Section 5: Information Gathering

Information Gathering in Penetration Testing

Overview

• Information gathering is a critical initial step in penetration testing.

• It involves collecting extensive information about the target to set the stage for subsequent actions.

• This process is iterative, requiring testers to revisit targets as new information is discovered.

• Focus is on Domain 2: Reconnaissance and Enumeration, particularly objective 2.1: applying information gathering techniques given a scenario.

Key Terms

Passive Reconnaissance

• Gathering information without direct interaction with the target system.

• Analogous to a detective observing without being noticed.

• Example: Using dig command-line tool to gather DNS information (domain names, IP addresses, DNS records) without directly interacting with the domain.

Active Reconnaissance

• Involves direct interaction with the target system to gather data.

• More intrusive and carries a higher risk of detection.

• Example: Using ping scans to determine if a host is online, which is easily detectable by defense systems.

OSINT (Open Source Intelligence)

• Utilizing publicly available sources to gather information.

• Examples:

  • Analyzing job postings and descriptions to understand a company's operations.

  • Examining a company's website to identify key personnel.

Topics Covered

• Network Sniffing: Listening to network traffic to gather valuable information.

• Port and Protocol Scanning: Discovering open ports and understanding the protocols in use.

• HTML Scraping and Cached Pages: Collecting data from web pages and cached browser content.

• Banner Grabbing: Pulling information from service banners to identify software versions and services.

• Hands-on Banner Grabbing Demonstration: Practical skills to extract information from systems.

• Quiz and Review: Assessing learning with a quiz and detailed review of each question.

Passive Reconnaissance

Primary Tools and Techniques

• Passive reconnaissance involves gathering information without direct interaction with the target system, minimizing the risk of detection.

Public Source Code Repositories

• Platforms like GitHub, Bitbucket, and SourceForge are used to host project code, enhancing collaboration and speeding up development.

• Risk: Sensitive information such as hostnames, IP addresses, database servers, service configurations, and credentials can be inadvertently exposed.

• Example: Hard-coded credentials for database access in publicly available code.

  • $Unauthorized \ access \ to \ sensitive \ data$

• Deployment scripts may reveal server configurations or environmental variables.

• Pen testers can uncover vulnerabilities by examining code and metadata without engaging the target network.

Images and Archived Websites

• Tools like Wayback Machine allow access to older website versions, capturing snapshots of past content.

• Reveals security lapses or sensitive information no longer available on the current site, such as directories or deprecated user interfaces.

• Image searches via Teni or Google can unveil information embedded in images, providing clues about the organization's activities or infrastructure.

• Example: Company event photo with visible login credentials on a whiteboard in the background.

Command Line Tools (e.g., DIG)

• Testers can query DNS records to retrieve information about domain names, IP mappings, and other DNS-related data without directly interacting with the target system.

• Provides insights into organizational structure and IT infrastructure.

Network Sniffing

Overview

• Network sniffing involves capturing data packets as they travel across a network to monitor network traffic in real-time.

PCAP Files

• PCAP (packet capture) files are used to capture and log data flowing across a network during a specified period.

• Useful for detailed analysis and replaying network interactions to identify specific events.

• Diagnosis for intermittent network issues and forensic analysis after security breaches.

• Example: Using TCP dump to capture all packets transmitted over a network interface.

Wireshark

• Wireshark is a popular tool for analyzing PCAP files.

• Presents a user-friendly interface for in-depth examination of data packets.

• Filtering capabilities allow users to isolate packets based on protocols, IP addresses, port numbers, etc.

IoT and OT Domains

• IoT (Internet of Things) and OT (Operational Technology) environments often employ specialized protocols.

• Examples:

  • MQTT (Message Queuing Telemetry Transport) for lightweight messaging between devices with low bandwidth.

  • Modbus for industrial environments to establish primary/secondary relationships between controllers.

• These protocols may require additional configurations or plugins in Wireshark for proper analysis.

• Monitoring these protocols is crucial for detecting anomalies, such as unusual command sequences or unauthorized access attempts.

Active Reconnaissance

Overview

• Active reconnaissance involves directly interacting with the target system to gather data, which can be risky as it might alert the target.

Protocol Scanning

• Scanning involves sending packets to a target to find out which protocols are being used (e.g., FTP, SSH, SMTP, HTTP).

