1. What is Reconnaissance/Footprinting?

Question 1

What is the significance of reconnaissance in terms of the phases that a hacker goes through?

Answer 1

Reconnaissance is one of the biggest phases a hacker goes through.

Question 2

What two major kinds of reconnaissance are there?

Answer 2

1. Active Reconnaissance

2. Passive Reconnaissance

Question 3

Why reconnaissance?

Answer 3

As hackers, we want to know as much information as we can about our target.

Question 4

What is reconnaissance?

Answer 4

Reconnaissance is the process of going through and collecting as much information about your target without being discovered.

Question 5

What are the typical phases of reconnaissance?

Answer 5

1. Collect Elementary Intel
2. Discover OS, Web Servers & Platforms
3. Perform Queries
4. Discover Vulnerabilities

Question 6

What are some questions that we can ask when collecting elementary intel?

Answer 6

1. What does the website look like?
2. What web server do they use?
3. Where is the target located?

Question 7

What is elementary intel and why is it important?

Answer 7

1. Some really basic information about the target.

2. It’s the basic stuff that builds our foundation.

Question 8

What does “Performing Queries” mean in reconnaissance and what’s the goal?

Answer 8

1. Use some tools to discover things like all the DNS names that are out there, etc.
2. The goal is to discover information about the underlying network infrastructure.

Question 9

What questions are answered in the “Discover OS, Web Servers & Platforms” phase of reconnaissance?

Answer 9

• What’s the operating system? Windows? Linux?
• What web servers are they using? Apache? AAS?
• What version of the software are they using? Anything old like a 2003 server?

Question 10

Why is the “Discover OS, Web Servers & Platforms” phase of reconnaissance important?

Answer 10

Like the other phases of reconnaissance, the information gathered in this phase will help us perform our attack.

Question 11

What questions are answered in the “Performing Queries” phase of reconnaissance?

Answer 11

1. Is the target being hosted by a particular company that had some security issues in the past?
2. Can we use another one of their customers to get into this target?

Question 12

What is the “Discover Vulnerabilities” phase of reconnaissance about?

Answer 12

It’s simply about checking what vulnerabilities might be there for us. Since at this point we know the OS, version, and possibly the webserver version, we’ll go and do some reconnaissance again here on what vulnerabilities could possibly be there.

Question 13

What’s the most important overall concern in conducting reconnaissance?

Answer 13

Gathering any type of information that might give us insight into our potential target.

Question 14

What can be said about the importance of the size of intel found during reconnaissance?

Answer 14

We shouldn’t care how small intel is. Sometimes that little piece of information comes back to help us out at the end.

Question 15

What are some secondary benefits of reconnaissance?

Answer 15

1. Understand the Security Posture
2. Reduce the Attack Area
3. Build Information Database

Question 16

How does reconnaissance help with understanding the security posture of a target?

Answer 16

The more we learn about this target, the more we will understand what it is that they’re doing — how often they’re looking into their security.

Question 17

What can be said about the typical structure of reconnaissance?

Answer 17

Typically, reconnaissance is extremely systematic and it’s also done in a methodical order — we go through the same steps, look at the same information.

Question 18

How does reconnaissance help with reducing the attack area?

Answer 18

Based on “Understanding the Security Posture” and doing our reconnaissance, we’re able to get very specific with (eg.) which domains to attack.

Question 19

Why is Reducing the Attack Area an important outcome of reconnaissance?

Answer 19

Focusing the scope down as much as we can mean we have a laser-focused goal or target in mind.

Question 20

What does Building an Information Database involve?

Answer 20

Typically an excel sheet with a big list of stuff that we’re trying to resolve or find out about the company.

Question 21

What does the information stored in an information database that is built for reconnaissance contain?

Answer 21

Information regarding security weaknesses of the target.

Question 22

What is an information database built in Recon used for?

Answer 22

Prioritizing based off the information database