Recover Keys – Part 2 – Scanning Devices on the Network

In this Part 2 review of Recover Keys, we will look at how we can scan machines via the network. For most users, I don’t believe this option will be used too often. The average home user that purchase a license for personal use could just uninstall and install the tool on each machine they want to grab license keys off of, or buy a license for multiple machines.

For larger organizations this tool is excellent as it can be installed in one location on a single machine. You also get the ability of being able to extract the license keys via the network, which makes this tool much more efficient and valuable. At the end of the day it is all about saving and making the best use of time.

If you haven’t read Part 1 of using Recover Keys (scanning a local machines) you can check it out here: https://www.stealthbay.com/recover-keys-part-1-scanning-a-local-machine/

Recover Keys – Part 1 – Scanning a Local Machine

Recovering License Keys

I ran into an issue when trying to upgrade a windows 7 PC back in 2019 before Windows 7 went EOL. A decision was made to start a complete fresh install of Windows 10 instead of upgrading from Windows 7 to 10.

However, it came with a caveat that I would have to reinstall many tools all over again. For some of them, I no longer had a stored copy of the license key(s) laying around, or stored digitally any longer. So it got me thinking, if there was a way to recover these license keys.

Now, I could poke around and find the answers combing through the Registry or disk. However, I thought I’d speed things up by using existing tools that get the job done for you.

Nirsoft (a well-known website for recovering all kinds of artifacts from your PC) used to have a free tool that would search the registry for license keys. The tool was called “ProduKey”, and can be found here:https://www.nirsoft.net/utils/product_cd_key_viewer.html

But, upon trying to download the file, it gets redirected to another website called “recover keys” https://recover-keys.com/en/aboutus.html   

Namechk – A Domain Searching & Recon Tool

Namechk –  A Domain Searching & Recon Tool

So I came across a new tool that I found particularly interesting. And, especially for someone that may be working on a pen test during the recon stage. Recon is very important, since it allows you to gather as much intel as possible before you start to look for weaknesses.

What is the tool?

I came across a website called Namechk (https://namechk.com). And, started to realize the power it gives you when conducting recon for particular companies or people. This site basically allows you to search for company names and personal names of people. Now the site isn’t made to conduct recon on anyone or any entity. But, it seems like some cyber security analysts and pen testers are starting to utilize it for recon purposes. And, why not? It’s a tool and various tools can be used for various purposes.

What is its real purpose?

Read The Full Post

Automating NMAP Scans

Automating NMAP Scans

Why do I need automation ?

Security analysts just don’t have the time to always run manual tests. Let’s say I wanted to monitor my ports and services open on my external lab IP address. It is not feasible for me to run a scan at 3am every day for the rest of my life. Therefore, if I had a tool that could automatically run a scan, check to see if anything suspicious is found and can alert me if that is the case would be hugely beneficial. In my case, I have created a method to do this and it is a very simple and straight forward method that virtually any one can use!

How can I create a NMAP scanning server ?

Servers are pretty easy to put up whether it’s a Virtual Image that’s spun up on a bare box, desktop, or in the cloud. In my case a Linux Ubuntu Server was used. It has a firewall and is assigned an external public IP address. It then has the ability to scan my lab network public IP address to be able to identify any open ports/services. It’s a great way to gain some visibility into knowing if any new ports were opened that shouldn’t have been or were missed.

*WARNING* please be sure that the network you are scanning is your own, or that you have WRITTEN PERMISSION to scan the network you desire. Scanning networks where you have no written permission can lead to legal issues, so please be sure you have permission or ownership of a network before doing so.

Read The Full Post

Wappalyzer – Identify technology on websites

Wappalyzer – Identify technology on websites

During one of my SANS vLive courses I am currently taking part in. My instructor introduced us to a nifty tool called Wappalyzer. He said he does use it as “one” of his tools of arsenal for pentesting servers and websites. I decided to take a look for myself since it wasn’t part of our SANS course. And, when you have a SANS instructor discussing a tool they use… well you just can’t go wrong by checking it out for yourself.

Finding technologies on a website

One of the most important aspects of pen testing online is to conduct proper recon. You need information to be able to devise a plan to more forward with the pen test. Information gathering is key and Wappalyzer can definetly help with recon. I decided to use Stealthbay.com as an example to see what type of technologies would show up. (more…)