PENETRATION TESTING

Phase 1

Planning and reconnaissance

 Introduction
• Reconnaissance and planning stage is THE MOST IMPORTANT STAGE of the
penetration testing process. All other actions in the next 4 stages of the
process that a pentesting team will perform will derive from what you do
during this first step.
• Poorly performed data collection and bad test strategy planning are the most
common reasons of failed, inefficient and incomplete test.
• Goal of the test is to find all possible vulnerabilities that pose a threat to the
enterprise.
• This is possible only if determine exact attack surface that the enterprise has
exposed over the Internet!
 Phase 1: Reconnaissance and planning

• Reconnaissance or Footprinitng is the first phase of the ethical hacking process

and consists of passively and actively gaining information about a target. The goal
is to gather as much information as is reasonable and useful about a potential
target with the objective of getting enough information to make later attacks
more accurate. The end result should be a profile of the target with enough data
to plan the next phase of scanning.
• Information that can be gathered during this phase includes the following:
• IP address ranges
• Namespaces
• Employee information
• Phone numbers
• Facility information
• Job information
 Phase 1: Reconnaissance

• Targets of a reconnaissance Process

• Network information
• Operating system information
• Organization information, such as CEO and employee information, office information, contact
numbers, and email
• Network blocks
• Network services
• Application and web application data and configuration information
• System architecture
• Intrusion detection and prevention systems
• Employee names
• Work experience
 Phase 1: Reconnaissance
Active Information Gathering
Active information gathering involves engagement with the target through
techniques such as social engineering. Attackers tend to focus their efforts on the
soft target, which tends to be human beings. A savvy attacker engages employees
under different guises under various pretenses with the goal of socially engineering
an individual to reveal information.
Passive Information Gathering
Passive information gathering is decidedly less aggressive and overt than active
information gathering. Whereas active information gathering requires much more
direct engagement with the target, passive does not. Passive uses methods that
gather information indirectly about a target from other sources. These sources
include websites, job postings, social media, and other types of sources.
 Phase 1: Reconnaissance

• Network Information
• Much of the network information that is useful to you in starting the initial
phase of an attack is readily available or can be easily obtained with little
investigation.
• Domain names the company uses to conduct business or other functions
• Internal domain name information
• IP addresses of available systems
• Rogue or unmonitored websites that are used for testing or other purposes
• Private websites
 Phase 1: Reconnaissance

• Network Information
• TCP/UDP services that are running
• Access control mechanisms, including firewalls and ACLs
• Virtual private network (VPN) information
• Intrusion detection and prevention information as well as configuration data
• Telephone numbers, including analog and Voice over Internet Protocol
(VoIP)
• Authentication mechanisms and systems
 Phase 1: Reconnaissance

• Finding the IP Address of a Website

ping [Link]
Determine the frame size on the network by entering this command:
• ping [Link] –f –l 1300
• Determine the path that traffic is taking from the local host to the remote
host.
• tracert <ip address>
 Phase 1: Reconnaissance
• Operating System Information
• The operating system is one of the most important areas you must gain information about. When
browsing information on job sites or gathering information from elsewhere, look closely to see if
anything you obtain can give you clues to what is running.
• For example, job postings that ask for experience on Office 365 or Red Hat administrator can
help determine the OS present in the environment.
• When looking at the informations you found about the target look for anything that provides
technical details:
• User and group information and names
• Operating system versions
• System architecture
• Remote system data
• System names
• Passwords
 Phase 1: Reconnaissance
• Organization Data
• Not all information's you need for a successful attack are purely technical and information's that provide
details about employees, operations, projects, or other similar details can be vital. These information's can
be found in many locations such as the company’s website, discussion groups, financial reports, etc.
• Type of data we are interested can be something like:
• Employee details
• Organization’s website
• Company directory
• Location details
• Address and phone numbers
• Comments in HTML source code
• Security policies implemented
• Web server links relevant to the organization
• Background of the organization
• News articles and press releases
 Phase 1: Reconnaissance
• Open Source and Passive Information Gathering
• Open source or passive information gathering is the least aggressive. The process
relies on obtaining information from those sources that are typically publicly
available and out in the open. Potential sources include newspapers, websites,
discussion groups, press releases, television, social networking, blogs, and many
other sources.

