All language subtitles for 4. Gathering Breached Credentials with Breach-Parse

OK.

So I would like you to go out to get hub dot com and then once you're there.

Go ahead and just do a forward slash H.

Maverick Adams H M A V E R I C K Adams and hit enter and you can see me and my snazzy photo here.

But what we're after is I want to show you a tool that I wrote called Breach pass and we're gonna walk

through what it does.

Now go ahead and click on breach pass and you're going to see a bash script here and a little bit of

a description so you do not need to download this.

Let me preface with what we're doing here.

This magnet link you're going to need one a torrent some sort of you torrent or Bit Torrent and you'll

need to this.

And it's also something along the lines of forty four gigabytes extracted.

It's a huge file so you don't have to do this.

You can just watch and follow along.

You're more than welcome to install this on your machine.

I'm going to show you what it looks like.

So I'm going to go out to my applications and my files here and then I have put this into my opt folder.

So if you come into opt here and I've got breach pass if you come into this breach compilation folder

which is what we'll download you're going to see that we have data here.

OK.

So this data has a bunch of different data.

It's got emails starting with 0 1 2 3 4.

All these different ones what's living inside of this is if we can display it is emails and passwords.

Now you see these ones have weird symbols inside the emails but there's a bunch of emails and passwords

in here like somebody at yahoo dot com and their password is 1 2 3 4 5 6.

Well these passwords are coming from credential dumps.

So we talked about it earlier about thinking about the you know Equifax or the linked in breach or Home

Depot all these big breaches that happen credentials get dumped out.

And guess what they show up on the dark web and eventually they show up in these lists.

So we utilize these lists and we've got you click into this just hundreds of files here and again 44

gigabytes.

So all I did was I built a little tool that can search through this data and pull down names so you

can take a quick look at the tool and what it does.

But basically what it does is you just put in the syntax you search for something like at Tesla dot

com and then you specify you know Tesla dot text and it's going to search through all of these files

for at Tesla dot com.

If you're more interested in the code behind it you're more than welcome to read the code in here and

see if some of the items that we've covered already with the batch scripting and the python scripting

kind of ring a bell.

So what we're gonna do is I'm going to come ahead and go into the terminal and make it a little bigger.

And then I'm just going to change into that folder breach pass and I'm going to run breach pass so reach

pass here.

And what we're gonna do is I'm just going to say at Tesla dot com and then Tesla dot text and that's

going to run.

So again you do not have to install this.

This is only for visual purposes.

I'm going to show you in the next video.

Another way to do this.

So this is going to run through it's going to take a minute here and it's going to grab everybody's

username and password that says Tesla dot com and the user name and then it's going to have all the

passwords and we're gonna be able to decipher things from this.

So I'm going to let this run and as soon as it's done I'll come back and we'll talk about the results.

OK.

The results are back.

So this breaks it down into three files.

There is a cat Tesla.

There is a master passwords and user.

So the master has the username and password and then the users file has the user's passwords has the

passwords.

So I'm actually get it.

The Tesla master dot text.

And let's take a look at this so from here we don't have a big list.

Surprisingly for a company the size of Tesla.

So what happens is people utilize their work credentials or their work e-mails and they log into Web

sites and probably shouldn't be using their work e-mails for.

And we just use it to our advantage.

So we're after is we're after not only these user names we're after these passwords as well.

So we see these user names and we see these passwords.

And I like to look for repeat offenders.

I like to look for the syntax as well.

Remember we had first initial last name but we see first name dot Last Name Here we see possibly you

know just a single name.

There are different types of things in here.

So Nick at Tesla dot com as well.

So you know it's changed up I think nowadays it is first initial last name but maybe in the past they

use first name dot last name then moved to an easier format or vice versa.

They started the first initial last name they got too big then they had to do first name dot last name.

But again what we're after here is potential repeat offenders.

So look at the shark at Tesla dot com.

It got popped twice and the password is very very very similar.

So if I were to attack Tesla dot com through a logging interface I might spray this username with this

password in this password.

That's what we call a credential stuffing because we already know the passwords.

And then I might make some modification of capitalized letters and non capitalized letters with DADT

because 9 0 7 and 8 1 4 appear to be consistent you know.

So I would alternate capitals in non capitals here in lowercase and just see maybe if something sticks.

So this is something that's interesting this user down here one two three four five One two three four

five star.

Probably not going to get in with that on a company like Tesla but you never know.

But this is what we would do we would take the user names we throw these passwords at it and that's

called credential stuffing and then we would take these user names and all the known user names and

we would spray passwords at them like fall 20 19 like we talked about last video.

That's password spraying.

So this is a important and very very critical part of information gathering is gathering these usernames

and these credentials right off the bat you want to identify those with your targets.

So this is kind of what it looks like.

This is what I do during every assessment.

And hopefully that makes sense and that works into it in the next video.

We're going to go ahead and just show another method and start thinking again about these credentials

and how they can be utilized.

And then we'll do some other information gathering as you move on and learn some techniques and how

we can get information on a client.

So I'll see you over in the next video.