Chapter 2: Reconnaissance and Enumeration

Chapter 2

Objective 2.1

Active and Passive Reconnaissance

• Active Reconnaissance → Actively interacts with the target system or network to gather information.
  • Methods: Port scanning, ping sweeps, banner grabbing, social engineering.
  • Risks: High detection risk, potential legal issues.
  • Importance: Provides detailed and actionable information about the target’s systems and vulnerabilities.
• Passive Reconnaissance → Gathers information about the target without directly interacting with the target system or network.
  • Methods: OSINT, WHOIS lookup, DNS enumeration, social media monitoring, website analysis.
  • Benefits: Stealthy, reduces legal risk.
  • Importance: Gathers initial information about the target without direct interaction, forming a foundation for further active reconnaissance.

Open-Source Intelligence (OSINT)

• Social Media: Gathers personal and organizational information for social engineering and intelligence.
  • Examples:
    • LinkedIn: Identifying key employees, organizational structure, and technology stack used.
    • Facebook/Twitter: Gathering personal information, behaviors, and affiliations.
  • Importance: Provides insights into potential targets, their roles, and publicly shared information that can be leveraged in social engineering attacks.
• Job Boards: Identifies technologies and potential vulnerabilities based on job postings.
  • Examples:
    • Indeed/Glassdoor: Reviewing job listings to find out what technologies and skills are sought by the target organization.
  • Importance: Reveals information about the organization’s IT environment, security tools, and potential vulnerabilities based on required skills.
• Scan Code Repositories: Searches for sensitive information and code vulnerabilities in public repositories.
  • Examples:
    • GitHub/GitLab: Searching for exposed credentials, API keys, or sensitive configuration files.
  • Importance: Uncovers potentially exploitable information and code vulnerabilities that can be used in an attack.
• Domain Name System (DNS):
  • DNS Lookups: Retrieves domain configuration details.
    • Example: Using nslookup or dig to retrieve A, MX, and CNAME records.
  • Reverse DNS Lookups: Maps IP addresses to domain names.
    • Example: Using host command to find domains pointing to an IP address.
  • Importance: Helps map out the target’s network structure and identify potential entry points.
• Cached Pages: Accesses historical web page versions to find removed or altered information.
  • Examples:
    • Wayback Machine: Viewing archived versions of a website to find old, possibly insecure configurations or sensitive information.
  • Importance: Provides access to information that has been removed or altered, which can be valuable in understanding historical security practices and changes.
• Cryptographic Flaws: Identifies weaknesses in encryption implementations.
  • Examples:
    • SSL/TLS Analysis: Using tools like SSL Labs to assess the security of a website’s SSL/TLS configuration.
  • Importance: Detects vulnerabilities in encryption that could be exploited to intercept or manipulate data.
• Password Dumps: Uses leaked credentials to find potential entry points.
  • Examples:
    • Have I Been Pwned: Checking if the target’s email addresses have been compromised in data breaches.
  • Importance: Provides potential entry points if reused or weak passwords are found in the dumps.

Network Reconnaissance

• Purpose: To gather information about a target network, identifying its structure, devices, services, and potential vulnerabilities. This information is crucial for planning and executing further penetration testing activities.
• Network Scanning
  • Purpose: Identifies active devices, open ports, and services.
  • Tools: Nmap, Angry IP Scanner.
  • Examples: Scanning a subnet to identify all active hosts.
• Ping Sweeps
  • Purpose: Discovers active devices using ICMP echo requests.
  • Tools: Fping, Nmap.
  • Examples: Using fping to ping all devices in a subnet.
• Port Scanning
  • Purpose: Identifies open ports and running services.
  • Tools: Nmap, Masscan.
  • Examples: Performing a SYN scan to identify open ports.
• OS Fingerprinting
  • Purpose: Determines the operating system of a target device.
  • Tools: Nmap, Xprobe2.
  • Examples: Using Nmap’s OS detection feature.
• Service Enumeration
  • Purpose: Gathers detailed information about services on open ports.
  • Tools: Nmap, Netcat.
  • Examples: Identifying the version of a web server running on port 80.
• Network Mapping
  • Purpose: Creates a visual representation of the network topology.
  • Tools: Nmap with Zenmap, SolarWinds Network Topology Mapper.
  • Examples: Visualizing network scan results with Zenmap.
• DNS Enumeration
  • Purpose: Gathers information about the target’s DNS infrastructure.
  • Tools: DNSRecon, Fierce.
  • Examples: Listing all DNS records for a target domain.

