La nueva FOCA 2.7

2.7.1 version
Chema Alonso

FOCA 0.X

MetadataRisks
“Secret” relationships
Government & companies
Companies & providers
Piracy
Reputation
Social engineering attacks
Targeting Malware

FOCA: File types supported
Office documents:
Open Office documents.
MS Office documents.
PDF Documents.
XMP.
EPS Documents.
Graphic documents.
EXIF.
XMP.
Adobe Indesign, SVG, SVGZ

What can be found?
Users:
Creators.
Modifiers .
Users in paths.
C:Documents and settingsjfoomyfile
/home/johnnyf
Operating systems.
Printers.
Local and remote.
Paths.
Local and remote.
Network info.
Shared Printers.
Shared Folders.
ACLS.
Internal Servers.
NetBIOS Name.
Domain Name.
IP Address.
Database structures.
Table names.
Colum names.
Devices info.
Mobiles.
Photo cameras.
Private Info.
Personal data.
History of use.
Software versions.

Sample: FBI.gov
Total: 4841 files

FOCA 1 v. RC3
Fingerprinting Organizations with Collected Archives
Search for documents in Google and Bing
Automatic file downloading
Capable of extracting Metadata, hidden info and lost data
Cluster information
Analyzes the info to fingerprint the network.

Howmaydaysto do thepentesting?

Sometimes…a pentesterneedsto be a SuperHero

FOCA 2.5
Network Discovery
Recursivealgorithm
InformationGathering
SwRecognition
DNS Cache Snooping
ReportingTool

DNS Search Panel

Network DiscoveryAlgorithm
http://apple1.sub.domain.com/~chema/dir/fil.doc
http -> Web server
GET Banner HTTP
domain.com is a domain
Search NS, MX, SPF records for domain.com
sub.domain.com is a subdomain
Search NS, MX, SPF records for sub.domain.com
Try allthe non verified servers onall new domains
server01.domain.com
server01.sub.domain.com
Apple1.sub.domain.com is a hostname
Try DNS Prediction (apple1) onalldomains
Try Google Sets(apple1) onalldomains

11) Resolve IP Address
12) GetCertificate in https://IP
13) Searchfordomainnames in it
14) Get HTTP Banner of http://IP
15) Use Bing Ip:IPtofindalldomainssharingit
16) Repeatforevery new domain
17) Connecttotheinternal NS (1 orall)
18) Perform a PTR Scansearchingforinternal servers
19) Forevery new IP discovered try Bing IP recursively
20) ~chema-> chemaisprobably a user

21) / , /~chema/ and /~chema/dir/ are paths
22) Try directorylisting in allthepaths
23) Searchfor PUT, DELETE, TRACE methods in everypath
24) Fingerprint software from 404 error messages
25) Fingerprint software fromapplication error messages
26) Try commonnamesonalldomains (dictionary)
27) Try Zone Transfer onall NS
28) Searchforany URL indexedby web enginesrelatedtothehostname
29) Downloadthe file
30) Extractthemetadata, hiddeninfo and lost data
31) Sortallthisinformationand presentitnicely
32) Forevery new IP/URL startoveragain

FOCA 2.5: Exalead

Hugedomains case

Digital Certificates

FOCA 2.5 & Shodan

FOCA 2.5 URL Analysis

.listing

Unsecure Http Methods

Search & Upload

Searchingfor Server-Side Technologies

Fuzzingoptions

DNS Cache Snooping

FOCA Reporting Module

What’s new
In 2.7.1

RDP & ICA Files Analysis

SquidProxies

DNS Records

NetrangeScan

ParametrizedURLs

Easy Bugs search

TaskList

Plugins

FearThe FOCA

IIS MetaShield Protector
http://www.metashieldprotector.com

Buy a FOCA T-Shirt
And be «Sexy» }:))

Questions?
Chema Alonso
chema@informatica64.com
http://www.informatica64.com
http://www.elladodelmal.com
http://twitter.com/chemaalonso
http://www.forefront-es.com
http://www.seguridadapple.com
http://www.windowstecnico.com
http://www.puntocompartido.com
Workingon FOCA:
Chema Alonso
Alejandro Martín
Francisco Oca
Manuel Fernández «The Sur»
Daniel Romero
Enrique Rando
Pedro Laguna
SpecialThanksto: John Matherly [Shodan]

La nueva FOCA 2.7

by Eventos Creativos on Jul 14, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

Statistics

La nueva FOCA 2.7 — Presentation Transcript