UNDERSTANDING FOOTPRINTING AND RECONNAISSANCE

foot1

WHAT IS FOOTPRINTING

Foot Printing in Security terms is the process of gathering as much possible information about the Target Organization

Footprinting is a part of reconnaissance process which is used for gathering possible information about a target computer system or network. Footprinting could be both passive and active. Reviewing a company’s website is an example of passive footprinting, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering.

Footprinting is basically the first step where hacker gathers as much information as possible to find ways to intrude into a target system or at least decide what type of attacks will be more suitable for the target.

During this phase, a hacker can collect the following information −

  • Domain name
  • IP Addresses
  • Namespaces
  • Employee information
  • Phone numbers
  • E-mails
  • Job Information

Objectives of Footprinting are as follows

  1. To Collect Network Information
  2. To Collect System Information
  3. To Collect Organizations Information
print2

TYPES AND METHODS OF FOOTPRINTING

  1. Footprinting through Social Media, this one is the most easiest to do mostly attacker will create fake account/ids and tries to gather as much as possible information about the target Organization.
  2. Footprinting through Search Engines like bing, google and duckduckgo. My favorite is duckduckgo. Attackers also look for cache and archives. Some of the good tools are netcraft, shodan, pipl, Google Earth. in order to perform footpriting.
  3. Footprinting through the Job sites. Hackers will come to know what tools and technology organization is working on.
  4. Target Monitoring through the Alerts like google alerts, twitter alerts, yahoo alerts.
  5. Another good method is via Google Hacking databases and Advance search queries. Query string can be used in search and can be used as keywords. Also Google Advance Search Operators can be utilized. For example “intitle index of” list down all the sites with index open. securityfocus.com, hackersforcharity.org/ghdb are few sites where you can get most of the info.
  6. Website footprinting is monitoring the target organization website. Web server details, directory structure, developers email id are some of the common info. Also tools available where we can mirror the whole website. Backdated website information can be extracted from archive.org.
  7. Email tracking is used to track the emails. Emails are used to gather information in order to perform the social engineering and many other attacks, Spam.
  8. DNS Information attackers can get the hosts in the network. Hackers can get A, CNAME, PTR, MX, NS, HINFO records. There are lot of command line utilities available to get the DNS information. nslookup and dig are the most common among the tools.
  9. WHOis attackers perform WHOis to understand whois behind a specific domain? ARIN, AFRINIC, RIPE. APNIC, LATNIC are the RIR’s (Regional Internet Registry). We can get info from WHOis like email, domain owner, address, name servers for the domain, registrar.
  10. Network Footprinting
  11. Footprinting through Social Engineering. Eavesdropping, Shoulder Surfing, Dumpster Diving.

Footprinting Countermeasures

To prevent foot printing,these strategies should be applied.

  • Restrict the employees to access social networking sites from organization’s network
  • Configure web servers to avoid information leakage
  • Educate employees to use pseudonyms on blogs, groups, and forums
  • Do not reveal critical information in press releases, annual reports, product catalogues, etc.
  • Limit the amount of information that you are publishing on the website/Internet
  • Use footprinting techniques to discover and remove any sensitive information publicly available
  • Prevent search engines from caching a web page and use anonymous registration services
  • Enforce security policies to regulate the information that employees can reveal to third parties
  • Set apart internal and external DNS or use split DNS, and restrict zone transfer to authorized servers
  • Disable directory listings in the web servers
  • Educate employees about various social engineering tricks and risks
  • Opt for privacy services on Whois Lookup database
  • Avoid domain-level cross-linking for the critical assets
  • Encrypt and password protect sensitive information

In the context of cybersecurity, reconnaissance is the practice of covertly discovering and collecting information about a system. This method is often used in ethical hacking or penetration testing. 

Like many cybersecurity terms, reconnaissance derives from military language, where it refers to a mission with the goal of obtaining information from enemy territory.

How Reconnaissance Works

Reconnaissance generally follows seven steps:

  1. Collect initial information
  2. Determine the network range
  3. Identify active machines
  4. Find access points and open ports 
  5. Fingerprint the operating system
  6. Discover services on ports
  7. Map the network

Using these steps, an attacker will aim to gain the following information about a network:

  • File permissions
  • Running network services
  • OS platform
  • Trust relationships
  • User account information 

One of the most common techniques involved with reconnaissance is port scanning, which sends data to various TCP and UDP (user datagram protocol) ports on a device and evaluates the response. 

Differences Between Passive and Active Reconnaissance

There are two main types of reconnaissance: active and passive reconnaissance. 

With active reconnaissance, hackers interact directly with the computer system and attempt to obtain information through techniques like automated scanning or manual testing and tools like ping and netcat. Active recon is generally faster and more accurate, but riskier because it creates more noise within a system and has a higher chance of being detected.

Passive reconnaissance gathers information without directly interacting with systems, using tools such as Wireshark and Shodan and methods such as OS fingerprinting to gain information. 

How To Prevent Reconnaissance

Organizations can use penetration testing to determine what their network would reveal in the event of a reconnaissance attack. During testing, organizations can deploy port scanning tools (which scan large networks and determine which hosts are up) and vulnerability scanners (which find known vulnerabilities in the network).

Drop Your comment

https://instagram.com

Leave a Reply