In this section of the course,
we're going to focus on Information Gathering.
Information Gathering is an important first step
at any pen test.
This is where we start to collect
as much information as possible about our target,
setting the stage for all actions we'll take later on.
Now, this will be important because we'll be going
back and forth between different phases of the pen test,
and we need to have a list of targets that we can go back
and attack after we discover more information.
This section will be centered around Domain 2,
Reconnaissance and Enumeration.
Our focus in this section will be on Objective 2.1,
which states that given a scenario,
we should be able to apply information gathering techniques.
But first, let's kick things off
with a short explanation of some key terms.
First, let's describe passive reconnaissance.
Passive reconnaissance is like being a detective
without letting anyone know you're watching.
You're gathering information from your target
without directly interacting with their systems.
For example, we could use a command line like dig
to get information about domain names, IP addresses,
and other DNS record,
which doesn't involve interacting with the domain directly.
Then there's active reconnaissance.
Now, imagine you move closer to get a better look.
Active reconnaissance involves directly interacting
with the target's system to gather data.
It's more intrusive and can potentially alert
the target that you're there.
For example, we could do a ping scan to see if a host is up,
but this can easily be detected by defense systems.
Another term I would like to discuss is OSINT,
or Open-Source Intelligence.
This is all about using publicly available sources
to gather information about your target.
Think of things like job postings and descriptions,
which could provide a clue
into what operating system a company is using.
We could also consider snooping on a company's website,
which could give us key personnel to target.
Now that we have described a few useful definitions,
let's cover some of the other topics
that you should expect from this section.
First, we have Network Sniffing.
This is all about listening in on network traffic
to gather valuable information.
It's a bit like eavesdropping on a target's conversations
to learn their secrets.
Second, there's Port and Protocol Scanning.
Think of this as knocking on doors to see who answers.
We'll learn how to scan the target systems
to discover open port
and understand the protocols that they're using.
Third, we have HTML Scraping and Cached Page.
This involves collecting data from webpages
and cached browser content.
It's a powerful way to gather intel
on how a website is built
and what kind of information it's serving.
Fourth we have Banner Grabbing.
Here, we'll focus on how to pull information
from service banners.
These banners can tell us a lot about the software versions
and services running on the target systems.
And lastly, we'll be performing
a Banner Grabbing demonstration,
giving you the hands-on skills to pull useful information
from systems that you're testing.
Finally, we'll take a short quiz
to see what you learned during this section of the course
and review each of those quiz questions fully
to ensure you can explain why each answer was right.
So, let's get started
and uncover the secrets of information gathering.