Ethical Hacking: Information Gathering Study Notes

Introduction to Ethical Hacking

• Ethical hacking is the authorized process of identifying vulnerabilities in systems, networks, or applications. It is performed with legal permission and aims to strengthen security, not to exploit it.
• Difference from malicious hackers: ethical hackers operate with permission and work to improve security; malicious hackers do not have permission and seek to cause harm.
• Real-world example: a company hires an ethical hacker to test its firewall and report weaknesses before an attacker can exploit them.
• Simple explanation: ethical hacking is using skills to test a system or network to find vulnerabilities with owner’s permission, to improve security.
• Real-world coffee shop analogy: manager hires an ethical hacker to try to break into the system to find weaknesses, then fixes them so customer data and online orders are safe.

The Role of Information Gathering

• Information gathering is the first and most critical stage of any penetration test.
• Goal: collect as much data as possible about the target to identify potential attack vectors.
• Example: for a web application, map the site’s structure and identify technologies used (e.g., Apache, PHP, MySQL).
• Analogy: reconnaissance on an enemy’s position before an attack; you want to know layout, defenses, and weaknesses.
• Outcome: better planning and more informed testing process.

Types of Information Gathering

• Broad idea: information gathering can be passive or active.

Passive Information Gathering

• Collect publicly available data without direct interaction with the target.
• Examples listed: HOI lookups, DNS record searches, social media analysis, scanning public data sources.
• Simple explanation: passively gathering information reduces the risk of detection.
• Real-world example: a Hoy search might reveal the domain owner’s name and email address.
• Passive techniques provide initial insights without touching the target directly.

Active Information Gathering

• Involves interacting with the target to retrieve information; simulates user activity.
• Examples listed: port scans, banner grabbing, DNS zone transfers.
• Real-world example: a tool like mapsvtarget.com actively scans the host for open ports and running services.
• Active gathering yields a more accurate picture but carries higher detection risk.

Passive Information Gathering Techniques (Overview)

• Techniques include: HOI lookups, DNS record searches, social media analysis, and scanning public data sources.
• Purpose: gather context about ownership, infrastructure, and public exposure without triggering direct responses from the target.
• Example scenario: a simple HOI (whois) search might reveal a company owner’s name and email address.
• Caution: data gathered passively can be misleading if not corroborated with active checks.

Active Information Gathering Techniques (Overview)

• Involves probing the target directly to collect data.
• Common methods: port scanning, banner grabbing, DNS zone transfers, etc.
• Real-world example: running a targeted scan against a web application to identify exposed services.

Port Scanning

• Purpose: identify open ports and running services; this reveals potential entry points.
• Analogy: checking which doors in a house are open and what’s behind them.
• Example: using a tool to scan a website like $ext{http://target.com}$ across a port range.
• Specific command example (as described): $ext{map p1 to 65535 target.com}$ to see which ports/services are exposed.

Service Fingerprinting

• Goal: determine the exact software and version running on a service port.
• Analogy: identifying a car model by its distinctive features.
• Example: using a tool’s SV option to reveal if an Apache server is outdated and vulnerable to known exploits.
• Practical significance: helps decide whether to test for specific vulnerabilities and plan mitigations.

Network Sniffing

• Purpose: capture and analyze network traffic to uncover credentials, unencrypted data, and protocols in use.
• Common tool: Wireshark.
• Example: Wireshark can capture plaintext HTTP logins on insecure websites.
• Real-world scenario: on a public (unsecured) Wi‑Fi, an attacker could capture unencrypted login credentials.

OSINT Gathering (Open Source Intelligence)

• OSINT collects data from public sources such as websites, forums, and databases.
• Simple analogy: searching for lost documents on a public library shelf.
• Real-world example: searching siteexample.com for PDF files to reveal internal documents exposed online.
• Benefits: gathers insights that might be hidden in plain sight, such as inadvertently exposed internal documents.

Email Harvesting

• Definition: collecting publicly available email addresses, which can be tested for breaches or phishing risks.
• Tool example: using TheHarvester to collect emails from sources like LinkedIn and Google.
• Real-world scenario: publicly exposed emails found via search results can be tested for breaches or phishing risk.

Website Reconnaissance

• Maps the structure, technologies, and content of a website; identifies hidden content.
• Example: target.com reconnaissance showing CMS and plugins used (e.g., WordPress and plugins).
• Tools mentioned (informally): WatWeb for discovering CMS and plugins; reconnaissance helps identify potential security risks and informs testing scope.

