Backtrack 4: Information Gathering: Search Engine: Goorecon – Find emails and subdomains using Google

During the Information Gathering section of a pentest, we are interested in finding out the various sub-domains of our target domain. In the past few tutorials we queried DNS servers using zone transfer requests or trying to retrieve entries using a dictionary & brute-forcing attacks. Another technique to figure out sub-domains is to query google and check if it has found any sub-domains during it’s web mining exercise on the target. Goorecon can do this. Goorecon was written by Carlos (Darkoperator) Perez.

I did have to fix the Goorecon in Backtrack 4 and I will be fixing the package today as well but if you have a issue with the email part not working you will need this fix which was posted by Steve Goldsby on his blog.

Here is the excerpt of the fix from his blog:
Goorecon recently broken when querying for email addresses (e.g. ruby goorecon.rb -e icsinc.com). Sometime between when goorecon was written and now, google changed their formatting of reposnses for email addresses from:

emailaddress@
icsinc.com to emailaddress@icsinc.com

Easy fix is to change the following line in goorecon.rb

response.scan(/[\w.-]+@#{target}/o) { |t|
to
response.scan(/[\w.-]+@<[^>]+>#{target}/o) { |t|

This will keep the code flexible enough so that if google ever changes the highlighting tag (formerly but now ) to some other html tag, goorecon will still correctly draw out emaill addresses.

The syntax of Goorecon is very simple. Lets have a look at the options:

bash

1. root@666:/pentest/enumeration/goorecon# ./goorecon.rb
2.  
3. Goorecon .01
4. By Carlos Perez
5. Email: carlos_perez@darkoperator.com
6.  
7. This is a simple tool writen for subdomain enumeration and email gathering
8. during authorized penetration test engaments using Google.
9. USAGE:
10. ruby goorecon.rb &lt;type&gt; &lt;target&gt;
11. TYPES:
12.  
13. -s        Subdomoin Enumeration
14. -e        Email gathering

As you can see there are really only 2 options. One is to look for sub domains and the other is to look for emails.

Here is a example of using the tool to gather sub domains:

