Passive information gathering is when you use an indirect approach to obtain information about your
target.
This method obtains information that is publicly available for many sources to use, eliminating direct
contact with the potential target.
Passive information gathering is usually fruitful, and a lot of organizations usually publish information
and details about their organization as marketing strategy for their existing and potential customers.
Sometimes when organizations advertise a vacancy on a job recruiting website, the recruiter post technical
requirements for the potential candidate.
From our penetration testers point of view.
The technical details can indicate the types of platforms and applications that are running within the
organization's network infrastructure.
As I mentioned previously, the first stage of penetration test is to gather as much information as
possible on a given target or organization.
Gathering information prior to exploiting and gaining access to a network or systems will help the penetration
tester to narrow the scope of the attack and design a specific types of attacks and payloads that are
suitable for the attack surface of the target.
We will begin our information gathering pace by utilizing the largest computer network in existence,
the Internet.
This diagram provides a brief overview of the different areas where open source intelligence can be
found on a target.
The Internet has many platforms ranging from forms and messaging boards to social media platforms.
A lot of companies create an online presence to help market their products and services to potential
clients.
In doing so, the creation of a company's website, Facebook, Instagram, Twitter, LinkedIn, and
so on ensures that their potential customers get to know how they are and what services and products
are offered.
The marketing department is usually responsible for ensuring that an organization's online presence
is felt and that their digital portfolio is always up to date and eye catching.
Organizations usually publish information about themselves on various Internet platforms, such as blogs
and recruitment websites, as the Internet is so readily available and by accessible, it's quite easy
for someone to gather information or target organization simply by using search engines and determining
their underlying infrastructure.
The technique is known as open source intelligence or as E and RT.
So this is where a penetration tester or ethical hacker uses a various tools and techniques that harness
information that's publicly available on the Internet to create a portfolio of the target.
It's awesome.
Is a type of passive information gathering where the penetration tester does not make direct contact
or connection with the actual target, but rather ask legitimate and reliable sources about the target.
Over the years, I have noticed a lot of job hunting websites where the recruiters post vacancies for
Internet technology positions within a company.
But the recruiter specifies that an ideal candidate should have experience with a specific technologies.
This can be a good thing for the company and the applicant, however, it can be bad as well.
So there's a pros and cons of companies posting their technologies on requirement websites so the pros
are the potential candidate will know what type of environment to expect if they are hired.
And the potential candidate can determine beforehand whether they have the skill set required for the
job or not.
But there are so cons here.
So the company is partially exposing their technologies to the general public, and the hacker can determine
the infrastructure and better select exploits and tools to perform a cyber attack.
So let's take a look at this screenshot from a job site.
So looking closely, we notice that the job poster has specified that they are using both Cisco and
HP Networking Technologies.
So the company uses an Avaya PBX systems as their voice over Internet protocol VoIP and they are running
Windows Server 2008 and or 2012 in their network.
So as a penetration tester, we can see that the company is using specific types of technology within
their I.T infrastructure.
From a penetration testers point of view, if this organization were a target for a penetration test,
we could now narrow our scope of attacks to these specific technologies.
Now that we have completed this lecture on better understanding open source intelligence.
So let's dive into practical of using osint tools.