-: Welcome back.
It is time we learn in details
what is ""Information Gathering"" and how can we perform it?
We already know that ""Information Gathering""
is the first step in penetration testing, and it is an act
of gathering data about our target.
It can be any type of data that we might find useful
for the future attack.
And if you remember,
there are two types of "Information Gathering".
We got active "Information Gathering",
and passive "Information Gathering".
And we talked briefly about them
but now it is time to fully explain what both of them are.
So let's start with active "Information Gathering".
In active "Information Gathering",
we use our Kali Linux machine
and we try to get as much data or as much information
about our target while interacting with them.
It could be a target website that we need to test,
so we need to find as many things about it as we can.
Or, it could also be a network that we are testing,
or perhaps an entire company.
The main point is that with active "Information Gathering"
we directly get that data from the target.
This could mean directly exchanging packets
with the target by visiting and enumerating their website
or, it could also mean talking
to an employee that works there.
We could maybe call them over mobile phone to
try to get them to tell us something important,
but this part is also considered social engineering.
Nonetheless, any action where you exchange something
with the target is active "Information Gathering".
This can be legal to an extent.
If you start performing some advanced scans
or OS fingerprinting on the target,
you most likely won't get in trouble
but you should still not do it without permission.
And it is important to mention that,
usually active "Information Gathering" will provide us
with much more important data
than passive "Information Gathering",
since we are directly interacting with the target.
On the other hand, we got passive "Information Gathering"
and it is similar.
We got our Kali Linux machine and our target, but we also
have an intermediate system or what I like to
call a middle source.
And what this middle source is, well, basically
it could be anything from a search engine to a website.
It could also be a person,
but what matters is that information we get is going
through that middle source.
For example, if we want to find out something
about a certain target, and we Google that target to
find some pages that contain information about it,
this is considered passive "Information Gathering".
Okay, good.
But what are the goals of this?
What exactly are we searching for?
Which information could be of value to us?
Usually the first thing we search to
identify a target, is there IP address or IP addresses
if the target has multiple addresses that belong to them.
This could be, for example, a company that has servers
and buildings all around the world.
And if we were to test this company,
we would also be interested in their employees too.
For example, we would want to gather their emails
which could be useful
for a future attack to gain access to that company.
Or we could possibly want to gather their phone numbers
which could also be useful.
But most importantly, and what we are mainly interested in
are technologies that the target has.
If it was a company, we would want to know how
many networks they have, what softwares are running
on their machines, what operating systems they have.
If it was a website
we would also want to know,
how that website was built,
which programming languages it has.
Does it have JavaScript or PHP?
For example, just one software
on one machine that is outdated or that has
unknown vulnerability,
that could be exploited is our way in.
So, now that we know what we are looking for
during this first step, it is time we see what tools
and programs can we use to find out
as much information as possible about our target.
Let's do it.