bash

1. root@666:/pentest/enumeration/goorecon# ./goorecon.rb -s cnn.com
2. www.cnn.com,157.166.255.19
3. www.cnn.com,157.166.255.18
4. www.cnn.com,157.166.226.26
5. www.cnn.com,157.166.226.25
6. www.cnn.com,157.166.224.26
7. www.cnn.com,157.166.224.25
8. edition.cnn.com,157.166.226.45
9. edition.cnn.com,157.166.226.46
10. edition.cnn.com,157.166.255.31
11. edition.cnn.com,157.166.255.32
12. marquee.blogs.cnn.com,74.200.247.187
13. marquee.blogs.cnn.com,76.74.255.117
14. marquee.blogs.cnn.com,76.74.255.123
15. marquee.blogs.cnn.com,72.233.104.123
16. marquee.blogs.cnn.com,72.233.127.217
17. marquee.blogs.cnn.com,74.200.247.59
18. archives.cnn.com,157.166.224.110
19. archives.cnn.com,157.166.226.110
20. newsroom.blogs.cnn.com,72.233.104.123
21. newsroom.blogs.cnn.com,72.233.127.217
22. newsroom.blogs.cnn.com,74.200.247.59
23. newsroom.blogs.cnn.com,74.200.247.187
24. newsroom.blogs.cnn.com,76.74.255.117
25. newsroom.blogs.cnn.com,76.74.255.123
26. money.cnn.com,157.166.226.108
27. money.cnn.com,157.166.226.109
28. money.cnn.com,157.166.255.24
29. money.cnn.com,157.166.255.25
30. money.cnn.com,157.166.224.108
31. money.cnn.com,157.166.224.109
32. campbellbrown.blogs.cnn.com,72.233.127.217
33. campbellbrown.blogs.cnn.com,74.200.247.59
34. campbellbrown.blogs.cnn.com,74.200.247.187
35. campbellbrown.blogs.cnn.com,76.74.255.117
36. campbellbrown.blogs.cnn.com,76.74.255.123
37. campbellbrown.blogs.cnn.com,72.233.104.123
38. us.cnn.com,157.166.255.19
39. us.cnn.com,157.166.224.25
40. us.cnn.com,157.166.224.26
41. us.cnn.com,157.166.226.25
42. us.cnn.com,157.166.226.26
43. us.cnn.com,157.166.255.18
44. politicalticker.blogs.cnn.com,76.74.255.123
45. politicalticker.blogs.cnn.com,72.233.104.123
46. politicalticker.blogs.cnn.com,72.233.127.217
47. politicalticker.blogs.cnn.com,74.200.247.59
48. politicalticker.blogs.cnn.com,74.200.247.187
49. politicalticker.blogs.cnn.com,76.74.255.117
50. www.studentnews.cnn.com,157.166.226.112
51. www.studentnews.cnn.com,157.166.224.112
52. tech.fortune.cnn.com,72.233.69.6
53. tech.fortune.cnn.com,74.200.243.251
54. tech.fortune.cnn.com,74.200.244.59
55. tech.fortune.cnn.com,76.74.254.120
56. tech.fortune.cnn.com,76.74.254.123
57. tech.fortune.cnn.com,72.233.2.58
58. transcripts.cnn.com,157.166.226.110
59. transcripts.cnn.com,157.166.224.110
60. joybehar.blogs.cnn.com,72.233.104.123
61. joybehar.blogs.cnn.com,72.233.127.217
62. joybehar.blogs.cnn.com,74.200.247.59
63. joybehar.blogs.cnn.com,74.200.247.187
64. joybehar.blogs.cnn.com,76.74.255.117
65. joybehar.blogs.cnn.com,76.74.255.123
66. pagingdrgupta.blogs.cnn.com,72.233.127.217
67. pagingdrgupta.blogs.cnn.com,74.200.247.59
68. pagingdrgupta.blogs.cnn.com,74.200.247.187
69. pagingdrgupta.blogs.cnn.com,76.74.255.117
70. pagingdrgupta.blogs.cnn.com,76.74.255.123
71. pagingdrgupta.blogs.cnn.com,72.233.104.123
72. ricksanchez.blogs.cnn.com,72.233.104.123
73. ricksanchez.blogs.cnn.com,72.233.127.217
74. ricksanchez.blogs.cnn.com,74.200.247.59
75. ricksanchez.blogs.cnn.com,74.200.247.187
76. ricksanchez.blogs.cnn.com,76.74.255.117
77. ricksanchez.blogs.cnn.com,76.74.255.123
78. sportsillustrated.cnn.com,157.166.224.105
79. sportsillustrated.cnn.com,157.166.226.104
80. sportsillustrated.cnn.com,157.166.226.105
81. sportsillustrated.cnn.com,157.166.255.22
82. sportsillustrated.cnn.com,157.166.255.23
83. sportsillustrated.cnn.com,157.166.224.104
84. insession.blogs.cnn.com,76.74.255.117
85. insession.blogs.cnn.com,76.74.255.123
86. insession.blogs.cnn.com,72.233.104.123
87. insession.blogs.cnn.com,72.233.127.217
88. insession.blogs.cnn.com,74.200.247.59
89. insession.blogs.cnn.com,74.200.247.187
90. behindthescenes.blogs.cnn.com,76.74.255.123
91. behindthescenes.blogs.cnn.com,72.233.104.123
92. behindthescenes.blogs.cnn.com,72.233.127.217
93. behindthescenes.blogs.cnn.com,74.200.247.59
94. behindthescenes.blogs.cnn.com,74.200.247.187
95. behindthescenes.blogs.cnn.com,76.74.255.117
96. newspulse.cnn.com,157.166.226.32
97. newspulse.cnn.com,157.166.224.31
98. newspulse.cnn.com,157.166.224.32
99. newspulse.cnn.com,157.166.226.31
100. tips.blogs.cnn.com,76.74.255.117
101. tips.blogs.cnn.com,76.74.255.123
102. tips.blogs.cnn.com,72.233.104.123
103. tips.blogs.cnn.com,72.233.127.217
104. tips.blogs.cnn.com,74.200.247.59
105. tips.blogs.cnn.com,74.200.247.187
106. afghanistan.blogs.cnn.com,74.200.247.187
107. afghanistan.blogs.cnn.com,76.74.255.117
108. afghanistan.blogs.cnn.com,76.74.255.123
109. afghanistan.blogs.cnn.com,72.233.104.123
110. afghanistan.blogs.cnn.com,72.233.127.217
111. afghanistan.blogs.cnn.com,74.200.247.59
112. weather.cnn.com,157.166.224.118
113. weather.cnn.com,157.166.226.117
114. weather.cnn.com,157.166.224.117
115. news.blogs.cnn.com,72.233.69.6
116. news.blogs.cnn.com,74.200.243.251
117. news.blogs.cnn.com,74.200.244.59
118. news.blogs.cnn.com,76.74.254.120
119. news.blogs.cnn.com,76.74.254.123
120. news.blogs.cnn.com,72.233.2.58
121. weather.edition.cnn.com,157.166.224.118
122. weather.edition.cnn.com,157.166.226.117
123. weather.edition.cnn.com,157.166.224.117
124. inthefield.blogs.cnn.com,76.74.255.123
125. inthefield.blogs.cnn.com,72.233.104.123
126. inthefield.blogs.cnn.com,72.233.127.217
127. inthefield.blogs.cnn.com,74.200.247.59
128. inthefield.blogs.cnn.com,74.200.247.187
129. inthefield.blogs.cnn.com,76.74.255.117
130. cgi.money.cnn.com,157.166.224.12
131. scitech.blogs.cnn.com,74.200.247.187
132. scitech.blogs.cnn.com,76.74.255.117
133. scitech.blogs.cnn.com,76.74.255.123
134. scitech.blogs.cnn.com,72.233.104.123
135. scitech.blogs.cnn.com,72.233.127.217
136. scitech.blogs.cnn.com,74.200.247.59
137. mxp.blogs.cnn.com,74.200.247.59
138. mxp.blogs.cnn.com,74.200.247.187
139. mxp.blogs.cnn.com,76.74.255.117
140. mxp.blogs.cnn.com,76.74.255.123
141. mxp.blogs.cnn.com,72.233.104.123
142. mxp.blogs.cnn.com,72.233.127.217

