When conducting a pen-test, the process typically starts with the reconnaissance phase, the process of gathering information about your target(s) system, organization or person.<\/p>\n
Today, we want to present a tool that can be added to your reconnaissance toolkit.<\/p>\n
Text dump sites such as pastebin and pastie.org allow users to dump large amounts of text for sharing and storage.<\/p>\n
As these sites become more popular the amount of sensitive information being posted will inevitably increase.<\/p>\n
Pastenum is designed to help you find that information and bring it into one easy to read location.<\/p>\n
The hope is it will allow internal security teams to run simple queries about their companies and determine if they have sensitive information residing in one of these text dumps. It will also help pen-testers with the recon phase by allowing them to enumerate more data faster.<\/p>\n
In order to do so, it uses a series of search queries for keywords, provided by the pentester. Since it queries public sources (and not the target network itself), this should be stealth to the target.<\/p>\n
To use Pastenum you will need ruby 1.9.2.<\/p>\n
I recommend using Ruby Version Manager (RVM) on linux found at http:\/\/rvm.beginrescueend.com\/. Once that is installed you need several gems, they are listed in the README file included with pastenum.<\/p>\n
What follows below is a quick procedure outlining the exact steps on how to get everything installed on Ubuntu. Steps should be similar on other OSs. <\/p>\n
As stated on the rvm website, it's important to run the installation commands with a non-root<\/u><\/strong> user account. If you want to install rvm system-wide as root, please check the rvm website for the exact installation steps. <\/p>\n Every time root permissions are required in the procedure below, sudo will be used. (So make sure the user account you are using has sudo permissions).<\/p>\n On certain security distributions (BackTrack for example), the only available user account is root. Since it is not recommended to use root for the procedure below, you will have to create a non-root useraccount first and use that account to perform the installation.<\/p>\n Example :<\/p>\n <\/p>\nroot@bt:~# useradd -d \/home\/corelanc0d3r -m -s \/bin\/bash corelanc0d3r\nroot@bt:~# passwd corelanc0d3r\nEnter new<\/span> UNIX password:\nRetype new<\/span> UNIX password:\npasswd: password updated successfully<\/pre>\n