Chapter 2 - Reconnaissance (Footprinting and Reconnaissance) Flashcards
4 Focuses and Benefits of Footprinting
Know the security posture
Reduce the focus area (network range, # of targets , etc)
Identify vulnerabilities
Draw a network map
Active vs Passive Footprinting
Active - requires attacker to touch the device, network or resource. ie social engineering, scanning IP addresses
Passive - collecting information from public sources. Checking websites, looking at DNS records.
CEH Defined examples of passive footprinting
dumpster diving gathering competitive intelligence using search engines browsing social media gaining network ranges raiding DNS for information
Sources of competitive information
EDGAR - www.sec.gov/edgar.shtml
Hoovers - www.hoovers.com
LexisNexis
Businesswire.com
secinfo. com
experian. com
marketwatch. com
twst. com
euromonitor. com
alexa. com for traffic statistics
finance. google.com for stock performance (milestones)
CEH Examples of Active Footprinting
social engineering
human interaction
anything that requires hacker to interact with the organization
it involves expositing your information gathering to discovery
Google Hacking
http://it.toolbox.com/blogs/managing-infosec/google-hacking-master-list-28302
site digger (www.mcafee.com)
metagoofil (www.edge-security.com)
using a search string with specific operators to search for vulnerabilities
filetype:xxxx index of /string info:string intitle:string inurl:string link:string related:webpagename
Google Hacking
http://it.toolbox.com/blogs/managing-infosec/google-hacking-master-list-28302
site digger (www.mcafee.com)
metagoofil (www.edge-security.com)
using a search string with specific operators to search for vulnerabilities
filetype:xxxx index of /string info:string intitle:string inurl:string link:string related:webpagename
Email Tracking Methods
view email header
use email tracking tools like mailtracking.com or emailtracker
DNS Footprinting
Can tell attacker where your services are located
which servers hold your DNS records
which servers run your email
which severs run your websites
DNS Record Types
SRV SOA PTR NS MX CNAME A
SRV - Service, defines hostname and port number
SOA - Start of Authority. ID’s primary name server for the zone.
PTR - Pointer. Maps IP address to hostname providing for reverse DNS lookups. Not required for each entry in DNS but usually found with email server records
NS - Name Server. Defines name servers in your namespace
MX - Mail Exchange. ID’s your email servers
CNAME - Canonical Name. Provides domain name aliases in your zone. i.e. you may have an FTP service and Web service on the same IP address. CNAME records could be used to list both
A - Address. maps an IP address to a hostname, mostly used for DNS lookups
DNS Record Types
SRV SOA PTR NS MX CNAME A
SRV - Service, defines hostname and port number
SOA - Start of Authority. ID’s primary name server for the zone. Contains loads of useful information to the pen tester.
PTR - Pointer. Maps IP address to hostname providing for reverse DNS lookups. Not required for each entry in DNS but usually found with email server records
NS - Name Server. Defines name servers in your namespace
MX - Mail Exchange. ID’s your email servers
CNAME - Canonical Name. Provides domain name aliases in your zone. i.e. you may have an FTP service and Web service on the same IP address. CNAME records could be used to list both
A - Address. maps an IP address to a hostname, mostly used for DNS lookups
DNS Poisoning
Attacker changes the cache on the local name server to redirect users to a server he controls
Mitigates by DNSSEC extensions in 1999
Using nslookup as an attacker
find name servers for the target
type nslookup to get into interactive mode
type ‘server servername’ to change to target’s server
perform dns queries, zone transfer, etc
Additional Footprinting Tools
web spiders
Maltego
Social Engineering Framework (SEF)
web spiders
Maltego - OSINT and forensics
Social Engineering Framework
can extract email addresses from websites, perform general prep for SE. Can tie into Metasploit
What port does DNS Zone Transfer use?
TCP 53
not UDP 53 like DNS lookups