And here is a example of using Goorecon to grab email address’s:

bash

1. root@666:/pentest/enumeration/goorecon# ./goorecon.rb -e louisville.edu
2. itstore@emlouisville.edu
3. onnie.dean@emlouisville.edu
4. john.drees@emlouisville.edu
5. a0pere03@emlouisville.edu
6. nmschu03@emlouisville.edu
7. aceldr01@emlouisville.edu
8. mcconnell@emlouisville.edu
9. helpdesk@emlouisville.edu
10. rachel.neal@emlouisville.edu
11. lgt@emlouisville.edu
12. charlie.rown@emlouisville.edu
13. yani.vozos@emlouisville.edu
14. lackfamilyconference@emlouisville.edu
15. commence@emlouisville.edu
16. asela01@emlouisville.edu
17. charlie.moyer@emlouisville.edu
18. susmita.datta@emlouisville.edu
19. lcdosk01@emlouisville.edu
20. tjgray01@emlouisville.edu
21. w0song03@emlouisville.edu
22. scdesa01@emlouisville.edu
23. s0kona01@emlouisville.edu
24. naolt01@emlouisville.edu
25. rhondauchanan@emlouisville.edu
26. ewa@emlouisville.edu
27. cultural@emlouisville.edu
28. advocate@emlouisville.edu
29. finaid@emlouisville.edu
30. chenxi.wang@emlouisville.edu
31. karen.kopelson@emlouisville.edu
32. k.haee@emlouisville.edu
33. a.thompson@emlouisville.edu
34. alhowa04@emlouisville.edu
35. rowell@emlouisville.edu
36. gradadm@emlouisville.edu
37. nw.aker@emlouisville.edu
38. scott.campell@emlouisville.edu
39. kielkopf@emlouisville.edu
40. timive01@emlouisville.edu
41. glynis.ridley@emlouisville.edu
42. laeric02@emlouisville.edu
43. peter.yoo@emlouisville.edu
44. guy.rock@emlouisville.edu
45. ulprint@emlouisville.edu
46. roger.radshaw@emlouisville.edu
47. hmdett01@emlouisville.edu
48. hccoll01@emlouisville.edu
49. s0kim023@emlouisville.edu
50. nomura01@emlouisville.edu
51. rstyag01@emlouisville.edu
52. lavanc02@emlouisville.edu
53. Collections@emlouisville.edu
54. llwill01@emlouisville.edu
55. irsurvey@emlouisville.edu
56. itcompctr@emlouisville.edu
57. i2a@emlouisville.edu
58. smena01@emlouisville.edu
59. stu.williams@emlouisville.edu
60. o.fores@emlouisville.edu

Goorecon is a great script to use along side some other the other tools we have written about to make sure you have all of your targets sub domains thus increasing your attack surface and the chances of a successful penetration.

See larger image Google Hacks: Tips & Tools for Finding and Using the World’s Information (Paperback) List Price: $24.99 USD New From: $6.00 USD In Stock Used from: $1.99 USD In Stock

See larger image The Ruby Programming Language: Everything You Need to Know (Paperback) List Price: $39.99 USD New From: $10.94 USD In Stock Used from: $1.49 USD In Stock