JW Network Consulting » reconnoiter project http://www.jwnetworkconsulting.com Watching the network so you don't have to. Thu, 22 Jul 2010 01:23:07 +0000 en hourly 1 http://wordpress.org/?v=3.0 Reconnoiter Updated with Metasploit Module http://www.jwnetworkconsulting.com/security/reconnoiter-updated-with-metasploit-module http://www.jwnetworkconsulting.com/security/reconnoiter-updated-with-metasploit-module#comments Tue, 15 Jun 2010 17:04:23 +0000 Jason http://www.jwnetworkconsulting.com/?p=358 Just a quick note today. I finished working on a Metasploit module to create usernames the same way that the other two scripts in Reconnoiter does. However, this module is able to search Yahoo or Google and does not require separate scripts to do so. It also provides the option to use msfweb to get a web interface to run it from and lets you chose whether to dump the output to the console or text files in a directory of your choosing. It has been tested on version 3.4 and 3.3 of Metasploit, so it should be good to go.  You can download it from https://sourceforge.net/projects/reconnoiter/files/.

So far it looks to be working very well.  A big thanks to Robin Wood (digininja), Larry Pesce (haxorthematrix) and Carlos Perez (Carlos_Perez or darkoperator) for their help.  All three were extremely willing to help me add functions, correct bugs and provide advice.

Technorati Tags: , ,

]]> http://www.jwnetworkconsulting.com/security/reconnoiter-updated-with-metasploit-module/feed 0 Reconnoiter featured on Pauldotcom Podcast http://www.jwnetworkconsulting.com/security/reconnoiter-on-pauldotcom-podcast http://www.jwnetworkconsulting.com/security/reconnoiter-on-pauldotcom-podcast#comments Wed, 14 Oct 2009 03:05:34 +0000 Jason http://www.jwnetworkconsulting.com/?p=280 The last week was really busy while I prepared to do my presentation at the Utah Open Source Conference.  While I was engaged in this process I got a message from Larry Pesce of the Pauldotcom Podcast.  He had some updates to Reconnoiter and wanted to shoot them over to me.  He said that he would be doing a tech segment on harvesting usernames via social media and was going to use the script as part of it.  I thought that was quite cool and figured that it would be one of the tools he mentioned.  I checked the show notes after the recording and found that the entire segment was built around Reconnoiter!

One of the things that I really liked about the podcast was that the guys spent some time on how it could be better.  The requests I heard were the following:

  • Configure what format it generates the user names into.  Perhaps you already know the format a client uses and need just want a dictionary.  Why have a bunch of user names that you know are bad.
  • Add some kind of GUI or website.  Good point.  Particularly for the Yahoo version of the script.  That API key is insanely long to put in as a command line argument.
  • Instead of spewing to STDOUT, save it to a file.  Larry has already provided the code for this and implemented it into both scripts.

I’ve been kicking around a couple other ideas, but will need to get some time to implement them.  I’ve also got another script in mind that may or may not help deduce what the user name format for a company might be.  Depends on how the target has their email server configured.  No hacking, just taking note of what the email server tells me.

You can check out the episode at pauldotcom.com.  Thanks guys!

Technorati Tags: , , , ,

]]> http://www.jwnetworkconsulting.com/security/reconnoiter-on-pauldotcom-podcast/feed 0