Protocol Scanning

• Purpose: Protocol scanning aims to identify open ports and the services running on them by sending packets to various ports on a target system. It helps in understanding which services are exposed and potentially vulnerable.
• TCP Scanning
  • Purpose: Identifies open TCP ports and services by analyzing TCP packet responses.
  • Tools: Nmap, Masscan.
  • Types:
    • SYN Scan: Stealthy, sends SYN packets.
    • Connect Scan: Completes the TCP handshake, more detectable.
    • FIN, Xmas, Null Scans: Uses specific TCP flags to elicit responses from closed ports.
  • Examples: nmap -sS target_ip, nmap -sT target_ip.
• UDP Scanning
  • Purpose: Identifies open UDP ports and services by sending UDP packets and analyzing responses.
  • Tools: Nmap, Unicornscan.
  • Examples: nmap -sU target_ip.
  • Challenges: Less reliable due to stateless nature of UDP and ICMP rate limiting.

Certificate Transparency Logs

• Purpose: Monitors and audits digital certificates issued by Certificate Authorities (CAs) to detect malicious or misissued certificates.
• Tools:
  • crt.sh: A website for searching Certificate Transparency logs.
  • Google Certificate Transparency: A project providing public logs of issued certificates.
• Examples:
  • Using crt.sh to find all certificates issued for a target domain.
• Importance: Helps identify rogue or unexpected certificates, which can indicate potential man-in-the-middle (MITM) attacks or unauthorized domain usage.

Information Disclosure

• Purpose: Identifies unintentional leakage of sensitive information through various channels.
• Examples:
  • Error Messages: Examining error messages that reveal software versions, paths, or other sensitive details.
  • Metadata: Analyzing document properties for hidden information like author names, software versions, etc.
  • Source Code: Checking for comments in HTML or other code that disclose internal workings or credentials.
• Importance: Detecting and mitigating information disclosure reduces the risk of attackers leveraging this information for more targeted attacks.

Search Engine Analysis/Enumeration

• Purpose: Uses search engines to find sensitive information or entry points exposed on the web.
• Tools:
  • Google Dorking: Using advanced search operators to find exposed information.
  • Shodan: Search engine for Internet-connected devices.
• Examples:
  • Using Google dorks to find publicly accessible login pages or sensitive files.
    • Example: site:example.com inurl:login
• Importance: Uncovers publicly accessible information that might be overlooked, providing attackers with valuable data.

Network Sniffing

• Purpose: Captures and analyzes network traffic to gather information about the network and the devices on it.
• Tools:
  • Wireshark: Popular network protocol analyzer.
  • tcpdump: Command-line packet analyzer.
• Examples:
  • Capturing traffic to identify protocols in use, active devices, and potential vulnerabilities.
• Importance: Provides insights into network communication patterns, potential vulnerabilities, and security posture.

IoT and Operational Technology (OT) Protocols

• Purpose: Identifies and analyzes protocols used in IoT and OT environments.
• Examples:
  • Modbus, DNP3: Commonly used in industrial control systems (ICS).
  • MQTT, CoAP: Used in IoT communication.
• Importance: Understanding these protocols helps in identifying vulnerabilities specific to IoT and OT environments, which are often overlooked but critical for industrial and smart devices.

