Module 02: Footprinting and Reconnaissance
Was this helpful?
Was this helpful?
The objective of the lab is to extract information about the target organization that includes, but is not limited to:
Organization Information Employee details, addresses and contact details, partner details, weblinks, web technologies, patents, trademarks, etc.
Network Information Domains, sub-domains, network blocks, network topologies, trusted routers, firewalls, IP addresses of the reachable systems, the Whois record, DNS records, and other related information
System Information Operating systems, web server OSes, location of web servers, user accounts and passwords, etc.
Footprinting refers to the process of collecting information about a target network and its environment, which helps in evaluating the security posture of the target organization’s IT infrastructure. It also helps to identify the level of risk associated with the organization’s publicly accessible information.
Footprinting can be categorized into passive footprinting and active footprinting:
Passive Footprinting: Involves gathering information without direct interaction. This type of footprinting is principally useful when there is a requirement that the information-gathering activities are not to be detected by the target.
Active Footprinting: Involves gathering information with direct interaction. In active footprinting, the target may recognize the ongoing information gathering process, as we overtly interact with the target network. </aside>
Type intitle:login site:eccouncil.org and press Enter. This search command uses intitle and site Google advanced operators, which restrict results to pages on the eccouncil.org website that contain the login pages. An example is shown in the screenshot below.
In the search bar, type the command EC-Council filetype:pdf ceh and press Enter to search your results based on the file extension and the keyword (here, ceh).
Apart from the aforementioned advanced Google operators, you can also use the following to perform an advanced search to gather more information about the target organization from publicly available sources.
cache: This operator allows you to view cached version of the web page. [cache:www.eccouncil.org]- Query returns the cached version of the website
allinurl: This operator restricts results to pages containing all the query terms specified in the URL. [allinurl: EC-Council career]—Query returns only pages containing the words “EC-Council” and “career” in the URL
inurl: This operator restricts the results to pages containing the word specified in the URL [inurl: copy site:www.eccouncil.org]—Query returns only pages in EC-Council site in which the URL has the word “copy”
allintitle: This operator restricts results to pages containing all the query terms specified in the title. [allintitle: detect malware]—Query returns only pages containing the words “detect” and “malware” in the title
inanchor: This operator restricts results to pages containing the query terms specified in the anchor text on links to the page. [Anti-virus inanchor:Norton]—Query returns only pages with anchor text on links to the pages containing the word “Norton” and the page containing the word “Anti-virus”
allinanchor: This operator restricts results to pages containing all query terms specified in the anchor text on links to the page. [allinanchor: best cloud service provider]—Query returns only pages in which the anchor text on links to the pages contain the words “best,” “cloud,” “service,” and “provider”
link: This operator searches websites or pages that contain links to the specified website or page. [link:www.eccouncil.org]—Finds pages that point to EC-Council’s home page
related: This operator displays websites that are similar or related to the URL specified. [related:www.eccouncil.org]—Query provides the Google search engine results page with websites similar to
info: This operator finds information for the specified web page. [info:eccouncil.org]—Query provides information about the home page
location: This operator finds information for a specific location. [location: EC-Council]—Query give you results based around the term EC-Council
You can use other video search engines such as
IoT search engines crawl the Internet for IoT devices that are publicly accessible. These search engines provide crucial information, including control of SCADA (Supervisory Control and Data Acquisition) systems, traffic control systems, Internet-connected household appliances, industrial appliances, CCTV cameras, etc.
You can also anonymously explore the following onion sites using Tor Brower to gather other relevant information about the target organization:
You can also use tools such as:
Type python3 sherlock satya nadella and press Enter. You will get all the URLs related to Satya Nadella, as shown in the screenshot. Scroll down to view all the results.
Photon is a Python script used to crawl a given target URL to obtain information such as URLs (in-scope and out-of-scope), URLs with parameters, email addresses, social media accounts, files, secret keys and subdomains. The extracted information can further be exported in the JSON format.
