Penetration Testing Bootcamp - Information Gathering

Key Takeaways

hello everyone welcome back to the penetration testing boot camp in this video we're going to be taking a look at information gathering or reconnaissance uh we're also going to take a look at passive and active information gathering but the main focus is to introduce you to information gathering and then we'll take a look at the various tools and techniques that we'll be using in passive information gathering all right so let's get started so first of all what is information gathering or reconnaissance right so information gathering or footprinting as it's also known as in certain cases and i'll i'll demystify that later but it is it is the first stage in a penetration test and it is the process of gathering as much information about the target and its information systems and architecture as possible right so this information is very important because it's then used to find various ways to gain access to the organization's network or infrastructure so the reason uh you know information gathering is the first step in apn test is because it gives you an overview of the organization's information systems the structure uh what assets the company has what service they have and then this gives the penetration tester a clear view of where the weaknesses lie in so far as you know the vulnerabilities that exist what areas might be the most susceptible to weakness and it allows the penetration tester to fine tune the pen test and that's why this is one of the most important phases in penetration testing now there are two types of information gathering that really entail two types of data or two different types of actually interacting with your target or your client right so let's start off with understanding passive information gathering or reconnaissance so passive information gathering is the process of gathering information about a target without making any direct contact with the target's digital infrastructure or really not engaging with the target actively so passive information uh passive information gathering relies on os int or open source intelligence or publicly available information to map out uh you know the the uh the the organizations to map out the organization's information systems their structure etc right we then have active information gathering so this is the process of gathering information about a target through direct interaction so this process involves directly interacting with the targets i.t infrastructure or you know the employees whether you're performing uh you know social engineering so you're actually probing the servers you might be trying to scan for open ports on the servers stuff like that however with passive you're dealing with information that's already in the public domain and really you're not targeting or you're not actively engaging with the target yet all right so let's talk about the objectives of information gathering because this is very very important so the main objective of information gathering is to build a blueprint of the targets organizational structure network information and host information all right so as i said this information becomes very useful because it allows you to orchestrate the next steps of the pen test very well so again if you perform very good information gathering or very comprehensive information gathering on your target or the target network you get an idea or a good understanding of of the structure and where you should start off with first right so you're typically tag you're typically targeting the low hanging fruit first secondly it also helps the penetration test to understand the overall security posture of the target network or infrastructure so again this will entail where the flaws or vulnerabilities exist so that he or she can focus on the low hanging fruit that comes to the first objective here so again it's very important that the penetration tester understands the entire scope of the organizational uh of the organizational structure the network information information about the various hosts and you know this this information goes quite in depth as i just say as i just point out right over here so when we take a look at the types of information that we'll be gathering let's start off with network and host based information so the information you're typically looking for are network ranges used by the company ip blocks dns names top level domains sub domains name servers mail servers and the the software that they're using either on the website or the client or employee software packages you know that they use on their desktop computers this can help you you know you know orchestrate social engineering attacks uh if you're targeting their web servers or the of their mail servers then again that information becomes very useful secondly uh you're typically targeting or looking for employee information and this of course is very useful in performing social engineering so you're looking for their name email phone number identity information their role within the company whether or not they have access to critical information and their various interests and then through that you can start building a uh you know a spear phishing um you can you can set up a sphere phishing campaign or you can work around or set up a social engineering campaign as a whole all right so let's talk about the various passive information gathering or osint methodologies techniques and tools and the one that i've set up [Music]