MOD2: Footprinting and Recon

Question 1

Information obtained in footprinting.

Answer 1

1. Organizational info –> ex Employee details is most important
2. Network Info –> DNS, IP addresses etc,
3. System info –> users and pws, OS, location of web servers

Question 2

Footprinting using Google Hacking techniques:

What type of information does [cache:] provide?

Answer 2

Displays the web pages stored in the Google cache.

Question 3

Footprinting using Google Hacking techniques:

What type of information does [link:] provide?

Answer 3

Lists web pages that have links to the specified web pages.

Question 4

Footprinting using Google Hacking techniques:

What type of information does [related:] provide?

Answer 4

Lists web pages that are similar to the specified web pages.

Question 5

Footprinting using Google Hacking techniques:

What type of information does [info:] provide?

Answer 5

Presents some information that Google has about a particular web page.

Question 6

Footprinting using Google Hacking techniques:

What type of information does [site:] provide?

Answer 6

Restricts the results to those websites in the given domain.

Question 7

Footprinting using Google Hacking techniques:

What type of information does [intitle:] provide?

Answer 7

Restricts the results to documents containing the search keyword in the title.

Question 8

Footprinting using Google Hacking techniques:

What type of information does [allintitle:] provide?

Answer 8

Restricts the results to those websites containing all the search keywords in the title.

Question 9

Footprinting using Google Hacking techniques:

What type of information does [allinurl:] provide?

Answer 9

Restricts the results to those containing all the search keywords in the URL.

Question 10

Footprinting using Google Hacking techniques:

What type of information does [inurl:] provide?

Answer 10

Restricts the results to documents containing the search keyword in the URL.

Question 11

Footprinting using Google Hacking techniques:

What type of information does [location:] provide?

Answer 11

Finds information for a specific location.

Question 12

You can do Google search queries for VoIP and VPN footprinting.
True / False.

Answer 12

True.

You can check out Google Dork, where they provide predefined search queries and the description for each.

Question 13

Name 1 meta search engine that uses other search engines (Google, Bing, etc) to produce their own results from the internet.

Answer 13

“Startpage” or “Metager”.

Question 14

What is a FTP (File Transfer Protocol) search engine?

Answer 14

A global File Search Engine that lets you search images, videos, music, folders, disc images, compressed files, regular files.

People in today’s day are still using FTP search engines to send and receive files however it’s not as secure as today’s security products.

Question 15

What information can you find at Netcraft.com?

Answer 15

Top level domains (TLD) and sub-domains.

Question 16

What 2 tools are useful to enumerate on LinkedIn to find employees of target companies along with their job titles?

Answer 16

“theHarvester” and “Email Spider”.

Question 17

What is an example of a whaling attack?

Answer 17

Going after the executive.

FYI: Attackers can go through Google to find financial services details for the target company.

Question 18

What is the Deep Web?

Answer 18

It consists of web pages and contents that ARE HIDDEN and UNINDEXED and cannot be located using traditional web browsers and search engines.
It can be accessed by the Tor Browser and the WWW Virtual Library.

Question 19

What is the Darknet?

Answer 19

It is a subset of the deep web that enables ANYONE to navigate ANONYMOUSLY without being traced.
It can be accessed by browsers like Tor Browser, Freenet, GNUnet, I2P, and Retroshare.

Question 20

What kind of information can attackers find on the deep and dark net?

Answer 20

They can use searching tools such as Tor Browser and ExoneraTor to gather confidential information about the target.
This includes: Social Security Numbers (SSNs), credit card details, passport information, identification card details, medical records, social media accounts, etc.

Question 21

Name 2 sites that help determine the OS by finding connected devices (such as routers, servers, IoT, etc).

Answer 21

“SHODAN” and “Censys”.

Question 22

What is competitive intelligence gathering?

Answer 22

Gathering information about your competitor.

This is passive information gathering.

Question 23

Competitive Intelligence Gathering: what are some information resource sites for determining how a company began /developed?

Answer 23

• EDGAR Database
• D & B Hoovers
• LexisNexis
• Business Wire

Question 24

Competitive Intelligence Gathering: what are some information resource sites for determining what the company’s plans are?

Answer 24

• MarketWatch
• The Wall Street Transcript
• Alexa
• Euromonitor

Question 25

Competitive Intelligence Gathering: what are some information resource sites for determining what experts say about the company?

Answer 25

- SEMRush - AttentionMeter - ABI/INFORM Global - SimilarWeb

Question 26

What tool is used to search a vast number of social networking sites for a target username?

Answer 26

Sherlock.

Question 27

What is the benefit of web mirroring (using a tool like HTTrack, Web Site Copier, NCollector Studio) for attackers?

Answer 27

Any of these tools can be used to download a copy of the website to a local directory, recursively building all directories, HTML, images, flash, videos, and other files from the server to your company.

Question 28

What is the benefit of using archive.org for attackers?

Answer 28

They can see a timeline of websites evolve. Sometimes even find comments in the source code that can be helpful for gathering more information, especially using the Wayback Machine. It can also help to determine internal and external links.

Question 29

What tool is used by attackers to gather a list words from the target website?

Answer 29

CeWL. This tool helps attackers gather a list of words available on the target website to brute-force the email addresses gathered through search engines, social networking sites, web spidering, etc. ex. cewl www.certifiedhacker.com

Question 30

What tool is used to extract metadata of public documents?

Answer 30

Tool: Metagoofil (this tool extracts metadata of public documents such as pdf, doc, xls, ppt, docx, pptx, xlsx, etc) Another tool: Exiftool Attackers use this to gather useful information that resides in the organization's website in the form of PDF documents, Microsoft word files, etc.

