Java au lait, por favor?

A thunk hit me this morning when I realised that Java is slowly entrenching itself into a lot of things we do at SensePost. Now, the lads have been known to churn out little snippets of brilliance over the years - you know - Wikto, Suru, reDuh etc - and lately the conversion of these tools to Java.

Apart from Yeti, we have jCertChecker (SSL miner) as well as J-Baah (the Java port of the Crowbar http fuzzer) and reDuh. Incidentally, the writer of J-Baah, Mr Ian de Villiers, has been confirmed as a trainer on the SensePost HBN - Combat Edition, at Black Hat Barcelona. It's a tough course, but it's worth it.

And last, but not least, ./w just pumped me in the ribs to say the Java port of Scully, an MSSQL/MySQL client interface, should be out in the week.

So, as you can see, lots of cross platform love. :-)

Enjoy, and play nice.

Why network footprinting?

Since our initial release of Yeti (once again, thank you for all the support thus far) we have had a number of suggestions, bug reports and critiques from keen users, all of this is greatly appreciated by the team at SensePost.

A number of you have asked us "why bother?, why bother writing yet another network footprinting tool?"

This is a great question, especially in an industry where numerous tools exist that do the same job.

We believe in the necessity to have good, solid Internet intelligence gatherers is on the increase. For small companies, such as a mom and pop shop, the requirement is much less than a multinational company with presence all over the Internet.

Cloud computing is compounding this necessity. Developers are embracing the instant availability of uncountable cycles of processing and storage, to serve up hot gourmet applications and services. But how much of this is officially sanctioned and comply with company security policies?

This is a question we often get asked by risk managers, and with Yeti we can give them solid answers. In short, many companies don't understand what they have out there on the Internet.

An example of this was when recently, we performed a footprinting exercise for a client, that focused heavily on the WHOIS data. We broke the results down into its most granular form, even focusing on the registrant and registrar data. This particular client then picked up that a rogue business unit was operating outside of senior management control and knowledge and leveraging off the parent company's name and brand.

This was picked up through the registrant email being different from the rest. Small detail but increasingly significant.

Secondly, we at SensePost believe in the most effective way of performing a task. Sure, you can do what Yeti achieves using command line techniques, but let's be honest here and admit this process is tedious and laborious. One shouldn't struggle in getting the data - one should rather put effort into analysing the results and applying them to the problem at hand.

Remember, technology scales - people don't. There is no shame in making use of technology to do manual labour.

Thirdly, at SensePost, the necessity was also driven by a depreciated Bidiblah. The 'Blah' was the flagship tool for fingerprinting for many years and, at the time, ahead in its class. But recently it has had problems walking up stairs and we now feel it's time for it to spend long days playing cards in a retirement home.

A question that hasn't been asked of us yet is: "Why should we follow the blog?, I don't care about your product!". Simply put, we will be using this blog to keep you updated about all aspects of Yeti's development, techniques that can be used and any other interesting tips we think you'd enjoy knowing about. Several of the techniques used in Yeti consist of rudimentary command line driven derivatives and these techniques will be discussed at a future date.

So there you have it, our approach at SensePost to footprinting is now available as a tool for the community.

Happy digging.

New tutorial added...

Added a tutorial on "Domain Expansion". Please read it, and let me know what you think, both of the tutorial as well as Yeti's functionality.

./w

progress report...

Hi, like Evert said, some gremlins did creep in, in the last release. Sorry about that.

I've spend some time now to try and sort out as many issues as possible, but for now here is a list of some of the changes what was made:

1. Improved forward lookups, it should be noticeably faster now
2. I've you click the view button on the job progress panel, it will switch tabs for you now
3. "Clear" button on the result screen is fixed
4. "Check all" checkbox is also fixed now
5. You can now save your footprints as SQLite db files and reopen them

there were also tons of little fixes that I'm not going to mention here.
From the next release on Monday 7th, '11 I will start including proper release notes with a detailed description of changes that was made.

Hope you are having fun so far.

./w

The joys of putting it out there

So, thanks to Blogspot's "would you like Google to index this site automagically" we have had a couple of hits on the site. And a couple of downloads. And with that a couple of suggestions. Several of them were about the ForwardLookup module that seems to be flaky.

Embarrassing yes but this is the nature of everyday software development. The only difference is that on the Internet, the issues can be highlighted so much quicker.

But never fear, ./w is on it - I am hearing mutterings about netbeans and the such but a good carpenter never criticizes his tools :). We will blog when a fix is available.

Happy digging.

And another thing ...

Added the link to the BING API key download site, to the "Getting Started" page. You really would want to add this to your Yeti configuration.

Comments open to all!!

Changed the settings so that Anonymous Comments are now allowed


./w