CEH Practical: Information-Gathering Methodology

 

Information gathering can be broken into seven logical steps. Footprinting is performed during the first two steps of unearthing initial information and locating the network range.

Footprinting

Footprinting is defined as the process of establishing a scenario or creating a map of an organization's network and systems. Information gathering is also known as footprinting an organization. Footprinting is an important part of reconnaissance process which is typically used for collecting possible information about a targeted computer system or network. Active and Passive both could be Footprinting. The example of passive footprinting is assessment of a company's website, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering. Basically footprinting is the beginning step of hacker to get hacked someone because having information about targeted computer system is the main aspect of hacking. If you have an information about individual you wanna hack so you can easily hacked that individual. The basic purpose of information gathering is at least decide what type of attacks will be more suitable for the target. Here are some of the pieces of information to be gathered about a target
during footprinting:

• Domain name
• Network blocks
• Network services and applications
• System architecture
• Intrusion detection system
• Authentication mechanisms
• Specific IP addresses
• Access control mechanisms
• Phone numbers
• Contact addresses

Once this information is assemble, it can give a hacker better perception into the organization, where important information is stored, and how it can be accessed.

Footprinting Tools 

Footprinting can be done using hacking tools, either applications or websites, which allow the hacker to locate information passively. By using these footprinting tools, a hacker can gain some basic information on, or "footprint," the target. By first footprinting the target, a hacker can eliminate tools that will not work against the target systems or network. For example, if a graphics design firm uses all Macintosh computers, then all hacking software that targets Windows systems can be eliminated. Footprinting not only speeds up the hacking process by eliminating certain tool sets but also minimizes the chance of detection as fewer hacking attempts can be made by using the right tool for the job. Some of the common tools used for footprinting and information gathering are as follows:

• Domain name lookup
• Whois
• NSlookup
• Sam Spade

Before we discuss these tools, keep in mind that open source information can also yield a wealth of information about a target, such as phone numbers and addresses. Performing Whois requests, searching domain name system (DNS) tables, and using other lookup web tools are forms of open source footprinting. Most of this information is fairly easy to get and legal to obtain.

Footprinting a Target 

Footprinting is part of the preparatory pre-attack phase and involves accumulating data regarding a target's environment and architecture, usually for the purpose of finding ways to intrude into that environment. Footprinting can reveal system vulnerabilities and identify the ease with which they can be exploited. This is the easiest way for hackers to gather information about computer systems and the companies they belong to. The purpose of this preparatory phase is to learn as much as you can about a system, its remote access capabilities, its ports and services, and any specific aspects of its security.

DNS Enumeration

DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. A company may have both internal and external DNS servers that can yield information such as usernames, computer names, and IP addresses of potential target systems.

NSlookup and DNSstuff

One powerful tool you should be familiar with is NSlookup (see Figure 2.2). This tool queries DNS servers for record information. It's included in Unix, Linux, and Windows operating systems. Hacking tools such as Sam Spade also include NSlookup tools. Building on the information gathered from Whois, you can use NSlookup to find additional IP addresses for servers and other hosts. Using the authoritative name server information from Whois ( AUTH1.NS.NYI.NET ), you can discover the IP address of the mail server.

Syntax

nslookup www.sitename.com

nslookup www.usociety4.com

Performing DNS Lookup

This search reveals all the alias records for www.google.com and the IP address of the web server. You can even discover all the name servers and associated IP addresses.

Understanding Whois and ARIN Lookups

Whois evolved from the Unix operating system, but it can now be found in many operating systems as well as in hacking toolkits and on the Internet. This tool identifies who has registered domain names used for email or websites. A uniform resource locator (URL), such as www.Microsoft.com , contains the domain name ( Microsoft.com ) and a hostname or alias ( www ).
The Internet Corporation for Assigned Names and Numbers (ICANN) requires registration of domain names to ensure that only a single company uses a specific domain name. The Whois tool queries the registration database to retrieve contact information about the individual or organization that holds a domain registration.

Using Whois

• Go to the DNSStuff.com website and scroll down to the free tools at the bottom of the page.
• Enter your target company URL in the WHOIS Lookup field and click the WHOIS button.
• Examine the results and determine the following:
  
  • Registered address
  • Technical and DNS contacts
  • Contact email
  • Contact phone number
  • Expiration date

• Visit the company website and see if the contact information from WHOIS matches up to any contact names, addresses, and email addresses listed on the website.

• If so, use Google to search on the employee names or email addresses. You can learn the email naming convention used by the organization, and whether there is any information that should not be publicly available.