• Active Information Gathering

• Active information gathering involves engagement with the target through
techniques such as social engineering. Attackers tend to focus their efforts on the
soft target, which tends to be human beings. Smart attackers engage employees
under different guises under various pretenses with the goal of socially engineering
an individual to reveal information.
 Phase 1: Reconnaissance

• Using Search Engines

• One of the first steps in the process of Reconnaissance tends to be using a
search engine. Search engines such as Google and Bing can easily provide a
wealth of information that your target may have wished to have kept hidden
or may have just plain forgotten about.
• Using a search engine, you can find information such as technology
platforms, employee details, login pages, intranet portals, etc. A search can
easily provide even more details such as names of security personnel, brand
and type of firewall, and antivirus protection, even network diagrams and
completely open admin panels.
 Phase 1: Reconnaissance
Google Hacking
• Cache: Displays the version of a web page that Google contains in its cache instead of
displaying the current version. Syntax: cache:< website name >
• Link: Lists any web pages that contain links to the page or site specified in the query.
• Syntax: link:< website name >
• Info: Presents information about the listed page. Syntax: info:< website name >
• Site: Restricts the search to the location specified.
Syntax: < keyword > site:< website name >
• Allintitle: Returns pages with specified keywords in their title.
Syntax: Allintitle: <keywords>
• Allinurl: Returns only results with the specific query in the URL.
Syntax: allinurl:< keywords >
 Phase 1: Reconnaissance

