đľď¸ Footprinting and Reconnaissance
The first step in the penetration testing process is footprinting and reconnaissance.
This phase involves gathering as much information as possible about the target system or network to identify potential vulnerabilities.
Information gathering can be done through various methods, including:
- Passive Footprinting: Collecting information without directly interacting with the target system.
- Active Footprinting: Actively probing the target system to gather information.
Footprinting with search engines
Section titled âFootprinting with search enginesâGoogle hacking
Section titled âGoogle hackingâGoogle hacking techniques are advanced search techniques that can be used to find specific information on the internet.
Image search engines
Section titled âImage search enginesâImage search engines can be used to find images related to a specific topic or similar to a given image.
Images can contain metadata that can be useful for footprinting.
Video search engines
Section titled âVideo search enginesâVideo search engines can be used to find videos related to a specific topic or keyword.
Videos like images can contain metadata that can be useful for footprinting.
FTP search engines
Section titled âFTP search enginesâFTP search engines can be used to find files and directories on FTP servers.
Like web pages also FTP servers can be indexed by search engines.
IoT search engines
Section titled âIoT search enginesâIoT search engines can be used to find Internet of Things (IoT) devices connected to the internet.
These search engines can be used to find devices like webcams, routers, and other IoT devices.
Footprinting with web services
Section titled âFootprinting with web servicesâWebsite discovery tools
Section titled âWebsite discovery toolsâPeople search tools
Section titled âPeople search toolsâThere are many web services that provide information about people, including social media profiles and contact information.
Dark and deep web searching
Section titled âDark and deep web searchingâThe deep web refers to parts of the internet that are not indexed by traditional search engines.
The dark web is a small part of the deep web that is intentionally hidden and inaccessible through standard web browsers.
The dark web is often associated with illegal activities, but it can also be used for legitimate purposes.
Footprinting With Social Networks
Section titled âFootprinting With Social NetworksâFootprinting for web servers
Section titled âFootprinting for web serversâIt is possible to gather information about a target website using the ping command line utility.
Information such as the IP address, hostname, and response time can be obtained.
ping TARGETOther tools
Section titled âOther toolsâ- Web Data Extractor: A tool for extracting data from websites.
- HTTrack Web Site Copier: A tool for downloading websites to your local machine.
Email footprinting
Section titled âEmail footprintingâEmails, email addresses, and email servers can be used to gather information about a target.
DNS and Whois footprinting
Section titled âDNS and Whois footprintingâWhois is a protocol used to query databases that store registered users or assignees of a domain name or an IP address block.
Whois databases are maintained by various organizations, including domain registrars and regional internet registries (RIRs).
DNS (Domain Name System) is a hierarchical naming system used to translate domain names into IP addresses.
nslookup
Section titled ânslookupânslookup is a command-line tool used to query DNS servers for information about domain names and IP addresses.
nslookup can be used to gather information about a targetâs DNS records, including A records, MX records, and NS records.
nslookup TARGETNetwork footprinting
Section titled âNetwork footprintingâNetwork footprinting is the process of gathering information about a target network, including IP addresses, subnets, and network devices.
traceroute
Section titled âtracerouteâtraceroute is a command-line tool used to trace the path that packets take from one host to another.
On Linux, the command is traceroute, while on Windows, it is tracert.
traceroute TARGETOther footprinting tools
Section titled âOther footprinting toolsâThere are many tools that integrate multiple footprinting techniques.