Information Gathering and getting to know the target systems is the first process in ethical hacking. Reconnaissance is a set of processes and techniques (Footprinting, Scanning & Enumeration) used to covertly discover and collect information about a target system.
During reconnaissance, an ethical hacker attempts to gather as much information about a target system as possible, following the seven steps listed below −
- Gather initial information
- Determine the network range
- Identify active machines
- Discover open ports and access points
- Fingerprint the operating system
- Uncover services on ports
- Map the network
We will discuss in detail all these steps in the subsequent chapters of this tutorial. Reconnaissance takes place in two parts − Active Reconnaissance and Passive Reconnaissance.
In this process, you will directly interact with the computer system to gain information. This information can be relevant and accurate. But there is a risk of getting detected if you are planning active reconnaissance without permission. If you are detected, then system admin can take severe action against you and trail your subsequent activities.
In this process, you will not be directly connected to a computer system. This process is used to gather essential information without ever interacting with the target systems.
Footprinting is a part of reconnaissance process which is used for gathering possible information about a target computer system or network. Footprinting could be both passive and active. Reviewing a company’s website is an example of passive footprinting, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering.
Footprinting is basically the first step where hacker gathers as much information as possible to find ways to intrude into a target system or at least decide what type of attacks will be more suitable for the target.
Social Engineering:- The easiest of all and can be done without any tool.
System and Network Attack
During this phase, a hacker can collect the following information −
- Domain name
- IP Addresses
- Employee information
- Phone numbers
- Job Information
In the following section, we will discuss how to extract the basic and easily accessible information about any computer system or network that is linked to the Internet.
Footprinting Different Methods.
1. Footprinting through Social Media, this one is the most easiest to do mostly attacker will create fake account/ids and tries to gather as much as possible information about the target Organization.
2.Footprinting through Search Engines like bing, google and duckduckgo. My favorite is duckduckgo. Attackers also look for cache and archives. Some of the good tools are netcraft, shodan, pipl, Google Earth. in order to perform footpriting.
3.Footprinting through the Job sites. Hackers will come to know what tools and technology organization is working on.
4.Target Monitoring through the Alerts like google alerts, twitter alerts, yahoo alerts.
5.Another good method is via Google Hacking databases and Advance search queries. Query string can be used in search and can be used as keywords. Also Google Advance Search Operators can be utilized. For example “intitle index of” list down all the sites with index open. securityfocus.com, hackersforcharity.org/ghdb are few sites where you can get most of the info.
6.Website footprinting is monitoring the target organization website. Web server details, directory structure, developers email id are some of the common info. Also tools available where we can mirror the whole website. Backdated website information can be extracted from archive.org.
7.Email tracking is used to track the emails. Emails are used to gather information in order to perform the social engineering and many other attacks, Spam.
8.DNS Information attackers can get the hosts in the network. Hackers can get A, CNAME, PTR, MX, NS, HINFO records. There are lot of command line utilities available to get the DNS information. nslookup and dig are the most common among the tools.
9.WHOis attackers perform WHOis to understand whois behind a specific domain? ARIN, AFRINIC, RIPE. APNIC, LATNIC are the RIR’s (Regional Internet Registry). We can get info from WHOis like email, domain owner, address, name servers for the domain, registrar.
11.Footprinting through Social Engineering. Eavesdropping, Shoulder Surfing, Dumpster Diving.
Foot-printing and Reconnaissance of a Website:
Domain Name Information
You can use http://www.whois.com/whois website to get detailed information about a domain name information including its owner, its registrar, date of registration, expiry, name server, owner’s contact information, etc.
Here is a sample record of www.hackonology.com extracted from WHOIS Lookup −
It’s always recommended to keep your domain name profile a private one which should hide the above-mentioned information from potential hackers.
Finding IP Address
You can use ping command at your prompt. This command is available on Windows as well as on Linux OS. Following is the example to find out the IP address of hackonology.com
It will produce the following result −
Pinging hackonology.com [2606:4700:3032::ac43:a8cd] with 32 bytes of data: Reply from 2606:4700:3032::ac43:a8cd: time=169ms Reply from 2606:4700:3032::ac43:a8cd: time=271ms Reply from 2606:4700:3032::ac43:a8cd: time=360ms Reply from 2606:4700:3032::ac43:a8cd: time=171ms
Finding Hosting Company
Once you have the website address, you can get further detail by using ip2location.com website. Following is the example to find out the details of an IP address −
Here the ISP row gives you the detail about the hosting company because IP addresses are usually provided by hosting companies only.
If a computer system or network is linked with the Internet directly, then you cannot hide the IP address and the related information such as the hosting company, its location, ISP, etc. If you have a server containing very sensitive data, then it is recommended to keep it behind a secure proxy so that hackers cannot get the exact details of your actual server. This way, it will be difficult for any potential hacker to reach your server directly.
Another effective way of hiding your system IP and ultimately all the associated information is to go through a Virtual Private Network (VPN). If you configure a VPN, then the whole traffic routes through the VPN network, so your true IP address assigned by your ISP is always hidden.
IP Address Ranges
Small sites may have a single IP address associated with them, but larger websites usually have multiple IP addresses serving different domains and sub-domains.
You can obtain a range of IP addresses assigned to a particular company using American Registry for Internet Numbers (ARIN).
You can enter company name in the highlighted search box to find out a list of all the assigned IP addresses to that company.
History of the Website
It is very easy to get a complete history of any website using www.archive.org.
You can enter a domain name in the search box to find out how the website was looking at a given point of time and what were the pages available on the website on different dates.
Though there are some advantages of keeping your website in an archive database, but if you do not like anybody to see how your website progressed through different stages, then you can request archive.org to delete the history of your website
Let’s Join our Hacking Team
We Are Indian We Are Great
Hope this article helpful for you. Thank You
Indian Cyber Army | Make IT Secure
Enjoy…Stay Happy…Stay Secure…
Hope this article helpful for you. Thank You
If You Appreciate What We Do Here On Hackonology, You Should Consider:
Hackonology is the fastest growing and most trusted community site where you can find lots of courses, articles about Technology/Hacking/Cracking. Millions of people visit Hackonology! to search or browse the thousands of published articles available FREELY to all.
Let's be a part of Hacker's Community! Join our Hacking Team
We Are Indian We Are Great