Skip to content

Latest commit

 

History

History
143 lines (123 loc) · 7.85 KB

footprinting-overview.md

File metadata and controls

143 lines (123 loc) · 7.85 KB
Raw

Footprinting overview

  • Also known as fingerprinting or reconnaissance
  • 📝 Gathering information about a target system
  • E.g. software, network protocols, operating systems or hardware devices.
  • End goal is to find a way to break into the system.
  • 🤗 Often offered as separate service bought by companies to check against leaks and to see what data is there.
  • See also • Reconnaissance | Hacking stages and • Information Gathering | Penetration testing phases

Footprinting types

Passive footprinting

  • Also known as passive reconnaissance, passive fingerprinting or passive information gathering
  • 📝 No direct contact with target
  • Rely on information that is publicly available.
  • Most difficult to detect
  • E.g. • News • job postings • WHOIS databases • government records • document sifting • dumpster diving | Social engineering • competitive analysis • browser search • map lookup • DNS lookup • Facebook/Twitter search

Open-source intelligence (OSINT)

  • 📝 Collection and analysis of information that is gathered from public, or open, sources
  • ❗ "Open-source" is unrelated to open-source software or collective intelligence
  • Categories: • media • internet • public government data • professional and academic publications • commercial data • grey literature
  • awesome-osint | list of tools, OsintFramework | graph of tools

Competitive intelligence

Active footprinting

  • Also known as active reconnaissance, active fingerprinting or active information gathering
  • 📝 Direct contact with target including
  • Possible for target to be aware e.g. through tasks that may be logged or recorded
  • Examples
    • Buying beers for company employees to see what you can extract.
    • Network mapping with nmap, perimeter mapping, port scanning, web profiling...
    • • E-mail tracking • Phishing scheme with an email • Querying name servers • File metadata • Social engineering • Extracting DNS information • Traceroute analysis
  • 💡 Easier idea to start with passive footprinting by gathering all publicly available data
    • Then organizing it, and putting in one place.
    • Then use active footprinting with starting probing for ports, networks, possible vulnerabilities etc.
  • 💡Good to learn more about stuff (employees) of a company
    • through them you can learn a lot more and gain a lot more access
    • e.g. contact them through social media and start a conversation
      • e.g. join a conference that you see the person is attending on LinkedIn and meet him.

Footprinting information

  • Network information
    • Domains, subdomains
    • IP addresses
    • Whois and DNS records
    • VPN firewalls using e.g. ike-scan
  • System information
    • Web server operating systems
    • Server locations
    • Users
    • Passwords
  • Organization information
    • Employee information
    • Organization's background
    • Phone numbers
    • Locations

Footprinting objectives

  • Learn security posture
    • Analyze security
    • Find loopholes
    • Create an attack plan
  • Identify focus area
    • Narrow down the range of IP addresses.
  • Find vulnerabilities
    • Identify weaknesses in the target's security.
  • Map the network
    • Graphical representation of target's network a guide during the attack.

Footprinting tools

  • Collects and visualizes information e.g. • IP location • routing • business • address • phone number • social security number • source of an email and a file • DNS • domain
  • 📝 Maltego
    • Proprietary software for open-source intelligence (OSINT)
    • Provides graphical link for investigative tasks.
  • [Recon-ng](The Recon-ng Framework)
    • Open source CLI tools for open source web-based reconnaissance
  • FOCA
    • Fingerprinting Organizations with Collected Archives
    • Open-source tool to find metadata and hidden information in the documents:
      1. Finds documents (e.g. PDF, SVG) through search engines or manual upload
      2. Analyze them and identify which documents are created by same team, using which servers/clients.
  • Recon-dog
    • Open-source CLI tool self-claimed as Reconnaissance Swiss Army Knife
    • Can extracts targets from STDIN (piped input) and act upon them
    • Passive reconnaissance tool extracting all information with APIs without any contact with target
  • Dmitry (DeepMagic Information Gathering Tool)
    • CLI tool to analyze a website e.g. dmitry https://cloudarchitecture.io
    • • Performs WHOIS lookup on IP and domain • Retrieves Netcraft information • Search for subdomains/email addresses • Performs TCP scanning • Grabs banner for each port

Footprinting reports

  • Includes
    • Details about the performed tests
    • Used techniques
    • Test results
  • It should also include
    • List of vulnerabilities and how they can be fixed
      • E.g. wrong configuration in webserver because you're allowing a forward and somebody is using your proxy for reflection attacks.
        • Reflection attack = Send a packet from A to B, A gives wrong source IP for DDoS attacks.
    • List sources of information e.g. DNS, social medial, social engineering.
    • List what information you gathered from each source
      • E.g. login pages, technologies, files, contact details, GPS location, IP address, email servers.
  • Should be kept highly confidential

Countermeasures

  • Enforcing security policies
  • Educating employees about security threats
    • Raises awareness, reduces risks dramatically
  • Encrypting sensitive information
    • 💡 Use proper encryption everywhere
      • 🤗 Many companies uses VPN/proxy with encryption for outside communication, but service communicate with each other without any encryption.
  • Disabling protocols that are not required
  • Proper service configuration
    • Double check all services that application depends.
    • Do not disable/enable configuration without knowing consequences.
  • Scrutinize information released to the public domain
    • E.g. you post on social media which routers the company has just bought
      • Allows hacker to
        • know default router configurations
        • get image of OS in the router and conduct tests in a VM
  • Limit site caching
    • Inform search engines what they're supposed to index through e.g. robots.txt
      • E.g User-agent: * Disallow: / prevents indexing any page (Disallow: /) for any crawler (User-agent: *)
  • Use Whois Guard
  • Restricting access to social media
    • Extra risk as you click on many links and giving away companies IP address