Reconnaissance 1

Question 1

WHOIS

Answer 1

• The WHOIS system is responsible for keeping track of who is responsible for a domain name. It is intended to provide contact details for the owners of a domain in cases of abuse or other circumstances.
• You can easily search for WHOIS information using the ‘whois’ command on Linux.

Question 2

DNS Recon

Answer 2

• The first thing to watch out for is the ability to perform a zone transfer. You’ll almost never be able to pull it off these days, but it’s worth checking because a zone transfer will allow you to pull off a complete list of every DNS record for the domain in question.
  cmd: host -l domain ip

Question 3

Dirb

Answer 3

• Armed with a list of websites, you could start to find directories that are not linked directly in the public areas of the site.
• For this task, we can use ‘dirb’.
• Once again, this tool uses a wordlist to craft HTTP requests to the target, and it will tell us if the directory exists on the site.

Question 4

NMap

Answer 4

• NMap is a prolific portscanner in the security community, and for good reason. It is incredibly powerful, with a host of different options.
• By default NMap will only scan the top 1000 most common ports. If you want to override that and have NMap scan all possible ports then then you need to use: ‘-p-‘

Question 5

Connect Scan

Answer 5

• The connect scan is the most basic type of scan you can do in NMap.
• The benefit to using a connect scan is that you don’t need root permissions on the system you are scanning from to use it.
• The downside is that a connect scan is quite obvious and many firewalls or IDS systems will flag it.

Question 6

Syn Scan

Answer 6

• There is a faster and stealthier alternative to the connect scan, which is the syn scan. This is the scan type you should almost always be using if you have root access to the system you are scanning from.

Open port connection (TCP):
Syn
Syn-Ack

Closed port refusal (TCP):
Syn
Rst

Question 7

Service Detection

Answer 7

• Once you know what ports are open, you could connect to them to try to find out which services are running.
• NMap can do a great job of telling you which services are running with ‘-sV’. The ‘-sV’ parameter is for version detection.
• Nmap does version detection by fingerprints. It looks at several factors and compares them against a fingerprint database to try to find out which services are running. It can even tell the difference if a service is configured to provide the wrong banner when you connect to it.

Question 8

OS Detection

Answer 8

• Add ‘-O’ to NMap cmd