hours.
Now, I'm not going to go through and add that to my notes because I want to go
ahead
and start getting through and doing some of this real quick.
But we can see here that it is because of that address, we can actually do a
Google
Street view.
So let me go back and copy that address real quick again, copy right there.
And then we're going to go into Google Street view.
And let's go ahead and open up right there.
Good.
Free view.
And we're going to type in our address.
And that's where we're going to close that tab right there.
This is where we're talking about right here.
I'm going to zoom in for you real quick and you can see if we zoom out that it
's
on Northwest side of San Antonio.
And we're going to take our little dude on the bottom right of the screen and
we're
going to drop him right there and turn around and see if we are in the right
location.
If not, we need to open our map back up and see how far we are off a little bit
.
Don't click there.
There we go.
And right there.
That's where we're looking at.
So I'm going to go ahead and click over there real quick.
And this right here, I'm going to zoom in for you real quick, right there is
where
we're taking a look at.
So it's this door right here, sweet B along with this garage door right here
and
everything inside of that building.
Now, why is this important?
Well, part of our physical recon and trying to do this as passively as possible
is to
make sure that when we are conducting this pen test, it's to make sure nobody
sees us.
Nobody is suspicious of us.
Nobody is trying to dime us out.
And by taking a look at this, we can see are there any security cameras?
Now, if I zoom back out and go to the other side of the building, make sure I'm
there.
OK.
Think, yeah, we can't get too far in there because the Google street, you didn
't.
Show us anything.
But if I zoom in, you can see on the backside of this building, there are no
security cameras.
Now, along with this comes with the information that we have other businesses
in the location.
So there would be other security cameras and other features out there that I'm
not going
to start digging into, but I can show you right across street.
There's a UPS substation there.
I guarantee you they have a lot of security there.
So let's say something criminal or something in our pen test happened that was
outside of our scope.
Those folks could be called and give up the security footage of what's actually
going on
to be able to identify us.
It's good to know this information, though, because if there's no security
equipment outside
of the building, then there's no network access to that organization because
most security cameras
and security equipment is connected inside of some sort of internal network.
Now, there are there is the rare occasion you run across the old school CCTV,
which is coax connected together.
But that's also a way for a method for us to identify.
We need to start getting makes and models of equipment when we're doing our
passive recon.
Because let's say that this light up here where my square is was a security
camera.
We should be able to get any information or get an idea of who made it and
start getting
instruction manuals, design information and see if it does use coax or ties
into an actual internal network.
If it uses cat five, then that gives us an idea that we might have to have to
go in and start doing
network reconnaissance when we're getting to the building itself.
Now, that being said, there's most likely an ISP connection inside of there.
But that's all we need to do on the street view so far.
Is there any kind of website domain or anything related to that?
Well, there is.
And that's where this website comes in at.
I'm going to open it in a new tab real quick.
And you can see here, I'm going to close it, that it's just a pointer to the
Instagram
or hybrid school of wrestling.
Now, with that information, can we either recon or get more in contact info or
otherwise related to that location?
Now, what I have pulled up here is at CRT dot SH.
And this basically allows us to do a quick certificate search for web domains.
And I have this pulled up because essentially you just type in the web address.
We can go copy that link address right there and then paste it in there and do
a search to see if there's any kind of SSL or TLS associated
with this actual website.
And you can see that there is none found.
And that's because this, again, is a pointer going to Instagram.
But this is actually good information to know.
Now, let's go do a more a rudimentary type search for the actual domain itself,
which is who is
on the actual domain tools dot com.
And this allows us to be able to do a domain look up and see if we can get any
information as far as IP addresses, registration information, what other
scopes that we may need to be able to look up.
So when we do get to the active scanning, we know what our scope is in terms of
network ID.
And you can see here that there is a network registration for that actual
website and it's done through a third party of GoDaddy.
You can see how long it's been around.
You can see what the name, uh, name service are.
And this allows us to be able to go through and do a deeper dive on if there
are any sub domains
that point outside of what's actually going on for that website, because the
main website itself may be a pointer, but it's possible
to own a domain, have a sub domain in the top level point to somewhere else.
And you can actually backdoor into a sub domain.
So all through this information, you see that you have the basic information of
the actual domain itself for the hybrid place that we're taking a look at.
But we want to go a little bit deeper and see if there are any instruction
documents or any network mappings or any kind of files that allow us to be able
to do a public search on the actual site itself.
So let's go back to Google real quick and we're going to start using a more
detailed Google search for our recon process.
And one of the things that we can do is say a site, uh, Cohen.
Hybrid school of wrestling.com and we want to make sure that we're looking for
a specific file type.
In this case, we're going to be looking for PDFs.
And so file type Cohen.
Now, you see here that nothing came up because I know that they don't have any
PDFs on there, but if you're targeting a different type of organization, they
may have
troubleshooting schematics instructions or anything related to that specific
organization or any kind of releasable information. Let's say common user
policy. This is a real big thing inside of the OD where if you did this exact
search against, let's say, army.mil, you would see a lot of this stuff come up.
Now, we're not really getting anything as far as like information concerning
the actual building itself or the equipment inside of it. And that's okay
because remember we're geo dislocated and we're also
picking a target that we know for a fact that doesn't have that much equipment
inside of it.
Well, what if we need to know more about the actual building itself and see
where we can actually sit in terms of doing a more active reton when we're on
site if we decide to go on site.
Well, let's go back to Google real quick and start real quick and because I
know that this isn't San Antonio. That's also Bear County, Texas.
And they have what's called a CAD. So you can do property searches on there.
And so we can go to the bear appraisal district official site or you can
Scroll down and go to the actual bear cat itself. And you can see here that we
actually have the actual property search. And now we can take our address that
we got from the Google search here. It could be like this right here.
And then when we go back to our browser, we can type that in and do a search.
And it may take just a second because we're going through a lot of different
pieces of information.
Now this will vary. I didn't modify that for a very specific reason because if
you go and look at the address, there's a sweet be inside of there.
And I don't want to show the personal information of the person that owns it
because this is actually a lease and not an ownership.