FOOTPRINTING/RECONNAISSANCE

This refers to the act of checking out the network, getting familiar with its layout, etc, in order to attack it - in other words, we are just gathering target information. We try to create a complete profile, with domain names, network blocks and individual IP addresses.

There is no one way to footprint. Different situations will take different paths. In general, we try to find:

• Domain Names (both external and internal)
• Network blocks
• Specific IPs (both reachable by internet and unreachable outside the local network)
• Access control mechanisms
• System architectures
• Intrusion detection systems
• an enumeration of the system (user and group names, system banners, routing tables, SNMP information)
• Networking protocols

This part of the attack can be both technical and physical. We consult as many sources as possible to glean information about the network.
A good starting point is the targets website – where we can look for email addresses, links to other servers, contact information, etc. It is sometimes easier to download an entire website to view offline than looking at it online, check out my tutorial here. You can use the wget command on linux. FOCA is another tool to use to find some very useful information about websites such as metadata.

Perform whois searches on domains to gain more information, including nameservers, etc. Link. The whois command on linux is also very useful, you can use it to perform very specific searches – for example registrar queries, organizational queries, domain queries, network queries and POC queries.

Use netcraft to find a lot of useful information about a site.
Some tools will help with the footprinting process, for example Spiderfoot.
EDGAR is also a semi-useful resource.

We can also use a security flaw in misconfigured DNS servers called Zone transfers to easily get a lot of information about the system. A zone transfer can give us an entire blueprint of the target network – internal hostnames and IP addreses.
This code demonstrates how to manually request a zone transfer from a misconfigured DNS server:

Code:

[bash]$ nslookup
Default Server: dns.example.com
Address: 192.168.0.1
>> server 192.168.0.1
Default Server: [192.168.0.1]
Address: 192.168.0.1
>> set type=any
>> ls –d Example.com. >> /tmp/dns_zone_transfer

That will save the information in a file called dns_zone_transfer which we can then view to gain more information. We can use commands like grep to find systems in the zone transfer that are potentially vulnerable to attack, and we can find systems with interesting names that may be very useful to us – for example we may find a backup server or something. It is often useful to find “test” systems which are often badly set up, and then rarely used – because they are the perfect place to set up our “camp” in the network.

There are a lot of useful network query tools we can use to gain information as well, including the host command:

Code:

host –l Example.com

Or

Code:

host –l –v –t any Example.com

Also, check out the dig command on Linux which is also a very useful command.
Some other good tools can be downloaded here. 

Traceroute is a useful tool which we can use to map out networks. In Linux, this is the traceroute command, and in windows this is the tracert command. By using this command with an IP address of domain name, we can see what route our packet takes to get to a server. We can use the –p –s switches with the command to set a specific port to use – in case only certain ports are allowed through a firewall, etc. Port 53 is the DNS lookup port so that is generally allowed through:

Code:

traceroute –S –p53 10.10.10.2