In this section of the course,
we're going to discuss Open-Source Intelligence,
or OSINT for short.
OSINT is publicly available information
that we use to gather insights about our target
in a penetration testing scenario.
This is important because it includes finding out
who works where, what the company structure looks like,
and spotting any unhappy employees
who might share sensitive details.
By understanding these findings,
testers can better spot security weaknesses
and plan their approach,
making OSINT a key tool in their toolkit.
Our focus in this section
will be centered around the Domain 2,
Reconnaissance and Enumeration.
We'll be keying in on Objectives 2.1,
which states that given a scenario,
we should be able to apply information gathering techniques.
Again, it involves using information
that's freely available to anyone,
but doing so in a way that's strategic
and focuses on uncovering vulnerabilities
or valuable data about a target.
This can range from details
about the company's infrastructure
to personal information about its employees
that can be used in social engineering attacks.
We'll start by looking at how social media
and job boards can be a treasure trove of information.
Companies often share more online than they realize
from technical details about their IT environments
to upcoming projects that can reveal any new technologies
that they plan on implementing.
Next, we'll discuss information disclosures.
These are instances
where sensitive information is accidentally exposed online,
perhaps in a misconfigured server
or through careless sharing of documents.
Identifying these can give us critical insights
into the target's weaknesses.
Cryptographic flaws will be next on our list.
We'll learn how weaknesses in encryption
can be spotted through OSINT technologies,
offering a backdoor to supposedly secure communication.
DNS lookups will be another key focus in this area.
By examining how a company's domain names
are structured and managed,
we can uncover aspects of their internal network structure
and potentially find any entry points
that aren't as well-guarded as they should be.
We'll also dive into certificate transparency logs.
These are public records of SSL certificates
issued for domains.
By analyzing these logs, we can discover subdomains
that were not meant to be public,
giving us more pieces to the puzzle.
Next, we'll talk about search engine analysis
which will show us how to use search engines
not just to find information,
but how to find the right information.
There's a wealth of data out there,
and knowing how to search effectively
can dramatically speed up the OSINT process.
And to bring it all to life,
we'll be conducting a demo of conducting a form of OSINT.
This hands-on example will help solidify your understanding
of the concepts we discussed
and show you how to apply them in a real-world setting.
Finally, we'll take a short quiz to see
what you learned during this section of the course,
and review each of those quiz questions to fully ensure
that you can explain why each answer was right.
So, if you're ready, let's dive into our lessons
focused on Open-Source Intelligence.