Question 31

What are other techniques for website footprinting?

Answer 31

- monitor web pages for updates/changes (Tool example: WebSite-Watcher, VisualPing) - search for contact info, email addresses, telephone numbers from company websites - search for web pages posting patterns / revision numbers - monitor website traffic of target company (Tool example: Web-Stat, Alexa, Monitis)

Question 32

What type of information can email tracking tools provide?

Answer 32

Tools: eMailTrackerPro, Infoga, Mailtrack, PoliteMail Allows the attacker to track an email and extract information such as: sender identity, mail server, sender's IP address, location, OS details, geolocation. eMailTrackerPro analyses email headers and reveals information such as sender's geographic location and IP address.

Question 33

Who maintains the Whois databases?

Answer 33

Regional Internet Registries.

Question 34

What information does the Whois databases contain?

Answer 34

``` Personal information of domain owners. This includes: - domain name details - contact details of domain owners - domain name servers - NetRange - When a domain was created - expiry records - last updated record ``` FYI: "whois" then "iprange" will give information that is specific.

Question 35

List the Regional Internet Registries (RIRs)?

Answer 35

1. AFRINIC : Africa, portions of the Indian Ocean. 2. APNIC : Portions of Asia, portions of Oceania. 3. ARIN: Canada, many Caribbean and North Atlantic islands, and the United States. 4. LACNIC : Latin America, portions of the Caribbean. 5. RIPE NCC : Europe, the Middle East, Central Asia.

Question 36

What information obtained from Whois database provides assistance to an attacker?

Answer 36

- gathering personal information that assist in social engineering - creating a map of the target organization's network - obtain internal details of the target network

Question 37

Why do attackers perform a reverse DNS lookup on IP ranges?

Answer 37

To locate a DNS PTR record. fyi - PTR (pointer record) provides the domain name associated with an IP address. Tools: DNSRecon Attackers can also find other domains that share the same web server. Tools: Reverse IP Domain Checker

Question 38

What is the benefit of locating a network range of a target?

Answer 38

It can help in creating a map of the target network. Attackers can use: - ARIN whois database search tool to find the range of IP addresses. RIR can provide information such as the range of IP addresses and the subnet masks used by the target organization.

Question 39

What program works on the concept of ICMP protocol and use the TTL field in the header of ICMP packets to discover the routers on the path to a target host? hint: tool to be used for network footprinting.

Answer 39

Traceroute. This tool can be used to extract information about network topology, trusted routers, firewall locations, etc.

Question 40

What tool is used to determine the relationships and real world links between people, groups of people, organizations, websites, internet infrastructure, documents, etc.

Answer 40

Maltego.

Question 41

What tool is used as a Web Reconnaissance framework with independent modules and database interaction, which provides an environment in which open source, web-based recon can be conducted.

Answer 41

Recon-ng.

Question 42

What tool is used to find metadata and hidden information in the documents it scans?

Answer 42

FOCA (Fingerprinting Organizations with Collected Archives).

Question 43

Which footprinting tool includes applications related to username checking, DNS lookups, information leaks research, deep web search, regular expressions extraction, etc

Answer 43

OSRFramework

Question 44

If using theHarvester, what does this cmd line do? | theHarvester -d microsoft.com -l 200 -b baidu

Answer 44

- d specifies the domain or company name to search - l specifies the number of results to be retrieved - b specifies the data source

Question 45

What type of request is sent during a ping request?

Answer 45

The ping command sends an ICMP echo request to the target host and waits for an ICMP response.

Question 46

What does "packet needs to be fragmented by DF set" mean? ping www.certifiedhacker.com -f -l 1500 Pinging certifiedhacker.com [0.0.0.0] with 1500 bytes of data: Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Ping statistics for 0.0.0.0 Packets: Sent = 4 , Received = 0, Lost = 4 (100% loss)

Answer 46

It means that the frame is too large to be on the network and needs to be fragmented. The packet was not sent as we used the -f switch with the ping command, and the ping command returned this error.

Question 47

What does it mean if TTL reaches 0?

Answer 47

The router discards the packet. This mechanism prevents the loss of packets.

Question 48

What does 0.0.0.0: TTL expired in transit mean?

Answer 48

It means that the router discarded the frame because it's TTL expired (reached 0)

Question 49

What does -n mean in the below: | ping www . Certifiedhacker . Com -n 1

Answer 49

-n represents the number of echo requests to be sent to the target.

Question 50

How can you find the hop count on the target?

Answer 50

Find the hop value by trying different TTL value to reach the target domain.

Question 51

What is the primary function of DNS?

Answer 51

to translate a domain name to IP address and vice-versa to enable human-machine-network-internet communications.

Question 52

What is DNS PTR?

Answer 52

A DNS pointer record (PTR for short) provides the domain name associated with an IP address. A DNS PTR record is exactly the opposite of the 'A' record, which provides the IP address associated with a domain name. DNS PTR records are used in reverse DNS lookups.

Question 53

When using nslookup, you receive a "non-authoritative answer". What does that mean? ex. nslookup >set type=a >www.certifiedhacker.com Non-authoritative answer: Name: certifiedhacker.com Address: 0.0.0.0 Aliases: www.certifiedhacker.com

Answer 53

Thus, if the response is coming from your local machine’s server (Google), but not the server that legitimately hosts the domain www.certifiedhacker.com; it is considered a NON-authoritative answer. So, if an attacker can determine the authoritative name server (primary name server) and obtain its associated IP address, he/she might attempt to exploit the server to perform attacks such as DoS, DDoS, URL Redirection, etc.