Syntax

whois sitename.com
whois usociety4.com

Read more

1. Hacker Tool Kit
2. Pentest Tools Review
3. Hacking Tools For Games
4. Hacker Hardware Tools
5. Free Pentest Tools For Windows
6. Hacking Tools For Mac
7. Hacking Tools And Software
8. Pentest Tools Free
9. Underground Hacker Sites
10. Hacker Tools Apk Download
11. Hacking Tools Name
12. Pentest Reporting Tools
13. Hacker Tools
14. Hacker
15. Hacker Tools For Windows
16. New Hack Tools
17. Pentest Tools Github
18. Hack Website Online Tool
19. Hack Tool Apk No Root
20. Hacker Techniques Tools And Incident Handling
21. How To Install Pentest Tools In Ubuntu
22. Hacker Tools Linux
23. Game Hacking
24. Pentest Tools For Android
25. Pentest Tools Url Fuzzer
26. Hacking Tools Pc
27. Hacker Tools Software
28. Hacker Tools Mac
29. Hacker Tools
30. Hacking Tools For Mac
31. Beginner Hacker Tools
32. Hack App
33. Underground Hacker Sites
34. Hacking Tools Free Download
35. Usb Pentest Tools
36. Android Hack Tools Github
37. Pentest Tools Windows
38. Hackers Toolbox
39. Usb Pentest Tools
40. Hack Tools
41. Hacker Tools Apk
42. Pentest Recon Tools
43. Termux Hacking Tools 2019
44. Pentest Tools List
45. How To Hack
46. Hacker Tools Software
47. Hacking App
48. Hacking Tools For Beginners
49. Hacking Tools For Pc
50. Hacker Tools For Ios
51. Hack Tools Pc
52. Hacker Tools
53. Underground Hacker Sites
54. Pentest Tools Framework
55. Hacking Tools Windows 10
56. Android Hack Tools Github
57. Hack Tools For Windows
58. Hacking Tools For Windows Free Download
59. Hacking Tools For Windows 7
60. Tools 4 Hack
61. Hacking Tools Name
62. Hack Tool Apk
63. Hacker Tools
64. Hack Apps
65. Physical Pentest Tools
66. Hacking Tools Software
67. Hack Tools For Pc
68. Pentest Tools Url Fuzzer
69. Hack Tools Github
70. Hack Apps
71. Hacking Tools Free Download
72. Pentest Tools Linux
73. Pentest Tools Github
74. Hacking Tools For Pc
75. Hacker Techniques Tools And Incident Handling
76. Pentest Tools Subdomain
77. Hacking Tools Mac
78. Free Pentest Tools For Windows
79. Hacking Tools Pc
80. Hacker Hardware Tools
81. Blackhat Hacker Tools
82. Android Hack Tools Github
83. Pentest Tools Find Subdomains
84. Top Pentest Tools
85. Pentest Tools Nmap
86. Hacker Tools List
87. New Hack Tools
88. Pentest Tools Review
89. Hacking Tools For Pc
90. Hacking Tools Kit
91. Hack Tools For Games
92. Pentest Tools Alternative
93. Hacker Hardware Tools
94. Hack Tools For Pc
95. World No 1 Hacker Software
96. Hacker
97. Hacking App
98. Pentest Tools Nmap
99. Hacking Tools Name
100. Hacking App
101. Hacker Tools For Pc
102. Pentest Tools Android
103. Hack Tool Apk
104. Hack App
105. Hacking Apps
106. Free Pentest Tools For Windows
107. Hacker Tools 2020
108. How To Make Hacking Tools
109. Hacking Tools For Beginners
110. Hack Tools For Games
111. Best Hacking Tools 2020
112. Hacking Tools For Windows
113. Hacker Hardware Tools
114. Hacker Tool Kit
115. Hacker Tools Free Download
116. Hacker Tools Apk Download
117. Hacking Tools And Software
118. Termux Hacking Tools 2019
119. Hack Tools Download
120. Hacking Tools Windows 10
121. Hack Tools Github
122. Pentest Tools Alternative
123. Hacker Search Tools
124. How To Make Hacking Tools
125. Pentest Recon Tools
126. Hacking Tools
127. Hacker Tools List
128. Underground Hacker Sites
129. Hacking Tools For Kali Linux
130. Easy Hack Tools
131. Pentest Tools Port Scanner
132. Pentest Tools Port Scanner
133. Hacker Tools Windows
134. Hack Tools Github
135. Nsa Hack Tools
136. Usb Pentest Tools
137. Hack Apps
138. Pentest Tools Framework
139. Pentest Tools Linux
140. Nsa Hack Tools
141. Pentest Tools Apk
142. Hack Rom Tools
143. Hacker Tools Free Download
144. Hack Tools For Windows
145. Computer Hacker
146. Pentest Tools Android
147. Hacker Tools Hardware
148. Physical Pentest Tools
149. Hacking Tools Mac
150. How To Hack
151. Nsa Hack Tools
152. Hacking Tools And Software
153. Hacker Tools Github
154. Hacker Hardware Tools
155. Pentest Tools Find Subdomains
156. Pentest Tools Website Vulnerability
157. Pentest Tools Url Fuzzer
158. Nsa Hack Tools
159. Pentest Tools Online