The Role of Non Obvious Relationships in the Foot Printi.ppt

The Role of Non Obvious Relationships in the Foot Printing Process Roelof Temmingh Charl van der Walt SensePost Black Hat Europe Amsterdam, the Netherlands2 2003/05 Schedule Introduction Why are we excited about foot printing? The bigger picture Footprint methodology BiLE friends Vet-IPRange Vet-MX Vet-whois Exp-whois Exp-TLD Vet-TLD Introduction SensePost The speaker Objective of presentation Why are we excited about foot printing? (it seems boring) As a security officer Know your perimeter Pressures from business As cyber criminal Firewalls frenzy/patches plenty Finding the one box, not the one bug As cyber terrorist “He pressed the button” Automated targeting the bigger picture Foot printing is the very first phase Foot printing methodology Part I Expand / Reduce / Expand / Reduce Foot printing methodology Part II DNS and ICMP Expanding domains The challenge With no prior knowledge, how do we link B with D?? The thinking If you surf around enough you’ll find all relationships. Practically Find links from the site Find link to the site Technically Mirror site – extract links and mailto (from) Parse Google’s “link” output - who links to site (to) Repeat for 2nd degree Expanding domains BiLE (Bi directional link extractor) How to use: perl BiLE.pl [website] [output file] [website] is a website name e.g. “” [output file] is where the results go? Output: Creates a file named [output file] Output format: Source_site:Destination_site Typical output: : : : : : : Expanding domains The thinking I can’t control who links to me, I control where I link to If you have one link and it’s to me, I have to be important to you If I link only to you I must consider you as important If we link to each other we must be friends Practically Algorithms Math Technically Start with a seed value, compute nodes around it Repeat for 2nd degree Expanding domains Expanding domains Part IExpanding domains Expanding domains BiLE-weigh Ho