Ethical Hacking

1
Ethical Hacking

• Phase I
• Reconnaissance

2
Module Objectives

• Overview of the Reconnaissance Phase
• Introducing Footprinting
• Understanding the information gathering
  methodology of hackers
• Comprehending the Implications
• Learning some of the tools used for
  reconnaissance phase
• Deploying countermeasures

3
Revisiting Reconnaissance

• Reconnaissance refers to the preparatory phase
  where an attacker seeks to gather as much
  information as possible about a target of
  evaluation prior to launching an attack.

4
Defining Footprinting

• Footprinting is the blueprinting of the security
  profile of an organization, undertaken in a
  methodological manner.
• Footprinting is one of the two pre-attack phases.
  The other is enumeration.
• Footprinting results in a unique organization
  profile with respect to networks (Internet /
  Intranet / Extranet / Wireless) and systems
  involved.

5
Information Gathering Methodology

• Unearth initial information
• Locate the network range
• Ascertain active machines
• Discover open ports / access points
• Detect operating systems
• Uncover services on ports
• Map the Network

Footprinting
6
Unearthing Initial Information

• Commonly includes
• Domain name lookup
• Locations
• Contacts (Telephone / mail)
• Information Sources
• Whois
• Nslookup

7
Whois
8
Nslookup

• Nslookup is a program to query Internet domain
  name servers. Displays information that can be
  used to diagnose Domain Name System (DNS)
  infrastructure.
• MX record reveals the IP of the mail server.
• Both Unix and Windows come with a Nslookup
  client.

9
Locate the Network Range

• Commonly includes
• Finding the range of IP addresses
• Discerning the subnet mask
• Information Sources
• Traceroute
• Hacking Tool
• Traceroute

10
Traceroute

• Traceroute is used to determine the route taken
  by packets across an IP network.
• In Windows the same tool is called tracert.

11
Example

• Lab 1 gathering information about wikipedia.org
• whois (www.betterwhois.org)
• Names of the DNS servers
• ...
• nslookup obtain the DNS server's IP
• traceroute obtain the web server's name
• nslookup obtain the web server's IP

12
Tool VisualRoute Trace
13
Tool eMailTrackerPro
14
Summary

• Information gathering.
• Footprinting renders a unique security profile of
  a target system.
• Whois can reveal public information of a domain
  that can be leveraged further.
• Traceroute and mail tracking can be used to
  target specific IP and later for IP spoofing.
• Nslookup can reveal specific users and zone
  transfers that can compromise DNS security.