The information that is targeted for collection is dependent on the initial goal of the penetration
test.
For example, if testers want to access a personal health records, they will need the names and biographical
information of relevant parties involved.
Like their usernames and their passwords, third party insurance companies, health care providers,
head of I.T. operations in any industry, commercial suppliers and so on.
If the wrath of an attack involves social engineering, they may supplement this information with details
that give credibility to the request for information such as.
Domain names, identification of targets for the attackers or penetration testers during an external
scenario begins with domain names, which is the most circular element of open source intelligence subdomains.
These are the domains that are part of the main domain.
For example, if the domain offered to the target is sampled dot com, it might be used them or dot
sample dot com production dot sample, dot com e-commerce, dot sample, dot com and so on.
Identification of these domains will provide the attackers with a wider range of assets to assess in
reconnaissance phase.
Dense entries in today's cyber world, everything can be potentially networked.
This means each device that is connected to the internet has unique IP addresses assigned to it.
Likewise, that DNS entries are list of human friendly names that are assigned with specific IP addresses.
For example, demo that sample dot com that is translated to an IP address is the format of, for example,
120 point x point x .245.
So DNS entries include a hostname and TSS name server C name canonical name M ex mail exchanged for
a DNS record to IPV six and as our way service record rt x TX which is text record obviously and P to
your point or record which is opposite to the A record.
So all this information will provide the attackers not only with the details relating to the DNS, but
also a wide range of other information such as what type of server service they run.
So which attackers can utilize the beginning keeping the attack strategy Mail Exchange.
Although we will find the Amex records from the dense entries identifying the mail exchange is treated
as a completely different set of enumeration, since most of the time they involve a third party that
provides mail delivery services which can be potentially utilized by the attackers to send bulk emails
by exploiting the SMTP normal functionality of the mail relay.
Dense reconnaissance and route mapping once a test that has identifying the target that has an online
presence and contains items of interest.
The next step is to identify the IP addresses and routes to the target system.
So DNS reconnaissance is concerned with the identifying who owns a particular domain or series of IP
addresses.
Information such as who is.
Although this has changed a lot after the General Data Protection Regulation and the DNS information
defining the actual domain names and IP addresses assigned to the target and the route between the penetration
tester or the attacker at the final target.
So this information gathering is semi active.
Some of the information is available from freely available sources, while other information is available
from third parties such as DNS registrars.
So although the registrar may collect IP addresses and data concerning requests made by the attacker,
but it's rarely provided to the end target.
So the information that could be directly monitored by the target, such as DNS server logs, is almost
never received or retained.
So because the information needed can be queried using a defined systematic and methodological approach,
its collection can be automated.
In next section, we will discuss how easy it will be to enumerate all the domain names just by using
simple tools that are pre-installed within Chalo Linux.
My name is Typhoon and I'm waiting you in next lecture.