There is a lot of information to cover when it comes to casting that net out
for such a wide target like the United States Army.
And we're going to go through some of the steps that we went through throughout
this skill to take a look at how we would actually approach this and understand
that we need to hone in our target and scope and make sure that
some times our scope is very narrow but the target is very wide. And this is a
prime example because if you're conducting a Pintest for the US Army, I
guarantee you it's not against every single system that the Army has at any
given time.
It's going to be for a very narrow slice of the overall pie so to speak. And
what we're taking a look at here is the who is record for Army.mil.
You'll notice that it's very straightforward and not a lot of info here. And
that's because as I zoom in for you, there's been over 500 changes and 500
unique IP addresses over the last three years alone for IP history.
Now you can go into the actual hosting history itself and get an idea of what's
going on if you sign up for the site. I'm not going to do that. I just wanted
to point that out for you real quick.
And there's also been a.
Basically a bunch of changes and IP addresses on the backside of this as well.
For instance, let me zoom back in again real quick.
There's over 4500 other sites posted on this particular server that starts with
104.
That means there's got to be different host clients and stations out there that
are public facing for us to be able to touch.
Now this doesn't include that. That's a whole different can of worms. But what
this does is give us an idea of where we're starting out at.
Now I also want to see if there are any other certificates out there that are
associated with the websites because that'll tell us what other sub domains we
potentially have as well.
And where the root chain goes back to the certificate authority because if
there's an intermediate certificate in there somewhere, it would be able to
tell us where exactly we would start to work.
We would start to look for some of these specific services and also servers in
the network.
And inside of the CRT dot SH readout for www.army.mil. We do get whenever the
certificate ID along with a bunch of the X dot 500 addressing.
In addition, down at the bottom, as I zoom in, some of the sub domains are
children domains of what's actually going on.
So we have soldier for life dot army dot mill, and that's where a lot of us
after we retire or do our first contract or whatever the case may be continued
to go for services like the USO and other things that the army has.
But those are the only ones that are publicly available. So if we hop on over
to our Kelly box here, you can see that one of the first tools that I ran was
DNS reton DNS reton just gives me a basic answer to what DNS records this down
there
against a specified DNS server or name server that I point to. And in this case
, I ran it against 8888 because I didn't want to go to the weeds and get the
actual name servers available.
And you can see here that there's not a lot of records that exist out there,
but there are some host records that would probably be the ones that would run
the Ford facing army dot middle site.
For example, if I go ahead and pop out and highlight for you right quick, you
can see that we have an alias record C name army dot mill, and you can see the
actual server or FQDN that actually goes to with edge key.net.
So there's a lot of directory and address for it in going on in order to get us
pen testers off the track of what's going on.
Now I have specifically left the output of the harvester empty. The reason that
is is because I want you to tell me in the final question of this particular
challenge, how many public facing email addresses that the harvester was able
to come back with for www.army.mil.
And that question will be right below this video. Now the last thing that we
did was do a call for TXT files. And the reason I did TXT is because I
specifically wanted to try and pull through robots.txt from www.army.mil.
And we just used our simple W get through this process and you saw that there
were a lot of files that it went through, but we do have our robots text.
The reason that I wanted to be able to pull this alone is because this actually
gives me a little bit of the directory structure behind the scenes, even though
I can't really touch those directories.
For instance, we already know that there's 123456789.
Yeah, at least nine subdirectories for this particular website that the crawl
is not allowed to go through on.
That's okay, because now that we know that those exist, we can take this
information and on our active reconnaissance and tool usage.
We can start to put things together for us to be able to build out a better
idea of what tool set we need in order to go through and conduct a pen test on
this particular target.
As we continue throughout the course, the theme of passive and active will
always remain the same. And we're really going to hammer home on it when it
comes to scanning.
There are other active and passive methods for the other parts of the pent up
being life cycle, but it's important to remember that it's not always a linear
path that sometimes we have to go back and forth on some of this to get more
information when it's needed.
I hope this has been informative for you and like to thank you for viewing.