CYS405 · Chapter 2 · Annotated SlidesInformation Gathering, Footprinting and Reconnaissance
Original
Overview

Information Gathering, Footprinting and Reconnaissance

What footprinting is and why it matters, the information-gathering process, what a company website leaks, Google hacking and the GHDB, registrar and WHOIS queries, nslookup, network ranges and traceroute, tracking employees and social networks, and countermeasures.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 40 slides
  1. 1 Slide 1
  2. 2 Learning Objective
  3. 3 Key Concepts
  4. 4 What is Footprinting?
  5. 5 Why Footprinting?
  6. 6 § There are a lot of places you, as an ethical hacker, can get
  7. 7 The Information-Gathering Process
  8. 8 The Information-Gathering Process (Cont.)
  9. 9 The Information-Gathering Process (Cont.)
  10. 10 The Information on a Company Website
  11. 11 The Information on a Company Website (Cont.)
  12. 12 The Information on a Company Website (Cont.)
  13. 13 The Information on a Company Website (Cont.)
  14. 14 The Information on a Company Website (Cont.)
  15. 15 Footprinting using using Advanced Google Hacking Techniques
  16. 16 Google Advanced Search Operators
  17. 17 Google Hacking (Cont.)
  18. 18 Google Hacking (Cont.)
  19. 19 Google Hacking (Cont.)
  20. 20 Slide 20
  21. 21 Slide 21
  22. 22 Exercises
  23. 23 Google Hacking Database (GHDB)
  24. 24 Google Hacking Database
  25. 25 Exploring Domain Information Leakage
  26. 26 Manual Registrar Query
  27. 27 Automatic Registrar Query
  28. 28 Whois
  29. 29 Nslookup
  30. 30 Nslookup
  31. 31 Slide 31
  32. 32 Determining a Network Range
  33. 33 Traceroute
  34. 34 Traceroute (Cont.)
  35. 35 Tracking an Organization’s Employees
  36. 36 Tracking an Organization’s Employees (Cont.)
  37. 37 Tracking an Organization’s Employees (Cont.)
  38. 38 Using Social Networks
  39. 39 Using Basic Countermeasures
  40. 40 Summary
Slide 1 / 40

Slide 1

Slide 1: Slide 1
Slide 2 / 40

Learning Objective

Slide 2: Learning Objective
Slide 3 / 40

Key Concepts

Slide 3: Key Concepts
Slide 4 / 40

What is Footprinting?

Slide 4: What is Footprinting?
Slide 5 / 40

Why Footprinting?

Slide 5: Why Footprinting?

Notes

  1. Why: learn the security posture, reduce the attack area, build a network map, find vulnerabilities.

Slide 6 / 40

§ There are a lot of places you, as an ethical hacker, can get

Slide 6: § There are a lot of places you, as an ethical hacker, can get
Slide 7 / 40

The Information-Gathering Process

Slide 7: The Information-Gathering Process

Notes

  1. The process: gather initial info → find the network range → find active machines → open ports and access points → OS fingerprinting → map the network.

Slide 8 / 40

The Information-Gathering Process (Cont.)

Slide 8: The Information-Gathering Process (Cont.)
Slide 9 / 40

The Information-Gathering Process (Cont.)

Slide 9: The Information-Gathering Process (Cont.)
Slide 10 / 40

The Information on a Company Website

Slide 10: The Information on a Company Website

Notes

  1. Company websites leak employee names, emails, technologies, locations, job postings that reveal systems.

Slide 11 / 40

The Information on a Company Website (Cont.)

Slide 11: The Information on a Company Website (Cont.)
Slide 12 / 40

The Information on a Company Website (Cont.)

Slide 12: The Information on a Company Website (Cont.)
Slide 13 / 40

The Information on a Company Website (Cont.)

Slide 13: The Information on a Company Website (Cont.)
Slide 14 / 40

The Information on a Company Website (Cont.)

Slide 14: The Information on a Company Website (Cont.)
Slide 15 / 40

Footprinting using using Advanced Google Hacking Techniques

Slide 15: Footprinting using using Advanced Google Hacking Techniques
Slide 16 / 40

Google Advanced Search Operators

Slide 16: Google Advanced Search Operators

Notes

  1. Google operators: site:, filetype:, inurl:, intitle:, intext:, cache:, link:.

Exam angle

PredictionQ1

Which query finds PDF files only on example.com?

Slide 17 / 40

Google Hacking (Cont.)

Slide 17: Google Hacking (Cont.)
Slide 18 / 40

Google Hacking (Cont.)

Slide 18: Google Hacking (Cont.)
Slide 19 / 40

Google Hacking (Cont.)

Slide 19: Google Hacking (Cont.)
Slide 20 / 40

Slide 20

Slide 20: Slide 20
Slide 21 / 40

Slide 21

Slide 21: Slide 21
Slide 22 / 40

Exercises

Slide 22: Exercises
Slide 23 / 40

Google Hacking Database (GHDB)

Slide 23: Google Hacking Database (GHDB)
Slide 24 / 40

Google Hacking Database

Slide 24: Google Hacking Database

Notes

  1. Google Hacking Database (GHDB): a catalogue of search queries ("dorks") that find exposed data.

Slide 25 / 40

Exploring Domain Information Leakage

Slide 25: Exploring Domain Information Leakage
Slide 26 / 40

Manual Registrar Query

Slide 26: Manual Registrar Query
Slide 27 / 40

Automatic Registrar Query

Slide 27: Automatic Registrar Query
Slide 28 / 40

Whois

Slide 28: Whois

Notes

  1. WHOIS: registrant names, emails, phone numbers, name servers, registration dates.

Exam angle

PredictionQ1

Which tool reveals a domain’s registrant and name servers?

Slide 29 / 40

Nslookup

Slide 29: Nslookup

Notes

  1. nslookup / dig query DNS records: A (IPv4), AAAA, MX (mail), NS (name server), CNAME, SOA, PTR.

Exam angle

PredictionQ1

Which DNS record identifies a domain’s mail servers?

Slide 30 / 40

Nslookup

Slide 30: Nslookup
Slide 31 / 40

Slide 31

Slide 31: Slide 31
Slide 32 / 40

Determining a Network Range

Slide 32: Determining a Network Range
Slide 33 / 40

Traceroute

Slide 33: Traceroute

Notes

  1. Traceroute lists the routers (hops) to a host using increasing TTL values: reveals network topology.

Slide 34 / 40

Traceroute (Cont.)

Slide 34: Traceroute (Cont.)
Slide 35 / 40

Tracking an Organization’s Employees

Slide 35: Tracking an Organization’s Employees
Slide 36 / 40

Tracking an Organization’s Employees (Cont.)

Slide 36: Tracking an Organization’s Employees (Cont.)
Slide 37 / 40

Tracking an Organization’s Employees (Cont.)

Slide 37: Tracking an Organization’s Employees (Cont.)
Slide 38 / 40

Using Social Networks

Slide 38: Using Social Networks

Notes

  1. Social networks (LinkedIn, etc.) reveal employees, roles, technologies: material for social engineering.

  2. Seen again Chapter 9: Social Engineering, slide 3: social engineering

Slide 39 / 40

Using Basic Countermeasures

Slide 39: Using Basic Countermeasures

Notes

  1. Countermeasures: limit what’s published, private WHOIS, staff awareness, remove sensitive metadata, monitor search engines.

Slide 40 / 40

Summary

Slide 40: Summary