Footprinting
Footprinting is the first phase of a penetration testing engagement. It is the process of gathering information about the target system, network, or organization. The goal of footprinting is to gain a comprehensive understanding of the target, identify potential vulnerabilities, and create a plan for further testing.
Footprinting can involve a variety of techniques, including:
Open-source intelligence (OSINT) gathering: This involves using publicly available information to learn more about the target. This can include researching the target's website, social media profiles, and other online resources.
Network footprinting: This involves mapping out the target's network, identifying active hosts and their open ports, and determining the target's IP address space and subnets.
Website footprinting: This involves analyzing the target's website to gather information such as the web server type and version, the technologies used, and any directories and files that may be accessible.
Whois and DNS record analysis: This involves gathering information about the domain name, registrar, and DNS servers associated with the target.
Footprinting is an important step in a penetration testing engagement because it provides the tester with a baseline understanding of the target's infrastructure and potential attack vectors. This information can be used to tailor the subsequent phases of the engagement, including vulnerability assessment and exploitation.
Passive Reconnaissance
Passive reconnaissance is a technique used in the enumeration phase of a penetration testing or ethical hacking process to gather information about a target system or network without actively interacting with it. The objective of passive reconnaissance is to gather the information that is readily available and publicly accessible, such as information from websites, social media, and public records.
The advantage of passive reconnaissance is that it is less likely to raise suspicion or trigger any security alerts compared to active reconnaissance, which involves actively interacting with the target system. Passive reconnaissance is often used as the first step in the enumeration phase, to gather basic information about the target and to lay the foundation for further active reconnaissance.
Examples of passive reconnaissance techniques include:
Search engine reconnaissance: Using search engines such as Google, Bing, or Shodan to search for information about the target.
Social media reconnaissance: Analyzing social media profiles and posts of employees or the target organization to gather information about their technologies, networks, and security policies.
DNS reconnaissance: Examining the target's DNS records to identify subdomains and IP addresses associated with the target.
Whois lookup: Querying the Whois database to gather information about the target's domain registration and contact information.
Overall, passive reconnaissance is a valuable technique in the enumeration phase, as it provides a non-intrusive way to gather the information that can be used to better understand the target and plan the next steps in the testing or hacking process.
Last updated