Original subtitles

So with this cause I want to take a very realistic approach.

There are a lot of other courses out there especially even certification courses that feel like a tool

regurgitation and it's about as many tools as you can utilize in most of them you'll never use again

in your career.

And I don't want that to be this cause I want you to step away from this course and you to have a realistic

approach and a realistic methodology when it comes to doing what you do as a penetration tester.

My approach when I first start is looking up items on websites regarding to users email format and breach

credentials.

And we're going to go down that path and then we'll start talking about other items of O.S. but this

is the first place that I target.

So we're going to start off first with a tool called Hunter dot I O.

And I want you to just go out to Hunter Io you're going to see a sign up in the upper right hand corner.

Go ahead and sign up.

It does require a valid email address.

Sign up get logged in and then meet me back at the video.

Go ahead posit and then resume the video when you're ready.

And then my machine's falling asleep so I'll see you when you get back.

OK so now you're logged in.

Your screen should look something like mine.

Hundred I O is a domain search where we can do is we can type in something like Tesla dot com and you

can see here it starts to bring up Tesla dot com.

It's got four hundred and fifty three results.

Let's go ahead and just click on this.

Now with the free plan that we are on we get something like 20 searches a month so please be careful

to not abuse the search feature and make sure you're searching for what you want.

Why do I use this.

Well it tells me some interesting things.

One it gives me a list of people in the organization.

I get the first name last name.

I get a first initial last name format here and it tells me the most common pattern with her email addresses

and we'll talk about why that's important in a second so I get up to four hundred fifty three results

here I get to export NACA yes V.F. I want I can take these emails all of these and I have a lot of information

right off the bat and this is all free to me and it even tells me where they got these resources from.

They're looking online and they're digging it up like they're finding it and farms and other Web sites.

This one's on the forms as well.

So all these different email addresses.

Very very good for us.

Sometimes they even have departments in here you can click on them and look human resources or I mean

engineering depending where they work like I might be interested in and who works at I.T. engineering

obviously not Nikola Tesla.

That's not true.

OK.

We've got a senior technical product manager we've got a staff software engineer.

That's good.

But you know maybe somebody like on the help desk might be really good to target or to have you know

knowledge of.

But this is a good way to just see who works where what their e-mail format is and how many names we

can pull down now Tesla is a big company which could potentially work into our favor depending on their

security.

Now we're going to be talking about tasks called Passwords spraying and credential stuffing as methods

of exploitation.

We're going to get into that when we get into the actual scanning enumeration and exploitation phase

and what it is and what we're after is being able to grab a valid list of names so we can gather here

for four hundred and fifty three usernames.

That's great.

But on top of this that's probably not everybody that works there.

So maybe we go out to LinkedIn and we see Bob Jones works there.

So we know OK.

His email address is probably B.

Jones and then you see somebody like Richard Jones.

So you probably could assume his is our Jones at Tesla dot com.

Knowing this First Name Last Name format or how they structure their email is super important for later

on when we perform attacks say we have a log in form and we have that log in form we want to log into

it if we know the format of the email address we can send a bunch of valid email addresses to it as

a user name and then we can do something like password spraying which is where we just take commonly

used passwords like right now.

It is November of 2019 we could say fall 20 19 Exclamation Point Fire that with every single email address

that we find in hopefully one sticks and that's the idea behind password spraying.

So this information here that we can gather is absolutely important.

So I'm going to show you a couple more methods on how to gather this sort of information and how we

can start to become malicious with the information that we gather and why this is all important.

So I'll meet you over in the next video when we start talking more in-depth about user name enumeration

through breach credentials.