Banner Grabbing

• Purpose: Collects banners from network services to identify the software and version running on them.
• Tools:
  • Netcat: Basic network utility for reading from and writing to network connections.
  • Nmap: Supports banner grabbing with service detection.
• Examples:
  • Using Netcat to connect to an open port and capture the service banner.
    • Command: nc target_ip port
• Importance: Identifies software versions and configurations, which can be matched against known vulnerabilities for further exploitation.

HTML Scraping

• Purpose: Extracts information from web pages to gather intelligence about the target.
• Tools:
  • Beautiful Soup: Python library for web scraping.
  • Scrapy: Python framework for web scraping.
• Examples:
  • Scraping a website for email addresses, internal links, or other useful information.
• Importance: Automates the process of extracting valuable information from web pages, which can be used for further analysis or attacks.

Objective 2.2

Operating System (OS) Fingerprinting

• Purpose: Determines the operating system of a target device.
• Tools:
  • Nmap: Includes OS detection capabilities.
  • Xprobe2: Active OS fingerprinting tool.
• Examples:
  • Using Nmap’s OS detection feature to identify the operating system running on a target server.
    • Command: nmap -O target_ip
• Importance: Helps tailor further attacks to the specific operating systems identified, improving the chances of successful exploitation.

Service Discovery

• Purpose: Identifies services running on open ports and gathers detailed information about them.
• Tools:
  • Nmap: Service version detection.
  • Netcat: Versatile tool for interacting with network services.
• Examples:
  • Using Nmap to identify the version of a web server running on port 80.
    • Command: nmap -sV target_ip
• Importance: Provides detailed information about the services, including software versions, which can be used to identify known vulnerabilities.

Protocol Enumeration

• Purpose: Identifies and gathers information about the protocols in use on the target network.
• Tools:
  • Wireshark: Network protocol analyzer.
  • Nmap: Supports various protocol scans.
• Examples:
  • Using Nmap to scan for specific protocols such as SMB, FTP, and SSH.
    • Command: nmap -sV -p 21,22,139 target_ip
• Importance: Helps in understanding the communication protocols used, which is crucial for identifying potential vulnerabilities.

DNS Enumeration

• Purpose: Gathers information about the target’s DNS infrastructure.
• Tools:
  • DNSRecon: DNS enumeration tool.
  • Fierce: DNS reconnaissance tool.
• Examples:
  • Using DNSRecon to list all DNS records for a target domain.
    • Command: dnsrecon -d target_domain
• Importance: Identifies domain names, subdomains, and associated IP addresses, which can provide additional targets for further reconnaissance.

Directory Enumeration

• Purpose: Identifies and lists directories and files on web servers.
• Tools:
  • DirBuster: Web directory scanner.
  • Gobuster: Directory and file brute-forcer.
• Examples:
  • Using Gobuster to find hidden directories and files on a web server.
    • Command: gobuster dir -u target_url -w wordlist.txt
• Importance: Helps identify hidden resources that might contain sensitive information or provide entry points for attacks.

Host Discovery

• Purpose: Identifies active hosts on a network.
• Tools:
  • Nmap: Network scanning tool.
  • Ping Sweep: Using ping to identify live hosts.
• Examples:
  • Using Nmap to discover hosts on a network.
    • Command: nmap -sn target_subnet
• Importance: Provides a list of active devices, which can be targeted for further analysis.

Share Enumeration

• Purpose: Identifies shared resources on a network, such as file shares.
• Tools:
  • SMBclient: Command-line tool for accessing SMB/CIFS resources.
  • enum4linux: Linux tool for enumerating information from Windows systems.
• Examples:
  • Using SMBclient to list shared resources on a Windows server.
    • Command: smbclient -L //target_ip
• Importance: Identifies shared resources that might contain sensitive information or provide entry points for attacks.