Type python3 photon.py -u http://www.certifiedhacker.com and press Enter to crawl the target website for internal, external and scripts URLs.
Now, type python3 photon.py -u http://www.certifiedhacker.com -l 3 -t 200 --wayback and press Enter to crawl the target website using URLs from archive.org.
Web data extraction is the process of extracting data from web pages available on the company’s website. A company’s data such as contact details (email, phone, and fax), URLs, meta tags (title, description, keyword) for website promotion, directories, web research, etc. are important sources of information for an ethical hacker. Web spiders (also known as a web crawler or web robot) such as Web Data Extractor perform automated searches on the target website and extract specified information from the target website.
The Web Data Extractor Pro main window appears. Click new session to start a new session.
The Session window appears; type a URL (here, https://www.certifiedhacker.com) in the Start URL field. Check all the options, as shown in the screenshot.
Web Data Extractor will start collecting information (Session, Meta tags, Emails, Phones, Faxes, Links, and Domains).
Website mirroring is the process of creating a replica or clone of the original website; this mirroring of the website helps you to footprint the web site thoroughly on your local system, and allows you to download a website to a local directory, analyze all directories, HTML, images, flash, videos, and other files from the server on your computer.
You can duplicate websites by using website mirroring tools such as HTTrack Web Site Copier. HTTrack is an offline browser utility that downloads a website from the Internet to a local directory, builds all directories recursively, and transfers HTML, images, and other files from the webserver to another computer.
Here, we will use the HTTrack Web Site Copier tool to mirror the entire website of the target organization, store it in the local system drive, and browse the local website to identify possible exploits and vulnerabilities.
In the terminal window, type cewl -d 2 -m 5 https://www.certifiedhacker.com and press Enter.
A unique wordlist from the target website is gathered, as shown in the screenshot.
nslookup is a network administration command-line utility, generally used for querying the DNS to obtain a domain name or IP address mapping or for any other specific DNS record. This utility is available both as a command-line utility and web application.
In the Windows 11 machine, launch a Command Prompt, type nslookup and press Enter. This displays the default server and its address assigned to the Windows 11 machine.
In the nslookup interactive mode, type set type=a and press Enter. Setting the type as “a” configures nslookup to query for the IP address of a given domain.
Other Tools:
SecurityTrails is an advanced DNS enumeration tool that is capable of creating a DNS map of the target domain network. It can enumerate both current and historical DNS records such as A, AAAA, NS, MX, SOA, and TXT, which helps in building the DNS structure. It also enumerates all the existing subdomains of the target domain using brute-force techniques.
tracert
Use domainfy to check with the existing domains using words and nicknames. Type domainfy -n [Domain Name] -t all (here, the target domain name is ECCOUNCIL) and press Enter.
Use searchfy to check for the existence of a given user details on different social networking platforms such as Github, Instagram and Keyserverubuntu. Type searchfy -q "target user name or profile name" (here, the target user name or profile is Tim Cook and it is searched in all the social media platforms) and press Enter.
Similarly, you can use following OSRFramework packages to gather more information about the target:
usufy - Gathers registered accounts with given usernames.
mailfy – Gathers information about email accounts
phonefy – Checks for the existence of a given series of phones
entify – Extracts entities using regular expressions from provided URLs
The FOCA new project wizard appears, follow the steps below:
Enter a project name in the Project name field (here, Project of www.eccouncil.org).
Enter the domain website in the Domain website field (here, www.eccouncil.org).
You can leave the optional Alternative domains field empty.
Under the Folder where to save documents field, click on the Folder icon. When the Browse For Folder pop up window appears, select the location to save the document that is extracted by FOCA (here, Desktop) and click OK.
Leave the other settings to default and click the Create button.
BillCipher displays various available options that you can use to gather information regarding a target website.
