CYBERSEURITY 2 (CHAPTER 3)

Information Gathering

The process of identifying, discovering, and obtaining information that may have relevance to the pen test; crucial to the success of most pen tests

Open Source Intelligence (OSINT)

Actionable information gathered from freely and publicly available sources; anyone can obtain it without breaking laws

Whois

A protocol that supports querying of data related to entities who register public domains and other Internet resources (registrant name, org, contact info, name servers, etc.)

Organization's Website (as OSINT)

Marketing sites, often including an "About" page, that reveal purpose, goals, nature of the org, executive/personnel info, events, and links to social media

Related Websites

Secondary sites, subdomains, partner/subsidiary sites, and social media profiles that can expand OSINT beyond the primary site; e.g., the 2014 Target breach via a third-party HVAC supplier

Social Media (as OSINT)

Organization and individual profiles (Twitter, Facebook, LinkedIn, YouTube, Instagram, Reddit) that reveal marketing info as well as personal interests, habits, and relationships

Job Boards (as OSINT)

Job postings that reveal personnel makeup, technical sophistication, software architecture, programming languages, hardware, and network/security systems used

Google Hacking

The process of using the Google search engine and special search operators to identify potential security weaknesses in publicly available sources

Google Operator: site

Searches a specific site, e.g., site:comptia.org report

Google Operator: link

Searches for pages that link to the specified page, e.g., link:comptia.org report

Google Operator: filetype

Searches for specific file types, e.g., filetype:pdf report

Google Operator: intitle

Searches for page titles, e.g., intitle:Certification report

Google Operator: inurl

Searches for URLs, e.g., inurl:Certification report

Google Operator: inanchor

Searches for anchor text, e.g., inanchor:Certification report

Online Articles and News (as OSINT)

Mainstream news, financial publications, and press releases that reveal services, fiscal performance, unethical practices, or acquisitions affecting people/products/technology

DNS Querying

Queries for name resolution info that reveal a target's network structure; standard queries find IPs, advanced queries retrieve MX/NS/TXT records and more

Zone Transfer

A DNS operation that, if improperly configured, allows transfer to untrusted domains, enabling enumeration of hosts accessible from the Internet

MX Record

DNS record type that identifies which server handles incoming mail for a domain; compromising it means compromising communication

Sender Policy Framework (SPF)

A kind of framework that validates incoming mail from a domain comes from a trusted IP address, mitigating email spoofing in spam/phishing

Subject Alternative Name (SAN)

This can identify specific subdomains, other domains, IP addresses, and email addresses the cert applies to

Wildcard Certificate

An SSL/TLS certificate using an asterisk (*) to denote all subdomains, making it harder to identify specific subdomains

CT Framework

This Framework publishes CA issuer logs containing info about domains/subdomains certs apply to, helping discover subdomains covered in the past

Shodan

A search engine that enables anyone to connect to public or improperly secured Internet-connected devices by banner grabbing through ports (e.g., exposed IP cameras, ICSs, IoT devices)

theHarvester

An open source OSINT tool that gathers subdomain names, employee names, email addresses, PGP keys, and open ports/service banners using search engines, Comodo, social media, and Shodan

Recon-ng

A command-line open source OSINT tool similar to but more robust than theHarvester, using dozens of modules that each run a specific type of query

Maltego

A graphical OSINT tool that features OSINT objects graphically with links to other objects, using "transforms" to automate querying and visualize relationships in node graphs

Fingerprinting Organizations with Collected Archives (FOCA)

A GUI OSINT tool (Windows only) that discovers hidden metadata within documents, such as names, software/OS versions, printer info, and plaintext passwords

Weaponization

The process of turning passive recon results into directions or launch points for active recon and preliminary attacks

Content of Interest

Categories to analyze from OSINT findings: IP addresses/subdomains, external/third-party domains, key personnel, social engineering-enabling info, and technology info

Public IP Addresses (as OSINT)

IP ranges organizations use to communicate with the outside world; can be leveraged through active scanning to discover services, ports, and OS info, or as entry points into the private network

External and Third-Party Sites

Partner, contractor, or unrelated sites (e.g., Glassdoor) not owned by the target org that can still reveal useful info, though action against them may be out of scope

Social Engineering

The practice of deceiving people into giving away access to unauthorized parties or enabling compromise of sensitive assets, exploiting natural human trust

Technologies (as Content of Interest)

Info about an org's tech stack (e.g., Apache vs. IIS) that can indicate underlying OS, vendor reliance, or the presence of an AD environment, guiding vulnerability research