---
title: '03 Footprinting'
disqus: hackmd
---

Lecture 03 Footprinting
===

<style>
img{
/* border: 2px solid red; */
margin-left: auto;
margin-right: auto;
width: 90%;
display: block;
}
</style>

## Table of Contents

[TOC]

Penetration Testing
---
#### Stages

### Footprinting
- footprinting
- discover info abt org/network
- usually avail on internet
- info gathered can be used to conduct security test
- or determine attack vectors
- example info
- size of network
- OS used
- info gathering
- many res to find info legally
- identify methods to find info abt orgs
- companies can try to limit the amt of info avail publicly

#### Info to Find
- domains
- how many registered domains
- principle service
- what main internet services provided
- test for port 21, 22, 25, 80, 443
- IP addr discovered
- dig up all systems & scope
- gateway routers
- who ISP
- whr hosting DMZ in-house
- how big
- visible systems
- estimate based on what we can see is alive
- primary OS by IP
- firewalls
- scan tcp 135-139
- IDS/IPS
- can teack us?
- will kill our conns?
- web techs
- slow past of testing
- ISPs
- name, addr, website, info on hosting
- test conditions
- hops
- restrictions
- Eg. internet weather

Web Tools
---

### Advanced Web Searches
- Eg.
- find certain word/file on website
- `site:www.example.com keyword`
- find file types with keywords
- `filetype:type site:www.example.com keyword`
- find webpages with certain string in URL
- `inurl:string site:www.example.com`
- find webpages with certain string anywhr in txt
- `intext:string site:www.example.com`
- http://www.googleguide.com/advanced_operators_reference.html

### Whois
- domain names registered with network info centre (NIC)
- regional internet registries handle IP allocation
- american registry for internet nums (ARIN)
- asia-pacific network info centre (APNIC)
- whois db allow queries on who owns domains, contact info, IP range etc.

### Using Email
- find email format
- guess other employee email accs
- bounce email using non-existent acc
- read mail header
- get info abt servers
- tool to find corporate employee info
- Groups.google.com

### Analyse Company's Website
- webpages have a lot of info
- preferred web tehc, type of OS, webserver etc.
- simplest tool is browser
- view source
- sometimes useful info can be found in comments


### Find Info about Connected Devices
- shodan
- www.shodan.io
- search engine for online devices


### Use Domain Name Service (DNS)
- dns
- resolve hostnames to IP
- people prefer URL to IP
- can be vuln
- dns query tools
- nslookip
- dig
- host
- whois
- determine company's primary DNS server
- look for __start of authority (SOA)__ record
- show zones/IP
- __zone transfer__
- enable you to see all hosts on network
- gives you org's network diagram

#### Other DNS Whois Tools
- www.whois.net
- greenwich
- wikto
- smartwhois
- activewhois
- spiderfoot
- www.dnsstuff.come
- www.mxtoolbox.com

### Traceroute
- why traceroute?
- can use to discover alt ISPs use for disaster recovery
- use ICMP (windows) or UDP (linux)
- TTL vals used to trace route
- perform traceroute from diff countries
- use online traceroute tool

### Analyse Company's Website
- other advanced tools (proxy)
- paros
- webscarab
- burpsuite
- dev tools on browser
- press f12

#### Paros
- search for website
- tools > spider
- enter website's url
- check results


- get structure of website
- tree > scan all
- report includes
- vulns & risk lvls
- web server ver
- gathering info takes time


### Copy Whole Websites
- pages of website inspected & analysed offline
- HTTrack Website Copier
- www.httrack.com

Using HTTP Basics
---
- port 80
- use HTTP lang to pull info from web server
- basic understanding of HTTP beneficial for security testers
- return codes
- reveal info abt system


- HTTP methods
- `GET / HTTP/1.1` is most basic method
- can determine info abt server OS from server's generated output


### HTTP Headers
- every HTTP packet (resp/req) contains set of header fields
- may contain info on
- browser of client
- OS of client
- web server turning response
- cookies
- other methods of gathering info
- cookies
- web bugs

### Detecting Cookies & Web Bugs
- cookie
- txt file generated by web server
- stored on user's browser
- info sent back to web server when user returns
- used to customise webpages
- some cookies store personal info
- security issue
- web bug
- 1 px x 1px img file
- referenced in IMG tag
- usually works with cookie
- purpose similar to spyware & adware
- comes from 3rd pt companies specialising in data collection

Social Engineering
---
- use human nature to get info
- biggest security threat to networks
- most difficult to protect against

### Techniques
- urgency
- help with probs
- everyone else doing it
- kindness & charm
- authority

### Shoulder Surf
- stand behind people and see info entered
- use camera phones to take vids

### Dumpster Diving
- lots of valuable info in trash
- discarded windows XP manuals - company just upgraded windows OS
- company organisational charts
- printouts of emails
- discarded hard disks, USB drives
- deleted data can be retrieved
- docs shld be shredded
- use disk-cleaning software to wipe all data on discarded disks

### Piggybacking
- trailing authorised staff closely to enter restricted areas
- may rely on kindness of people to hold door for them while wearing fake staff card
- or carrying big boxes

### Phishing
- urgent emails that seem to be from legit companies asking you to click on link to provide/update details
- link leads to atker's website
- spear phishing
- sent to specific people in org

- not limited to emails, can occur in mobile msgs too
- phishing sms

View Email Headers
---
- learn to find email headers
- after opening email headers, copy paste into txt doc to read them from txt editor
- headers contain valuable info abt sender
- unique identifying numbers, IP addr of sending server & sending time
- [Learn more abt email headers](https://www.arclab.com/en/kb/email/how-to-read-and-analyze-the-email-header-fields-spf-dkim.html)

### Info to look out for
- info to look out for
- return path
- recipient email addr
- type of email sending service
- ip addr of sending server
- name of email server
- unique msging num
- date & time email sent
- attachment files info
- use who is or other db to find true source of email

Summary
---

###### tags: `EHD` `DISM` `School` `Notes`