Chapter 4 Footprinting & Reconnaissance

Question 1

PHASE 1 of the ethical hacking process!!

Answer 1

Footprinting - PASSIVELY gaining info about target

i.e. want just enough data to plan next phase of scanning

includes IP address ranges, Namespaces, Employee info, phone #s, facility info, job info, OS

Question 2

Phase 2

Answer 2

Scanning - ACTIVELY gaining info; footprinting helps identify targets but not all may be active, which is where scanning takes place

includes locating active hosts to target in later phase, pings, ping sweeps, port scans, tracert

Question 3

Phase 3

Answer 3

Enumeration - systematic probing of target w/ goal of obtaining user lists, routing tables, & protocols from the system; shifting from outside to inside to gather data

includes shares, users, groups, applications, protocols, banners, usernames, group info, passwords, device info, NW layout, services

Question 4

Phase 4

Answer 4

System Hacking - methodical approach including cracking passwords, escalating privileges, executing apps, hiding files, covering tracks, concealing evidence

Question 5

Footprinting, or reconnaissance

Answer 5

method of observing & collecting info about potential target w/ the intention of finding a way to attack

Question 6

Finding NW information –> using ping and tracert

Answer 6

1) ping facebook.com –> IP address return + RTT (idea of connections performance & quality)

2) determine frame size on NW
ping facebook.com -f -l 1300
if pack is fragmented, decrease value until results show up

3) tracert
reveals info about path from local host to remote host

Question 7

Terminology in Footprinting

Answer 7

1) Open source & Passive info gathering - using public resources to find info
2) Active Info gathering - engaging target for info (i.e. social engineering)
3) Pseudonymous Footprinting - gathering info from online sources posted by someone from the target but under a diff name
4) Internet Footprinting - using the internet to gain info

Question 8

The Footprinting process

Answer 8

-

Question 9

Using Search Engines

Answer 9

search through a lot of different engines;

Major search engines have an alert system for any updates that occur such as Google

after using search engines, move onto looking for information relating to the URL

Archive.org (aka The Wayback Machine) allows you to find archived copies of websites form which you can extract information

Netcraft - suite of tools used to obtain web server version, IP address, subnet data, OS info, subdomain info

Link Extractor - this tool locates & extracts the internal and external URLs for a given location

Question 10

Public & Restricted Websites

Answer 10

websites that are not intended to be public but to be restricted to a few

Question 11

Location and Geography

Answer 11

important to know location for dumpster diving, social engineering, & other techniques

use people search, google maps, google earth,

Question 12

Social Networking & Information Gathering

Answer 12

can learn all about an individual and their relationships; good for social engineering

Maltego - a app that illustrates relationship between people, gruops, companies, etc (illustrates the dangers of social networking)

Question 13

Financial Services for Info Gathering

Answer 13

Finance websites allows you to gather info about company officers, profiles, etc

Question 14

Job Sites for Info

Answer 14

job postings tend to have a statement of desired skill sets, this can have important details such as OS info, HW info, employer/employee profile, SW info

Question 15

Email for info

Answer 15

http://whoreadme.com –> allows you to track emails & provides info on OS, browster type, location, etc

Question 16

Competitive Analysis

Answer 16

establishing what makes your product or service unique; looking at what competitors are doing to see how your target is moving

reports provide info such as project data, financial status, etc

Tools such as EDGAR (reports), LexisNexis (news), BusinessWire (status), CNBC (future plans)

Question 17

Google Hacking

Answer 17

using advanced operators to fine-tune your results;

can obtain passwords, sensitive folders, logon portals, etc

Examples of operators include:

1) cache:
2) link:
- —Finding websites that have linked to the page
3) info:
4) site:
5) allintitle:
- –Returns websites w/ specified words in their title
6) allinurl:
7) filetype:

For more: www.exploit-db.com/google-dorks/

Question 18

Gaining NW info

Answer 18

Whois - find domain name, IP info, etc

Tracert - follow the path of traffic from one point to another, find relative performance and latency between hops; find server names, etc

Question 19

Social Engineering Techniques (though not part of Footprinting)

Answer 19

Eavesdropping - listening in on convos

Shoulder surfing - standing behind someone while they are on their computer

Dumpster Diving - going through victim’s trash

Question 20

DNS for Zone Transfers PORT #

Answer 20

53 TCP