In this lesson,
we're going to explore the concept
of active recon in Pen testing.
Unlike passive reconnaissance
where you gather information without touching the target,
active reconnaissance involves directly interacting
with the target systems to get important data.
This type of reconnaissance can be risky
because it might alert the target
that someone is assessing their security.
We'll look at several methods of active reconnaissance,
specifically focusing on protocol scanning,
TCP/UDP scanning, and banner grabbing.
These methods are key
to finding vulnerabilities in the network.
Protocol scanning involves sending packets to a target
to find out what protocols are being used
like FTP, SSH, SMTP, and HTTP.
For example, a Pen tester might use a tool like NMAP
to scan for open ports associated with these protocols.
This helps identify which services
are running on which ports.
Imagine scanning a range of IP addresses,
see if port 22, typically used for SSH, is open.
If it is, this means the SSH service is available
and might be vulnerable to attacks.
Now, TCP, which stands for Transmission Control Protocol
and UDP, which stands for User Datagram Protocol,
are both used to find open ports
and services running on those ports in a target network.
TCP scanning involves starting a handshake
to see if a port is open.
NMAP can do different types of scans,
like SYN or synchronized scans,
which sends a TCP SYN packet to start a handshake.
If a SYN-ACK or synchronized-acknowledged response
comes back, it means the port is open.
UDP scanning, on the other hand, sends UDP packets
to various ports.
The response or a lack of one
helps figure out the port status.
For instance, no response usually means UDP port
is being blocked while an ICMP port unreachable error
suggests a closed port.
Banner grabbing is another active reconnaissance method.
It is used to gather information
about the software running on a network,
including the type and version of the software.
This is done by connecting to a remote service
like a web server on port 80
and recording the banner information
that the server sends back.
This banner often contains details
about the server software.
Tools like Telnet or Specialized Scripts
can send requests to a server and capture the banner data.
For example, using the curl command to interact
with the server can be a simple but effective way
to get detailed information about the web server software.
By running the command curl -I www.google.com,
you see a HEAD request to the server,
which fetches the headers of the document.
This can reveal critical data about server configurations
like the server type, cookies, caching policies, and more.
This information is useful for finding known vulnerabilities
in specific software versions.
Using the active reconnaissance methods
allows penetration testers to gather detailed
and actionable intelligence
about their target's network and defenses.
By understanding which ports are open,
what services are running on those ports,
and specific details about the software versions,
testers can better tailor their attack strategies
to exploit known vulnerabilities.
We'll cover these methods in more detail later on.
So remember, active reconnaissance is a powerful approach
in penetration testing that involves direct interaction
with the target system to gather detailed information,
while it provides deep insights into the target network
and services, it must be conducted carefully
to avoid being detected too early.
Methods like protocol scanning,
TCP/UDP scanning, and banner grabbing are critical
for building an effective Pen testing strategy,
helping to identify vulnerabilities
that can be exploited in later stages of the assessment.