2.2.1 Information gathering & Vulnerability scanning: active reconnaissance/ scanning & recon

Question 1

What is active reconnaissance?

Answer 1

Engaging with the targeted systems or networks to gather information about their vulnerabilities

Question 2

Scanning & enumeration: name the type of scan that can be done (3):

Answer 2

• Discovery scan: ping scan that identifies what host are online and port scan that identifies whether the ports on those hosts are open/closed
• Enumeration: it digs deep into target systems and links identified components into known vuln
• Nmap/Zenmap: nmap require exact syntax and zenmap provides dropdown menu, there is also other scan like ping scan, quick scan and intense scan

Question 2

Scanning & enumeration: what is scanning?

Answer 2

Actively connecting to a system and getting a response to identify hosts, open ports, service, users, domain names and URLs used by a given organization

Question 3

Scanning & enumeration: what is fingerprinting ?

Answer 3

The identification of an OS, service or specific software version that is use by a host, system or network

Question 4

Scanning & enumeration: what is banner grabbing refers to?

Answer 4

Using a program like Netcat, wget or telnet to connect to a given port that is running a service

Question 5

Scanning & enumeration: what’s the difference between scanning, enumeration and fingerprinting ?

Answer 5

• Scanning: more generic
• Enumeration: more in depth
• Fingerprinting: most detailed

Question 6

Scanning & enumeration: what is host enumeration?

Answer 6

Enumeration of any server, workstation, client, which can also include mobile devices, tablets, and IoT devices, or even a networking device like a switch, router, or access point

Question 7

Scanning & enumeration: how to proceed to a host enumeration?

Answer 7

We can enumerate the hosts using command line-based Windows tools or BASH command line tools for Linux hosts or servers to learn more about the target network

Question 8

Scanning & enumeration: list and explain the most common commands line tools for enumeration on Windows

Answer 8

• net: A suite of tools that can be used to perform operations on groups, users, account policies, network shares, and more
• arp: Used when enumerating a Windows host. Address Resolution Protocol (ARP) Cache
  provides a list of all the other machine’s MAC addresses that have recently communicated with the host you are currently on
• ipconfig: Determines the IP address of the machine you are currently on
• ipconfig /displaydns: Displays any DNS names that have recently been resolved

Question 9

Scanning & enumeration: list and explain the most common commands line tools for enumeration on Linux

Answer 9

• finger: Used to view a user’s home directory, their login, and their current idle time
• uname -a: Shows the OS’s name, version, and other relevant details displayed to the terminal
• env: Gives a list of all of the environment variables on a Linux system

Question 10

Scanning & enumeration: can service be enumerated and why?

Answer 10

Yes, they can be enumerated to provide us with additional details about a given host

Question 11

Scanning & enumeration: how service can be enumerated?

Answer 11

By conducting an intensive scan using Nmap, it returns information about the services running on a host’s open ports

Question 12

Scanning & enumeration: what is Active Directory (AD)?

Answer 12

A database that stores, organizes, and enables access to other objects under its control

Question 13

Scanning & enumeration: in AD, what is Organizational Unit (OU)?

Answer 13

Used within a domain to group similar objects (i.e., computers, groups, or even users) together

Question 14

Scanning & enumeration: in AD, what is a user?

Answer 14

Used to represent a person or process that will access a given resource in the domain

Question 15

Scanning & enumeration: in AD, what is a group?

Answer 15

A collection of users

Question 16

Scanning & enumeration: why do you need to know domain enumeration?

Answer 16

Because many Windows attacks rely on trying to bypass the Kerberos authentication in a domain environment.
The first domain is always considered the root domain. Domains or subdomains underneath the root domain are considered children

Question 17

Scanning & enumeration: how to enumerate a domain?

Answer 17

• Powershell: with Get-NetDomain (Lists the current logged in user’s domain) or Get-NetLoggedon (Lists of all the users who are logged into a given computer)
• Nmap, Metasploit

Question 18

Scanning & enumeration: how to enumerate users on a Windows machine?

Answer 18

• Get-NetGroupMember: Lists the domain members belonging to a given group
• net user: Lists all the users on the machine
• net groups: Lists the groups on the machine

Question 19

Website reconnaissance: what information do you need to determine when you are conducting a website reconnaissance?

Answer 19

▪ Software
▪ Operating system
▪ Hosting
▪ Resources
▪ Hidden information

Question 20

Website reconnaissance: what is a website builder?

Answer 20

A platform that a creator or developer uses to create a website from the ground up. It typically offers templates to select from that give sites different looks, features, capabilities, and further opportunities for customization as well.

Question 21

Website reconnaissance: why should you conduct a website reconnaissance?

Answer 21

To identify vulnerabilities.
Find every page that exists on the website, because any page can hold a vulnerability

Question 22

Website reconnaissance: how to conduct a website reconnaissance (2 techniques)?

Answer 22

2 ways:
- Website Crawling (Forced Browsing): The process of systematically attempting to find every page on a given website
- Web Scraping/Harvesting/Data Extraction: A technique used for extracting data from websites performed using automation or through manual processes

Question 23

Website reconnaissance: what are the 2 ways to conduct Website Crawling?

Answer 23

• Prevention: by checking the robots.txt file
• Using DirBuster

Question 24

Website reconnaissance: what is robots.txt file and what valuable information can you retrieve from this file?

Answer 24

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index.
It is often used by attacker to identify restricted or private areas of a site’s contents. The information in the file may therefore help an attacker to map out the site’s contents.

Question 25

Website reconnaissance: what is DirBuster and what valuable information can you retrieve by using it ?

Answer 25

A free tool by OWASP that can conduct brute-force web crawling by trying all various combinations of directories and file name to find hidden data, file and directories

Question 26

Website reconnaissance: what is Custom Word List Generator (CeWL) in Web Scraping/Harvesting/Data Extraction type of reconnaissance?

Answer 26

A technique used for extracting data from websites performed using automation or through manual processes