Introduction to information gathering, information gathering is the first and one of the most important
activities in penetration testing.
This step is carried out in order to find out as much information as possible about how to get machine.
The more information we have, the better our chances will be for exploiting the target.
During the information gathering phase, our main focus is to collect facts about the target machines,
such as the IP address, available services and open ports.
This information plays a vital role in the process of penetration testing to achieve this goal.
We will be and will be learning certain scanning techniques such as SMB scanning, SSL server scanning.
FTP scanning is an enumeration, how it be scanning, and we are scanning the brute forcing by end of
this course, actually in the middle of this course, of course.
So information gathering footprinting and enumeration are terms that are used often used interchangeably,
but they are still different.
According to the Sun, standard footprinting is the ability to obtain essential information about an
organization, so this information includes the technologies that are being used, such as internet,
intranet, remote access and extra on it.
In addition to the technologies, the security policies and procedures must be explored.
So scanning consists of six steps in mapping out whether a network is performing and automating ping
sweeper on the range of IP addresses and network blocks to determine if individual systems are alive.
So integration involves active connections to a system and directed queries.
So this is the type of information enumerated by hackers can be loosely grouped into categories such
as network resources and shares, users and groups, applications and banners and network blocks.
There are basically three types of techniques used in information gathering.
So first is passive information gathering.
This technique is used to gain information about the target without having any physical connectivity
or access to it.
So this means that we use other resources to gain information about a target, such as by using the
WHO is query server, look up and so on.
Suppose our target is an online application, but then a simple who is up can provide us with a lot
of information about the web application, such as its IP address, its domains and subdomains.
Uh, actually the location of server, of course, the hosting server and so on.
So the this information can be very useful during penetration testing as it can widen our track of exploiting
the target.
And then secondly, we have active information gathering.
So in this technique, a logical connection is to set up with the target in order to gain information.
So this technique provides us with the next level of information which can directly supplement our understanding
of the target security in port scanning.
The target is the most widely used active scanning technique in which we focus on the open ports and
available services running on a target.
And lastly, we have social engineering, so this type of information gathering is similar to passive
information gathering, but relies on Monero.
So and the information leaked out in the form of printouts, telephone conversations, incorrect email
ideas and so on.
So the techniques for utilizing this method are numerous, and the ethos of information gathering is
very different and social engineering is a category in itself.
For example, hackers who use their domain names that sound similar with the spelling mistakes and set
up a mail server to receive such a run or some emails.
Such domains are known as doppelganger domains.
This is the evil twin here.
So the victims of social engineering are tricked into releasing desired information that they do not
realize will be used to attack an enterprise network.
For example, an employee in an intrepid enterprise company may be tricked into revealing an employee
ID number to someone who's pretending to be someone he she trusts.
While the employee number may not seem valuable to the employee, which makes it easier for him to reveal
this information in the first place.
So the social engineer and the social engineer can use that employee number in conjunction with the
other information that has been gathered to get closer to finding your way into enterprise network.