Local User Enumeration

• Purpose: Identifies user accounts on a target system.
• Tools:
  • enum4linux: Tool for enumerating information from Windows systems.
  • rpcclient: Command-line tool for interacting with Windows RPC services.
• Examples:
  • Using enum4linux to list user accounts on a Windows system.
    • Command: enum4linux -U target_ip
• Importance: Helps in identifying potential user accounts that can be targeted for password attacks or privilege escalation.

Email Account Enumeration

• Purpose: Identifies email accounts associated with a target domain.
• Tools:
  • theHarvester: Tool for gathering emails, subdomains, and more.
  • Hunter.io: Web service for finding email addresses.
• Examples:
  • Using theHarvester to find email addresses associated with a target domain.
    • Command: theHarvester -d target_domain -b google
• Importance: Identifies potential targets for phishing attacks or social engineering.

Wireless Enumeration

• Purpose: Identifies wireless networks and gathers information about them.
• Tools:
  • Kismet: Wireless network detector, sniffer, and intrusion detection system.
  • Aircrack-ng: Suite of tools for wireless network security.
• Examples:
  • Using Kismet to discover wireless networks and their configurations.
• Importance: Helps in identifying wireless networks, their security configurations, and potential vulnerabilities.

Permission Enumeration

• Purpose: Identifies permissions and access controls on resources.
• Tools:
  • AccessChk: Windows tool for viewing permissions.
  • Linux file permissions commands: Using ls -l to view file permissions.
• Examples:
  • Using AccessChk to list permissions on a Windows file or directory.
    • Command: accesschk.exe -s target_directory
• Importance: Helps in identifying overly permissive access controls, which can be exploited for privilege escalation or unauthorized access.

Secrets Enumeration

• Purpose: Identifies sensitive information such as credentials, access keys, and tokens that can be used to gain unauthorized access.
• Tools:
  • TruffleHog: Searches through git repositories for secrets.
  • AWS IAM Access Analyzer: Identifies permissions and access keys in AWS environments.
• Examples:
  • Cloud Access Keys: Using TruffleHog to search for AWS keys in a Git repository.
    • Command: trufflehog --regex --entropy=True target_repo_url
  • Passwords: Searching for plaintext passwords in configuration files.
  • API Keys: Identifying API keys in public repositories or code.
  • Session Tokens: Extracting session tokens from intercepted traffic or logs.
• Importance: Finding and securing secrets prevents unauthorized access and potential data breaches.

Attack Path Mapping

• Purpose: Visualizes the potential paths an attacker could take to exploit vulnerabilities and escalate privileges within a network.
• Tools:
  • BloodHound: Graph-based tool for analyzing Active Directory trusts.
  • CARTA: Cybersecurity Attack Resiliency & Threat Assessment framework.
• Examples:
  • Using BloodHound to map relationships and permissions in an Active Directory environment.
    • Command: Invoke-BloodHound -CollectionMethod All
• Importance: Understanding attack paths helps in identifying and mitigating vulnerabilities before attackers can exploit them.

Web Application Firewall (WAF) Enumeration

• Purpose: Identifies the presence and configuration of web application firewalls protecting web applications.
• Tools:
  • WAFW00F: Tool to detect and identify WAF products.
• Examples:
  • Using WAFW00F to identify the type of WAF protecting a web application.
    • Command: wafw00f target_url
  • Origin Address: Bypassing WAF to directly interact with the origin server by discovering its IP address.
    • Techniques: DNS history lookup, SSL certificate analysis.
• Importance: Understanding WAF configurations helps in planning attacks that can bypass or evade these defenses.

Web Crawling

• Purpose: Automatically traverses and maps a website’s structure, identifying all accessible pages and resources.
• Tools:
  • Burp Suite: Web vulnerability scanner with crawling capabilities.
  • Scrapy: Python framework for web crawling.
• Examples:
  • Using Burp Suite to crawl and map a web application.
    • Command: Configure Burp Suite’s spider to target the application.
• Importance: Comprehensive mapping of a web application aids in identifying hidden or less obvious vulnerabilities.