• Example: Using Nmap to scan for open ports associated with these protocols.

TCP/UDP Scanning

• TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) scans are used to find open ports and services running on those ports.

• TCP scanning involves initiating a handshake (SYN scan) to check if a port is open.

  • A SYN-ACK response indicates an open port.

• UDP scanning involves sending UDP packets to various ports.

  • No response usually means the port is being blocked, while an ICMP port unreachable error suggests a closed port.

Banner Grabbing

• Banner grabbing is used to gather information about the software running on a network, including the type and version of the software.

• This involves connecting to a remote service and recording the banner information that the service sends back.

• Example: Using Telnet or specialized scripts to send requests and capture banner data.

• Example: Using the curl -I www.google.com command, which sends a head request to the server, fetching the headers of the document can reveal critical data about server configurations, like the server type, cookies, policies, and more.

Port and Protocol Scanning

Overview

• Port scanning involves sending packets to specific ports on a host and analyzing the responses to learn about the state of the ports and services.

TCP Scanning

• TCP (Transmission Control Protocol) is a connection-oriented protocol.

• SYN scan (half-open scan): The scanner sends a SYN packet to initiate communication.

  • If the target responds with SYN-ACK, the port is open.

  • The scanner then sends a RST packet to abort the connection.

UDP Scanning

• UDP (User Datagram Protocol) is connectionless.

• If an ICMP port unreachable error is returned, the port is closed.

• If there is no response, the port could be open or filtered.

Protocol-Specific Assessments

• FTP (File Transfer Protocol): Port 21, known for insecure data transmission.

  • Finding an open FTP port might lead to testing for anonymous access or brute-forcing credentials.

• SMTP (Simple Mail Transfer Protocol): Port 25, used for sending emails.

  • Checking for open email relays or gathering email headers.

• DNS (Domain Name System): Port 53, translates domain names to IP addresses.

  • Revealing information about domain names and associated IP addresses.

• HTTP (Hypertext Transfer Protocol): Ports 80 (non-secure) and 443 (HTTPS - secure).

  • Uncovering active web servers and potential misconfigurations or vulnerable web applications.

• SMB (Server Message Block): Ports 139 and 445, used for file sharing and network browsing.

  • Open SMB ports can pose a significant security risk.

Example Nmap Commands

• TCP SYN Scan:

  • $nmap \ -sS \ -p1-65535 \ scanme.nmap.org$

• UDP Scan:

  • $nmap \ -sU \ -p1-65535 \ scanme.nmap.org$

HTML Scraping and Cached Pages

HTML Scraping

• HTML scraping involves collecting data from a website's HTML code to uncover hidden details within a site's markup.

• Comments or meta tags may reveal backend technologies, server types, or internal IP addresses.

• Tools like Beautiful Soup in Python can be used.

• Inspect element on the web page to view HTML source of the web page being rendered.

• Example: finding comments like note, update server to version two point o next month,

• Example: meta tag name equals generator, content equals Drupal eight dot nine indicating software versions vulnerable to remote code execution.

Cached Pages

• Cached pages through search engines like Google and services like Wayback Machine help access content that has been deleted or altered.

• Example:

  • cache colon URL in Google to view cached version.

• HTTP Header sniffing tools provide valuable insights.

• Example output: Apache two dot four dot two nine on Ubuntu

Banner Grabbing

Overview

• Banner grabbing involves extracting information about a target system's network services running on open ports.

• Helps identify service details such as the type of server software, version, and sometimes the operating system.

Tools for Banner Grabbing

• Wget: Fetches content from web servers and receives server headers (HTTP banners).
  * Example:
  * wget www.deonattorney.com-capitals

• Netcat: Versatile tool for network debugging and investigation.
  * Example:
  * echo dash e n git forward /http/1.0backslashnbackslashnspacepipe nc www.dianatraining.com 80 pipe grep server

• Nmap: Used for service version detection with the -sV flag and Nmap Scripting Engine (NSE).
  * Example:
  * nmap dash s capitals v dash dash script equals banner, then you input the target IP address or DNS name

• Curl: Retrieves headers from web servers. Example:
  * curl -capitali www.dmtraining.com

Vulnerability Identification

• Example: Discovering an outdated version of Apache (e.g., Apache 2.2.34) reveals susceptibility to vulnerabilities like Optionbleed (CVE-2017-9798).