Google Hacking
• [Link]
• You should note that when using these advanced operators frequency and
number of keywords are important. If you use it for too many times and with
different operators in a short period of time Google will blacklist you.
• Don’t foget that there are many more keywords such as filetype.
• In some cases you may find that the information you need by looking at older
versions of the website (or even webistes that no longer exist)
• On [Link] (also known as The Wayback Machine), you can find archived
copies of websites from which you can extract information.
 Phase 1: Reconnaissance
• Social Networks Data Harvesting
• Facebook: The largest social network on the planet boasts an extremely large user
base with a large number of groups for sharing interests. Facebook is also used to
share comments on a multitude of websites, making its reach even farther.
• Twitter: Twitter has millions of users, many of whom post updates several times a day.
Twitter offers little in the way of security, and those security features it does have are
seldom used. Twitter users tend to post a lot of information with little or no thought
as to the value of what they are posting.
• LinkedIn: One of hackers favorites for gathering information is LinkedIn. The site is a
social networking platform for job seekers, and as such it has employment history,
contact information, skills, and names of those the person has worked with.
• Instagram: This social media service allows the sharing of photos online. The service is
extremely popular and is used by a large number of people worldwide.
 Phase 1: Reconnaissance
• Social Networks Data Harvesting
• Facebook: The largest social network on the planet boasts an extremely large user
base with a large number of groups for sharing interests. Facebook is also used to
share comments on a multitude of websites, making its reach even farther.
• Twitter: Twitter has millions of users, many of whom post updates several times a day.
Twitter offers little in the way of security, and those security features it does have are
seldom used. Twitter users tend to post a lot of information with little or no thought
as to the value of what they are posting.
• LinkedIn: One of hackers favorites for gathering information is LinkedIn. The site is a
social networking platform for job seekers, and as such it has employment history,
contact information, skills, and names of those the person has worked with.
• Instagram: This social media service allows the sharing of photos online. The service is
extremely popular and is used by a large number of people worldwide.
Phase 1: Reconnaissance
• One tool that is very useful for this purpose is PoliteMail (
[Link] ), which is designed to create and track email
communication from within Microsoft Outlook. This utility can prove
incredibly useful if you can obtain a list of email addresses from the target
organization.
• Once you have such a list, you can then send an email to the list that
contains a malicious link. When the email is opened, PoliteMail will inform
you of the event for each individual.
• Another utility worth mentioning is WhoReadMe ( [Link]
). This application lets you track emails and also provides information such
as operating system, browser type, and ActiveX controls installed on the
system.
Phase 1: Reconnaissance
• Whois This utility helps you gain information about a domain name,
including ownership information, IP information, netblock data, and
other information where available
• Ping Utilizing ICMP, this utility is used to determine not only if a host
is reachable, but also if it is up or down.
• Nslookup This utility is used to query DNS servers and gain
information about various parts of the DNS namespace or individual
hosts. On the Unix and Linux platforms the DIG command is used to
perform the same function as nslookup.
Phase 1: Reconnaissance
• WhoIs This utility helps you gain information about a domain name,
including ownership information, IP information, netblock data, and
other information where available
• Ping Utilizing ICMP, this utility is used to determine not only if a host
is reachable, but also if it is up or down.
• Nslookup This utility is used to query DNS servers and gain
information about various parts of the DNS namespace or individual
hosts. On the Unix and Linux platforms the DIG command is used to
perform the same function as nslookup.
Potential risks for the enterprise
Social Engineering – Can be mitigated by efficient awareness training
Network and System Attacks-gather information relating to an environment’s system
configuration and operating systems.
Information Leakage – One of the biggest challenges is implementing DLP rules that
will successfully stop data from leaving the organization.
Privacy Loss – Once an attacker gains access to a system he can do more then just
control it. In most cases they will sweep the environment in order to gather private
and personal information within it. This can cause serious legal and financial
consequences depending on your local jurisdiction (There are number of applicable
laws such as GDPR, the Health Insurance Portability and Accountability Act of 1996
(HIPAA) or Sarbanes–Oxley).
Revenue Loss – Once it is publicly known that a company has suffered a tada breach
it unstoppably leads to losing trust in that business, which may even lead to
bankruptcy of that company. if they don’t feel it is safe.
DNS data harvesting
DNSEnum
• DNSEnum is a command-line tool that automatically identifies basic DNS
records such as MX, mail exchange servers, NS, domain name servers, or A—
the address record for a domain. It also attempts zone transfers on all
identified servers, and it has the ability to attempt reverse resolution (that is,
getting the hostname given an IP address) and brute forcing (querying for the
existence of hostnames in order to get their IP address) of subdomains and
hostnames. Let us query [Link]
DNS data harvesting
Brute force DNS records using Nmap
• Nmap is a multifunctional tool that does not only perform host discovery and
enumeration. As an example nmap comes with a script to query the DNS
server for additional hosts using a brute forcing technique. It makes use of
the [Link] and [Link] dictionary files, which contain a large
list of common hostnames The files are stored here:
/usr/share/nmap/nselib/data/.
• Nmap sends a query to the DNS server for each entry in that file to check
whether there are any A records available for that hostname in the DNS zone.
DNS data harvesting
Recon-ng
• Gathering information about the subdomains of the target website will help
you identify different content and features of the website. Each product or
service provided by the target organization may have a subdomain dedicated
to it. This aids in organizing diverse content in a coherent manner. By
identifying different subdomains, you can create a site map and a flowchart
interconnecting the various pieces and understand the flow of the website
better.
• This is crucial when planning the attack as you need to know what is the
targets attack surface!
• NOTE: RECON-NG also has exploitation modules included which can be used
for attack!
Search engines
Google dorks
• The Google dorks technique, also known as Google hacking, started as an abuse of
Google’s advanced search options. Other search engines also include similar
options.
It searches for specific strings and parameters to get valuable information from an
organization or target.
PDF documents in a domain:
site:[Link] filetype:pdf
References to email addresses of a specific domain, excluding the domain's site:
"@[Link]" -site:[Link]
Administrative sites with the word admin in the title or the URL in [Link]:
intitle:admin OR inurl:admin site:[Link]
Specific error message indicating a possible SQL injection vulnerability:
"SQL Server Driver][SQL Server]Line 1: Incorrect syntax near“ site:[Link]
Search engines
Shodan
• [Link] is a specific search engine which allows you to look for
devices connected to the internet instead of content in web pages. Like
Google, it has operators and a specific syntax to execute advanced and
specific searches.
• Google Hacking Database (Google dorks on steroids)
• [Link]
• Set of prepared and sorted search queries that will find data their owners
never wanted you to see…
Source Code repositories
• Open-Source Code repositories can be used to passively search for
information. Resources such GitHub,PasteBin, GitLab or SourceForge are a
valuable source of information. Code stored online can provide a view into
the programming languages and frameworks used by an organization. Many
times developers have even accidentally committed sensitive data such as
keys or credentials on this repos. The search tools for some of these
platforms will support the Google search operators that we discussed earlier
in this module.
• On GitHub, we will be able to search a user or organization repository, but we
need an account if we want to search across all public repos.
QUESTIONS???