WEBVTT 00:00.560 --> 00:06.050 So let's talk about some of the basics when it comes to foot printing. 00:06.320 --> 00:11.840 Remember, foot printing is going to be followed by a discussion of enumeration. 00:12.350 --> 00:17.510 But when it comes to foot printing, I want you to immediately think about the two types, and those 00:17.510 --> 00:19.700 are active and passive. 00:20.000 --> 00:28.520 Let me do a quick example of an active reconnaissance or foot printing type of information session. 00:29.400 --> 00:30.520 Yeah, you guessed it. 00:30.540 --> 00:32.100 We don't have to be fancy. 00:32.130 --> 00:44.100 If I ping some device on my local network, I know my IP address is 192168 127 and I have a 24 bit mask. 00:44.370 --> 00:51.390 So here I am trying to see if there is a network entity alive at 1921681 ten. 00:51.750 --> 00:55.920 Now we are not getting responses to our ping. 00:56.100 --> 01:00.030 This doesn't necessarily mean there is no machine there. 01:00.210 --> 01:06.870 That machine may be in a security posture where it is not responding with echo replies. 01:07.170 --> 01:07.750 Okay. 01:07.770 --> 01:08.570 Well, guess what? 01:08.580 --> 01:10.080 Why don't we try 11? 01:10.260 --> 01:11.160 No, no. 01:11.160 --> 01:11.850 Good there. 01:12.090 --> 01:14.420 Notice a better way for me to go? 01:14.430 --> 01:17.940 Oh, and this is more interesting here. 01:18.150 --> 01:19.910 Notice I am getting a response. 01:19.920 --> 01:22.590 Destination host unreachable. 01:22.830 --> 01:25.570 So it looks like trying to get to that device. 01:25.590 --> 01:34.950 We had a situation where it is being filtered and ICMP responses ended up reaching us, telling us that 01:34.950 --> 01:36.330 that host can't be reached. 01:36.540 --> 01:41.460 So that definitely looks like there's a host there that is not responding. 01:41.460 --> 01:47.490 Let's try to one above the dot one default gateway address and look at that. 01:47.760 --> 01:57.660 We just found a device that is responding to ICMP echoes and it is at 19216812. 01:57.900 --> 02:02.160 What we're doing right now is active foot printing. 02:02.430 --> 02:06.900 And why we consider it active is because we can get caught. 02:07.440 --> 02:13.830 Yes, any network administrator worth their salt is going to be watching out for someone on their network 02:14.070 --> 02:16.620 doing what I'm doing right now. 02:16.770 --> 02:21.960 And that is pinging around trying to footprint the network environment. 02:22.200 --> 02:26.130 This sticks out like a sore thumb to use that expression. 02:26.400 --> 02:28.140 So this is not good. 02:28.620 --> 02:29.010 I mean. 02:29.190 --> 02:30.990 Well, let's back up a minute here. 02:31.200 --> 02:36.660 This is great for the person that's doing the attack because they're getting great information. 02:36.960 --> 02:41.850 But because it is active foot printing, they might get caught. 02:42.150 --> 02:42.560 Okay. 02:42.570 --> 02:47.190 So that's that's the trade off with this style of foot printing. 02:47.220 --> 02:48.510 It's called active. 02:49.140 --> 02:56.430 Now, if you're not actively engaging in foot printing, you're passively engaging in foot printing 02:56.430 --> 03:00.450 in this is scarier because it might go undetected. 03:00.750 --> 03:08.130 So maybe just totally legitimate traffic is being sent from one entity to like a broadcast address. 03:08.370 --> 03:15.630 And then there is a recognition of who received that broadcast and it's just, you know, disguised 03:15.630 --> 03:18.450 amongst other traffic in a passive way. 03:18.570 --> 03:21.780 So it wouldn't be as easily detected. 03:21.990 --> 03:27.520 We're going to be seeing examples of both active and passive foot printing, of course. 03:28.050 --> 03:34.080 Beyond the example I just gave with Ping as an example of actively seeing if something is out there 03:34.080 --> 03:42.870 alive and responding to you, what are the objectives of active and passive type of foot printing attacks 03:42.870 --> 03:49.530 while they're gaining information, maybe they're gaining information about your organization. 03:50.190 --> 03:55.110 Let's keep in mind that this is not always going to be technical in nature. 03:55.380 --> 04:05.130 So they may start to attack you by looking up the many public records about your organization that are 04:05.130 --> 04:06.240 readily available. 04:06.510 --> 04:10.380 They might even pose as a legitimate source for that information. 04:10.560 --> 04:17.370 So they'll pose as some financial entity in your establishment, and they'll be inquiring about public 04:17.370 --> 04:23.160 records, about their own organization, even though they're not in your organization because they're 04:23.160 --> 04:26.670 publicly available, they're given the records just as anyone would be. 04:26.670 --> 04:31.260 But you get the idea they'll masquerade as a corporate employee. 04:31.680 --> 04:38.640 They'll gain information from the network using scanning tools that are designed to get that information. 04:38.910 --> 04:47.010 They will get as much information as they can off the nodes or systems that are connected to your networks. 04:47.520 --> 04:51.900 And if they're hacking you as part of a team, what are their products? 04:52.020 --> 04:58.600 What are they bringing to the rest of their team members after their often long hours? 04:58.620 --> 05:01.170 And by the way, that's an important point. 05:01.410 --> 05:08.460 One of the reasons this is such a challenging area for cybersecurity teams to guard against is the incredible 05:08.460 --> 05:14.550 amount of time that the attackers have in comparison, typically to those of us that are working in 05:14.550 --> 05:22.020 the field, either as a member of a corporate security team or maybe we're on a pen test, we have limited 05:22.020 --> 05:23.970 amounts of time to defend. 05:24.120 --> 05:28.710 They have often times massive quantities, amounts of time. 05:28.960 --> 05:32.590 With which to perform these reconnaissance types of attacks. 05:32.920 --> 05:34.780 So what are they really trying to do? 05:34.810 --> 05:42.070 They're trying to get a great look at the security posture of us or our organization. 05:42.430 --> 05:47.590 They may even know more about the security posture than our own other departments. 05:47.590 --> 05:48.040 And that's. 05:48.880 --> 05:54.430 They're trying to reduce their overall focus, their overall scope. 05:54.640 --> 06:01.480 They're trying to figure out where are the weaknesses so that we can really spend time attacking those. 06:01.930 --> 06:09.460 They're mapping what vulnerabilities might be identifiable in your environment so that they can leverage 06:09.460 --> 06:11.560 those vulnerabilities with exploits. 06:11.890 --> 06:19.450 And sadly, they're making network maps that might even be better than the documentation that you might 06:19.450 --> 06:21.730 find in your own organization. 06:21.850 --> 06:22.390 Yikes. 06:22.630 --> 06:30.640 So these are their, quote unquote products that they would be really loving to gain as deliverables. 06:31.180 --> 06:35.260 Well, I hope you enjoyed just the basics of footprint. 06:35.680 --> 06:41.650 Now we're going to be getting into specific ways to do it and specific tools that might be used against 06:41.650 --> 06:41.950 us.