DNS Enumeration

• Purpose: discover domain details such as subdomains, mail servers, and DNS records.
• Example described: using a tool to list DNS entries and potential hidden subdomains.
• Analogy: DNS enumeration is like a phone book for domains.
• Practical value: helps identify entry points or misconfigurations that could be exploited.

Hoi (WHOIS) and Domain Analysis

• HOI databases store domain registration information, which can reveal ownership, registrar, and contact information.
• Example: a domain’s technical contact email can be used in phishing awareness training scenarios.

Network Footprinting and DNS Discovery Tools

• Network footprinting involves mapping the network topology, identifying IP ranges, and discovering connected systems.
• Techniques mentioned: using traceroute to map the path packets take from your system to the target network.
• Traceroute steps (as described):
  • Sends packets with increasing hop counts.
  • Tracks the path and reveals IP addresses and networks along the way.
  • Displays results in a format showing which systems or networks are part of the route.
• DNS enumeration (revisited): discover subdomains, mail servers, DNS records, and other domain details.

Cloud and IoT Reconnaissance

Cloud Environment Recon

• Focus: identifying exposed cloud storage, APIs, and misconfigurations.
• Example: checking AWS S3 buckets for public access permissions.
• Real-world implication: exposing cloud data can be catastrophic; discovery helps prevent data leakage.
• Real-world analogy: leaving the front door unlocked; anyone could walk in.

IoT Device Reconnaissance

• IoT devices often run outdated software; recon involves identifying devices and checking for vulnerabilities.
• Example: using Shodan to find internet-exposed webcams with default passwords.
• Why it matters: insecure IoT devices can be exploited to pivot into broader networks.

Physical Security Assessment

• Physical recon checks the target’s physical access controls and security policies.
• Dumpster diving example: discarded documents in an unlocked dumpster could reveal sensitive information.
• Practical lesson: weaknesses in physical security can undermine digital defenses.

Tool Spotlight: Nmap

• Nmap is a powerful network scanner used for host discovery, service detection, and OS fingerprinting.
• Example: nmap target.com performs a comprehensive scan including version detection and traceroute.
• Practical value: helps identify what devices are online, what services they offer, and what OS they run.

Tool Spotlight: Wireshark

• Wireshark captures and analyzes network packets to help identify suspicious activity.
• Example: filtering packets to focus on HTTP traffic to spot unencrypted credentials.
• Analogy: like a GPS for network traffic; provides a detailed map of the data trail.

Tool Spotlight: Maltego (Mall2Go)

• Mall2Go (Maltego) visualizes relationships between people, domains, IPs, and other entities to identify phishing targets.
• Example use: mapping employees' LinkedIn connections to see who might be phished; helps security teams prioritize defense.
• Benefit: visualizes complex networks of connections to focus protective measures.

Tool Spotlight: ReconNG

• ReconNG is an open-source, modular reconnaissance framework that automates OSINT collection.
• How it works: uses pre-built modules to gather information from the internet with one script.
• What it gathers: subdomains, domain registration details, social media profiles linked to a target.
• Use case: investigating a new business partner by running a single script to collect OSINT across the web.
• Analogy: ReconNG is like a Swiss Army knife for automated information gathering.

The Harvester

• The Harvester gathers emails, subdomains, and hosts from public sources.
• Example: using the harvester with target.com and Google to collect data from public sources.
• Command pattern described: theharvester -d target.com -b Google
• Role: useful in reconnaissance or initial penetration testing stages to collect target intel.

Reporting Findings and Best Practices

• Reports should include technical details, risk ratings, and remediation steps.
• Example: highlighting an outdated Apache version and suggesting an upgrade.
• Best practices:
  • Validate all findings: double-check that vulnerabilities are real before reporting.
  • Protect sensitive data: handle confidential information securely.
  • Follow a consistent methodology: use a repeatable approach for reliability.
• Practical reporting steps: reproduce the vulnerability to confirm it is exploitable before including it in the report (to avoid false positives).

Conclusion

• Technical information gathering is essential for ethical hacking; detailed recon improves the accuracy and value of penetration tests.
• Example: comprehensive DNS enumeration could reveal a forgotten subdomain running an outdated application.
• Final analogy: a detective gathering clues before solving a mystery; ethical hackers collect information about a company’s technology, systems, and people to understand potential weaknesses and how to test defenses.
• Real-world takeaway: discovering a subdomain with an outdated application or other misconfigurations helps testers target defenses and improve security posture.