In this lesson, we'll touch on the role
of passive reconnaissance
in the penetration testing methodology,
specifically how it helps gather information
without direct interaction with the system's target.
Passive reconnaissance is like observing from the shadows,
collecting valuable information about a organization,
while minimizing the risk of detection.
Now, one of the primary tools in passive reconnaissance
is the use of public source-code repositories.
In today's rapidly changing developing environment,
many organizations
utilize platforms like GitHub, Bitbucket, and SourceForge
to host their project code.
Now, these platforms are designed to encourage
and enhance collaboration,
and also speed up development time
by allowing developers to share,
and iterate on code publicly or within teams.
However, they also pose elevated risk
as they may inadvertently expose sensitive information
such as host names, IP addresses,
database servers, service configurations,
and even credentials.
For example, so a developer might accidentally push code
that contains API keys,
or credentials to a public repository,
providing a direct method for exploitation.
Consider this snippet of code
that includes hard-coded credentials for a database access:
Now, this type of exposure
allows unauthorized access to data that the company or team
probably doesn't want anyone to know about.
In a similar fashion,
deployment scripts might reveal server configurations,
or environmental variables
that could be exploited.
By examining the code and the metadata stored
in these repositories,
pen testers can uncover vulnerabilities
without directly engaging in the targets network
and use this information to plan their approach.
Another aspect of passive reconnaissance
involves searching for images in archived websites.
Tools like Wayback Machine
or web cache viewers allow testers
to access older versions of websites,
capture snapshots of past content,
which may reveal security lapses
or a sensitive information
no longer available on the current site.
This could include directories, old press releases,
or deprecated user interfaces
that expose system details.
Similarly, image searches through platforms like TinEye,
or Google can unveil information embedded in images
or track where else these images appear on the internet,
providing clues about the organization's activities,
personnel, or infrastructure.
For instance, an image search using Google or TinEye
might uncover a company event photo
containing visible logging credentials
on a whiteboard in the background.
And lastly, the use of command lines like 'dig'
can be very useful in passive reconnaissance.
With 'dig', testers can query DNS records
to retrieve information about the domain names,
IP mappings, and other DNS-related data
without sending traffic directly to the target system.
This method provides a great deal of information
about the organizational structure
and IT infrastructure
that could be leveraged in later stages
of a penetration test.
We'll cover 'dig' and other DNS commands
in more detail later in this section.
So remember, passive reconnaissance
is a critical initial step
in the penetration testing process,
offering a stealthy approach to information gathered.
By leveraging public data sources like code repositories,
archived web pages, image searches, and DNS queries,
testers can compile a comprehensive profile of their target.
This groundwork is essential
for preparing for more direct engagements
in later phases of the penetration test.