In this section of the course,
we're turning our attention to the tools of the trade
for reconnaissance and enumeration.
This is where theory meets practice,
and we get hands-on with the technology that enables us
to gather detailed information about our targets.
Reconnaissance and Enumeration is all about gathering
as much information as possible
before we begin testing for vulnerabilities.
The right tools can make this process a lot easier,
providing us with a wealth of data about our target.
This section will be centered around Domain 2,
Reconnaissance and Enumeration.
We'll be focusing our attention on Objective 2.4
which states that given a scenario,
we must be able to use the appropriate tools
for reconnaissance and enumeration.
We'll start by exploring the Wayback Machine,
a digital archive in the World Wide Web.
It allows us to see past versions of websites,
which can reveal hidden directories, outdated files,
and other secrets that are no longer visible
on the current version of a site.
Next, we'll look at the Harvester and Hunter.io.
These tools specialize in gathering email addresses
and other data from various public sources.
These tools can be invaluable
for understanding the human element
of our target organization.
For a broader look into the open source intelligence,
we'll discuss various OSINT tools.
These are designed
to pull in information from publicly available sources,
compiling data that might not seem important on their own,
but can paint a comprehensive picture of the target.
After that, we'll conduct a demo using Whois,
which is a tool that provides details
about domain ownership.
Knowing who owns a domain can lead us
to additional information about our target.
Next, we'll be covering the tools nslookup and dig.
We will perform a demonstration
to show their use case in this lesson.
These tools help us curate the domain name system
to uncover details about domain names
and their associated IP addresses,
providing insights into the structure
of the target's online presence.
DNSdumpster and Amass are up next.
They look further into the DNS reconnaissance,
helping us map out the target's domain environment.
This can reveal again, subdomains and associated services
that might not be immediately apparent.
Continuing on, we'll cover Shodan and Censys.io,
which offer a way to search the internet
for specific types of computers, webcams, refrigerators,
or any device connected to the internet.
This is especially useful for finding devices
that are directly accessible from the internet
and potentially vulnerable.
After that, we'll move on to talking about tcpdump,
a powerful command line packet analyzer.
This tool is great for capturing
and analyzing network traffic, which can reveal a lot
of information about what's happening on the network.
Wireshark, which is another packet analyzer,
but with a graphical user interface, makes it easier to sift
through the data captured by tcpdump
or directly from the network,
offering a more user friendly way to analyze traffic.
And to wrap things up,
we'll discuss wireless analysis tools.
These are crucial for examining wireless networks,
identifying devices,
and just understanding how they communicate at large.
Wireless networks often present
different vulnerabilities than wired networks,
so these tools can be key for security assessment.
And finally, we'll take a short quiz to see what you learned
during this section of the course,
and review each of those quiz questions to fully ensure
that you can explain why each answer was right.
If you're ready to get practical
and learn about the tools that will become a key part
of your penetration testing toolkit,
let's jump into this section of the course.