Save Eyewitness Default with airSlate SignNow

Add eyewitness text

[Music] hi everybody and welcome to another episode of ten minute tips with me Micah Hoffman from the ocean curious project right now we're gonna look at a way of automating viewing a bunch of different websites now when we are doing our open source intelligence many times we will have a list of URLs maybe you've done some username enumeration and you need to visit instagram.com slash username twitter.com slash username facebook.com slash username and you could do it in a browser it might take a long time depending on how many URLs you have so what we can do is use some pretty cool tools that are out there and free to do this work for us in a rapid fashion today I want to introduce you to a really really great tool that I love it's called eyewitness and it's made by a man named Chris trencher Chris has been contributing to the cyber curtain security community for many many years as a terrific person he has his repository here on github at 40 north security slash eyewitness now I've already gone ahead and taken this content here downloaded it to my computer and installed it well I always get choked up when I deal with eyewitness huh so if you've never done this before I'm gonna do another session on how to go ahead and download and get stuff from git but in essentially if we scroll down here on the page usually the author's will show you how to actually install their tool here setup navigate to the setup directory and run the setup Sh script alright it's pretty um pretty high-level there I've gone ahead and done this for us and then what we can do is specify a file name with URLs in it and for his tool to go out and visit it from the web so let's go ahead and take a look at this like I said done the work here this is what I witness looks like in the terminal and I have a file called URLs with HTTPS Osen curious DuckDuckGo and oesn't framework comm just as test sites for us to run through so let's say that you had twitter.com slash whatever instagram.com slash whatever you just put them in a file and then we point I witness to it so the way we do it is we do eyewitness we have to tell it that we wanted to do web searches and that we have a certain file now in my case I have that URL file you have a lot of other options to use we can switch user agents using eyewitness so that eyewitness will check out the website and see if it changes via an iPhone or mobile device versus something that's a desktop or a Google bot there's also other things for increasing the amount of wait time in case you have a site that's really slow or your Internet's a little slow in my case this worked really really quickly with these three sites and I witnessed as completed you can see on the screen right here it says done report written to this location and eyewitness saves it in the current directory by default and it specifies it month/day/year and then the time in hours minutes seconds when you ran the report so if i reran this report in another second or five seconds or a minute it'll have a different location on the file system and you can go ahead and compare the two reports now I always like to do the yes here so I'm going to say yes I do want to open the report and what the tool will do is open the report in Firefox or your default browser which is in my case is Firefox and for our purposes and we're going to go ahead and take a look at what was retrieved here is a picture of what DuckDuckGo looked like when the eyewitness script went out and looked at it and over here on the left hand side we see the request was for cocom which was at this IP address and then this content here on the left that's all header information that gets sent to and from the server with the request so if there's any cookies that are set here if there are other things like content security policies or csps or cross-site scripting protection you'll see that here zosyn framework now Osen framework there's JavaScript down here that didn't show up because I witnessed and doesn't necessarily execute that JavaScript but we can see a little bit about what the page would look like here again we have the header information now for the O's and curious we need to go to page two and here we have the ocean curious website and here's the request and you can see that we do have that header information well that's pretty cool and since we have a bunch of time left I'm hoping you're okay with going back to a previous ten minute tip we actually did something on another ten minute tip with DNS twister this is that tool or that website that you can use to look for typos squating domains so if I have google.com is my target domain what DNS twister will do is it will look for google.com and Google with three o's and a whole bunch of different variations to see who has gone ahead and registered those other domains now sometimes those domains are actually malicious maybe they're hurting trying to trick people and sometimes they're not well if we look here I've run this on sans or the sans Institute's website or domain and we see that we have a whole bunch of entries that have come back sans a sans C sans e and then even down here we have SAS org SAFS and each one of these could be a phishing site somebody that's setting it up to try to trick sanz's users well let's go ahead and export this which we didn't do in the last video we're going to export this to CSV now you can do this two ways in this case I have lube unto and I can open this directly in LibreOffice calc then strip out the column with the URLs that I want I'm gonna go ahead and do some command line kung-fu and save this file so let's let's leave that eyewitness directory here we're gonna open a new tab I'm going to CD over to downloads here's that DNS twister report I'm just gonna look at the head of it and so it's in this format right here sans org the original Sansa org edition Sansa org and what we can see is any ones that didn't resolve that weren't actually a valid domain or didn't have a IP address associated with them have this false false so let's go ahead and do a grep - b say find all the records that do not have false false from that file there we go alright so let's take it one step further let's use our friend cut to cut out just one column worth of information we only want this column right here that is the let's see one two three the third column in this thing so let's take this pipe that to cut field three tell it at delimiter of comma and there we have our domains that we can test now we need to take these domains and put them into our a file so let's go ahead and output them to oh we'll just leave them here sans URLs now it's very important to remove any other crud in here like tweak that's not going to work let's see if all of these are actual domains to do yep they are does save that alright so now we have in the Downloads folder sans URLs let's go back over here we're just going to up arrow instead of F colon we're going to do downloads sans URLs and tell it to go now 60 hosts here I witness like I said has a bunch of different options for choosing how many threads you can request or how many processes you can request at the same time also with things like timeouts we can increase that from the default or decrease it as well so I'm going to go ahead and use the magic of video editing here to speed this part up [Music] and now we finished that took about two minutes let's go ahead and check out the report now this is going to be a pretty long report because we've got about 60 hosts again if I wanted to fix some of these issues that I had here where we hit these timeout limits then I can do an eye witness and if you see this there's a number of threads there's increasing the timeouts the timeout right now is set to 7 seconds which is not a lot of time especially with a slow website but let's take a look at some of these now your service unavailable on SAN org here's s dot ans dot org know if some of you were going to be concerned that we're hacking or whatever we're not we're visiting these websites with a script instead of a web browser so there's no hacking that's going on here this is all totally legit here we have ans Sansa and you can see that it's so much easier for me to just scroll down this page and look at these screenshots and look at the cookies and other things over here then to go ahead and visit each one of these in in a web browser now some of these are the the screen shots are going to look something like this we can click on them and zoom in to see all of the kind of content that's on the website well that's all the time I have today so I'd like to say thanks for watching I'm Micah Hoffman Stadio San curious