In this lesson,
we're going to cover the information gathering phase
of a penetration testing engagement.
Information gathering is also known as reconnaissance.
It's an important step because it helps you collect
as much data as possible about your target
before attempting any attacks.
This phase can be divided into passive
and active reconnaissance.
Passive reconnaissance involves collecting information
without directly interacting with the target.
This means you're not sending any traffic
to the target systems, reducing the risk of detection.
Some common methods of passive reconnaissance
include analyzing public records,
searching through online databases,
and using open source intelligence, also known as OSINT.
For example, you might use tools like Maltego or Recon-ng
to gather from social media profiles,
corporate websites, or public forums.
One effective passive technique is the who is lookup,
which provides information about domain registration,
including the owner's contact details,
domain expiration dates, and nameservers.
Another technique is searching for the target's IP ranges
using tools like ARIN or the American Registry
for internet numbers to identify the network blocks
owned by the target organization.
Additionally, analyzing job postings
can reveal valuable information about the technologies
and security tools used by the target.
Active reconnaissance, on the other hand,
involves directly interacting with the target
to gather information.
This can include activities like scanning networks,
probing services, and enumerating resources.
While more intrusive, active reconnaissance provides you
more detailed and accurate information
about the target system.
For example, you might use tools like Nmap
to perform network scans and identify open ports,
services running on those ports and their versions.
This can help you understand the attack surface
and potential vulnerabilities.
Another active technique is banner grabbing,
where you send requests to services
and analyze the responses to determine the software
and the versions running on the target.
For example, by connecting to a web server
on port 80 or 443 and analyzing the HTTP headers,
you can often identify web server software and versions,
which might have no vulnerabilities.
DNS Enumeration is another valuable
active reconnaissance technique.
Using tools like Nslookup or dig,
you can query DNS servers to gather information
about the domain sub-domains, mail servers,
and other DNS records.
This can help you map out the targets network
and identify additional points of entry.
One specific active reconnaissance tool worth mentioning
is Shodan, often referred to as the search engine
for the Internet of Things.
Shodan scans the internet and indexes information
about connected devices, which can be incredibly useful
for identifying exposed services and devices
belonging to your target.
As you gather information,
it's essential to document everything meticulously.
This includes the IP addresses, domain names,
service versions, operating system details,
and any other relevant data.
Proper documentation ensures that
you have a clear picture of the target environment
and can plan your attack strategies effectively.
During this phase, it's also important to maintain a balance
between thoroughness and stealth.
While you might want to gather
as much information as possible,
you also need to avoid raising any red flags
that might alert the target to your activities.
Techniques like adjusting the timing of your scans
and using anonymization tools
can reduce the risk of detection.
So remember, in the information gathering phase,
use a mix of passive and active reconnaissance techniques
to gather comprehensive data about your target.
Document everything meticulously and always be mindful
of maintaining stealth to avoid detection.