Manual Enumeration

• Purpose: Manually investigates specific files and configurations to gather information about a target system.
• Examples:
  • Robots.txt: Checking for disallowed paths that might contain sensitive information.
    • URL: http://target_domain/robots.txt
  • Sitemap: Reviewing the sitemap for a complete list of URLs.
    • URL: http://target_domain/sitemap.xml
  • Platform Plugins: Identifying plugins and extensions used by the web application platform (e.g., WordPress plugins).
    • Techniques: Viewing the HTML source or scanning for known plugin directories.
• Importance: Manual investigation can reveal specific details that automated tools might miss, providing deeper insights into the target environment.

Objective 2.3

Information Gathering

• Purpose: Collect data about the target.
• Techniques: Passive and active reconnaissance.
• Examples: Using theHarvester and Nmap.

Data Manipulation

• Purpose: Process and analyze gathered data.
• Techniques: Parsing, filtering, transforming.
• Examples: Python script to parse scan results.

Scripting Languages

• Bash: Automate command-line tasks.
  • Example: Network scan script.
• Python: Data manipulation and web scraping.
  • Example: Subdomain enumeration script.
• PowerShell: Windows system administration.
  • Example: Local user enumeration script.

Logic Constructs

• Loops: Repeat code blocks.
  • Examples: For loops in Bash and Python.
• Conditionals: Execute code based on conditions.
  • Examples: If-else statements in Bash and Python.
• Operators: Perform logical, string, and arithmetic operations.
  • Arithmetic Operator → Perform mathematical operations.
  • String Operator → Manipulate and compare strings.
  • Boolean Operator → Perform logical operations.
  • Examples: Boolean, string, and arithmetic operators in Bash and Python.

Use of Libraries, Functions, and Classes

• Libraries: Leverage existing functionalities (e.g., requests in Python).
• Functions: Encapsulate reusable code.
• Classes: Define data structures and behaviors.