The OSINT Framework includes the following indicators with the available tools:
(T) - Indicates a link to a tool that must be installed and run locally
(D) - Google Dork
(R) - Requires registration
(M) - Indicates a URL that contains the search term and the URL itself must be edited manually
Hacker's Mantra:A hacker is someone who enjoys playful cleverness, not necessarily with computers. The programmers in the old MIT free software community of the 60s and 70s referred to themselves as hackers. Around 1980, journalists who discovered the hacker community mistakenly took the term to mean "security breaker." - Richard Stallman
After the video link is copied, open a new tab in Mozilla Firefox, place your mouse cursor in the address bar and click and press Enter.
Google videos (),
Yahoo videos (),
EZGif (),
()
TinEye Reverse Image Search (),
Yahoo Image Search (),
You can use FTP search engines such as File Search to gather crucial FTP information about the target organization or
Netcraft -
Sublist3r -
Pentest-Tools Find Subdomains -
PeekYou -
Spokeo -
pipl -
Intelius -
BeenVerified -
: This tool gathers emails, subdomains, hosts, employee names, open ports, and banners from different public sources such as search engines, PGP key servers, and the SHODAN computer database as well as uses Google, Bing, SHODAN, etc. to extract valuable information from the target domain. This tool is intended to help ethical hackers and pen testers in the early stages of the security assessment to understand the organization’s footprint on the Internet. It is also useful for anyone who wants to know what organizational information is visible to an attacker.
The Hidden Wiki is an onion site that works as a Wikipedia service of hidden websites. ()
FakeID is an onion site for creating fake passports ()
Cardshop is an onion site that sells cards with good balances ()
ExoneraTor ()
OnionLand Search engine (),
Censys ()
Netcraft ()
Shodan ()
The Central Ops website -
Website Informer ()
Burp Suite ()
Zaproxy ()
ParseHub ()
SpiderFoot ()
Cyotek WebCopy (),
searches for available subdomains, sub-subdomains, login pages, directory listings, exposed documents, WordPress entries and pasting sites and displays the results.
SmartWhois ()
Batch IP Converter ()
DNSdumpster ()
DNS Records ()
DNSChecker ()
DNSdumpster ()
VisualRoute ()
Traceroute NG ()
is a web reconnaissance framework with independent modules and database interaction that provides an environment in which open-source web-based reconnaissance can be conducted. Here, we will use Recon-ng to perform network reconnaissance, gather personnel information, and gather target information from social networking sites.
is a footprinting tool used to gather maximum information for the purpose of ethical hacking, computer forensics, and pentesting. It provides a library of transforms to discover data from open sources and visualizes that information in a graph format, suitable for link analysis and data mining. Maltego provides you with a graphical interface that makes seeing these relationships instant and accurate, and even making it possible to see hidden connections.
is a set of libraries that are used to perform Open Source Intelligence tasks. They include references to many different applications related to username checking, DNS lookups, information leaks research, deep web search, regular expressions extraction, and many others. It also provides a way of making these queries graphically as well as several interfaces to interact with such as OSRFConsole or a Web interface.
is a tool that reveals metadata and hidden information in scanned documents. These documents are searched for using three search engines: Google, Bing, and DuckDuckGo. The results from the three engines amounts to a lot of documents. FOCA examines a wide variety of records, with the most widely recognized being Microsoft Office, Open Office and PDF documents. It may also work with Adobe InDesign or SVG files. These archives may be on-site pages and can be downloaded and dissected with FOCA.
is an information gathering tool for a Website or IP address. Using this tool, you can gather information such as DNS Lookup, Whois lookup, GeoIP Lookup, Subnet Lookup, Port Scanner, Page Links, Zone Transfer, HTTP Header, etc. Here, we will use the BillCipher tool to footprint a target website URL.
is an open source intelligence gathering framework that helps security professionals for performing automated footprinting and reconnaissance, OSINT research, and intelligence gathering. It is focused on gathering information from free tools or resources. This framework includes a simple web interface that lists various OSINT tools arranged by category and is shown as an OSINT tree structure on the web interface.
Recon-Dog ()
Grecon ()
Th3Inspector ()
Raccoon ()
Orb ()