Backtrack 4: Information Gathering: Search Engine: Goorecon – Find emails and subdomains using Google

During the Information Gathering section of a pentest, we are interested in finding out the various sub-domains of our target domain. In the past few tutorials we queried DNS servers using zone transfer requests or trying to retrieve entries using a dictionary & brute-forcing attacks. Another technique to figure out sub-domains is to query google and check if it has found any sub-domains during it’s web mining exercise on the target. Goorecon can do this. Goorecon was written by Carlos (Darkoperator) Perez.

I did have to fix the Goorecon in Backtrack 4 and I will be fixing the package today as well but if you have a issue with the email part not working you will need this fix which was posted by Steve Goldsby on his blog.

Here is the excerpt of the fix from his blog:
Goorecon recently broken when querying for email addresses (e.g. ruby goorecon.rb -e icsinc.com). Sometime between when goorecon was written and now, google changed their formatting of reposnses for email addresses from:

emailaddress@
icsinc.com to emailaddress@icsinc.com