Objective 2.4

• Wayback Machine
  • Purpose: Archive of web pages; allows viewing of historical versions of websites.
  • Usage: Check past versions of a target site for exposed sensitive information or vulnerabilities.
  • Example: Visiting archive.org to look at past snapshots of target_site.com.
• Maltego
  • Purpose: Data mining tool; visualizes relationships between people, companies, domains, etc.
  • Maltego is a powerful data mining and link analysis tool developed by Paterva.
  • It is used for gathering and connecting information across various platforms, helping users visualize complex relationships among people, groups, websites, domains, networks, and other entities.
  • Maltego is widely utilized in cybersecurity, open-source intelligence (OSINT), forensic investigations, and threat intelligence.
  • Usage: Generate graphs that display the interconnections between different pieces of information.
  • Example: Using Maltego to map out relationships between email addresses, domains, and social media profiles.
• Recon-ng
  • Purpose: Open-source web reconnaissance framework.
  • Usage: Automate the process of gathering open-source intelligence.
  • Example: Running modules in Recon-ng to gather email addresses from a domain.
    • Command: recon-ng > marketplace install recon/domains-contacts/whois_pocs
• Shodan
  • Purpose: Search engine for Internet-connected devices.
  • Usage: Find devices with specific vulnerabilities or configurations.
  • Example: Using Shodan to find all exposed webcams.
    • Command: shodan search "webcamxp"
• SpiderFoot
  • Purpose: Automated OSINT tool; collects data from various sources.
  • SpiderFoot is an open-source intelligence (OSINT) automation tool used for reconnaissance and information gathering.
  • It automates the process of collecting intelligence on IP addresses, domain names, email addresses, and other entities.
  • SpiderFoot scans multiple data sources to build a detailed profile of the target, making it a valuable tool for penetration testers, security researchers, and threat analysts.
  • Usage: Automate the collection of information about a target.
  • Example: Running a scan in SpiderFoot to gather data on a target domain.
    • Command: python3 spiderfoot.py -s target.com
• WHOIS
  • Purpose: Look up domain registration information.
  • Usage: Find ownership and contact information for a domain.
  • Example: Using a WHOIS lookup tool to find the registrant’s information for target.com
    • Command: whois target.com
• nslookup/dig
  • Purpose: DNS lookup utilities.
  • Usage: Retrieve DNS records for a domain.
  • Example:
    • nslookup: nslookup target.com
    • dig: dig target.com
• Censys.io
  • Purpose: Search engine for internet-connected devices.
  • Usage: Find devices, services, and vulnerabilities.
  • Example: Searching Censys for devices running specific software versions.
• Hunter.io
  • Purpose: Email address search engine.
  • Usage: Find email addresses associated with a domain.
  • Example: Using Hunter.io to find contact emails for target.com.
• DNSdumpster
  • Purpose: DNS recon and research tool.
  • DNSdumpster is an online tool that provides comprehensive domain reconnaissance by performing DNS enumeration and gathering information about the DNS infrastructure of a given domain.
  • It helps security researchers, penetration testers, and IT professionals map out the external network infrastructure associated with a domain, including subdomains, mail servers, and other DNS records.
  • Usage: Find DNS records and subdomains for a target.
  • Example: Using DNSdumpster to find subdomains for target.com.
• Amass
  • Purpose: In-depth DNS enumeration tool.
  • Amass is an open-source tool developed by the OWASP (Open Web Application Security Project) foundation, designed for in-depth network mapping and external asset discovery.
  • It is particularly effective for DNS enumeration, subdomain discovery, and reconnaissance.
  • Amass uses multiple techniques to gather information about a target domain, including active and passive methods, and integrates data from various sources to provide comprehensive results.
  • Usage: Discover subdomains and map out network structures.
  • Example: Running Amass to enumerate subdomains of target.com.
    • Command: amass enum -d target.com
• Nmap
  • Purpose: Network scanning tool.
  • Usage: Discover hosts and services on a network.
  • Example:
    • Basic Scan: nmap target_ip
  • Nmap Scripting Engine (NSE): Extend Nmap functionality with scripts.
    • Example Script: nmap --script http-enum target_ip
• theHarvester
  • Purpose: Gather emails, subdomains, hosts, and more from public sources.
  • Usage: OSINT gathering tool.
  • Example: theHarvester -d target.com -b google
• WiGLE.net
  • Purpose: Wireless network mapping service.
  • WiGLE.net (Wireless Geographic Logging Engine) is an online service that aggregates data on the locations of wireless networks worldwide.
  • It collects information about Wi-Fi networks (SSIDs, BSSIDs, GPS coordinates, etc.) and allows users to search, map, and analyze this data.
  • WiGLE is popular among security researchers, penetration testers, and wireless network enthusiasts for discovering and mapping Wi-Fi networks.
  • Usage: Find and map Wi-Fi networks.
  • Example: Searching WiGLE.net for Wi-Fi networks in a specific area.
• InSSIDer
  • Purpose: Wi-Fi network scanner.
  • Usage: Identify Wi-Fi networks and their configurations.
  • Example: Using InSSIDer to scan for nearby Wi-Fi networks.
• OSINTframework.com
  • Purpose: Collection of OSINT tools and resources.
  • Usage: Reference for various OSINT tools.
  • Example: Visiting OSINTframework.com to find tools for a specific type of OSINT task.
• Wireshark/tcpdump
  • Purpose: Network protocol analyzers.
  • Usage: Capture and analyze network traffic.
  • Example:
    • Wireshark: Using the graphical interface to capture packets.
    • tcpdump: tcpdump -i eth0 -w capture.pcap
• Aircrack-ng
  • Purpose: Suite of tools for Wi-Fi network security assessment.
  • Usage: Capture and crack WEP/WPA-PSK keys.
  • Example:
    • Capturing packets: airodump-ng wlan0
    • Cracking a WPA handshake: aircrack-ng -w wordlist.txt -b target_bssid capture_file.cap