SUMMARY

 Chap01: Introduction to “Pentest”

 Chap02: Gathering Target Information: Reconnaissance, Footprinting, and Social

Engineering

 Chap03: Gathering Network and Host Information: Scanning and Enumeration

 Chap04: System Pentesting: Password Cracking, Escalating Privileges, and Hiding Files

 Chap05: Trojans, Backdoors, Viruses, and Worms

 Chap06: Gathering Data from Networks: Sniffers

 Chap07: Web Pentesting: Google, Web Servers, Web Application Vulnerabilities,

 Chap08: Attacking web Applications: SQL Injection

 Chap09: Pentesting Linux Systems

 Chap10: Pentesting Mobile Platforms (Android)

 Chapte
Chapter Gathering Target Information:
r Reconnaissance, Footprinting,

22 and Social Engineering

OBJECTIVES COVERED IN T H I S C H AP T E R

01 Define the term

footprinting
07 Understand how traceroute
is used in footprinting

02 Describe information-
gathering methodology
08 Understand how email
tracking works

03 Describe competitive
intelligence
09 Understand how web
spiders work

04 Understand DNS
enumeration
10 What is social
engineering?

05 Understand Whois
lookup
11 Understand
dumpster diving

06 Identify different types of

DNS records
12 Understand insider attacks, identity theft,
online scams, URL obfuscation,phishing
 Gathering Target Information: Reconnaissance,
Chapter Footprinting, and Social Engineering

2 The first step of the hacking process is gathering information on a target. Information
gathering, also known as foot-printing, is the process of gathering all available information
about an organization.

WEBSITES/PHONES/FAX / VOIP ?
NEWS

SITES HIRING

EMPLOYERS
CLIENT / SUPPLIER

WAYBACKS
SOCIAL MEDIA
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r
22  Reconnaissance
In the world of Pentesting, reconnaissance
applies to the process of information gathering.
Reconnaissance is a catchall term for watching
the hacking target and gathering information
about how, when, and where they do things. By
identifying patterns of behavior, of people or
systems, an enemy could find and exploit a
loophole

 Competitive
Intelligence
Competitive intelligence means information
gathering about competitors’ products,
marketing, and technologies. Most competitive
intelligence is nonintrusive to the company
being investigated and is benign in nature—it’s
used for product comparison or as a sales and
marketing tactic to better understand how
competitors are positioning their products or
services
Chapter Gathering Target Information: Reconnaissance,
Chapte Footprinting, and Social Engineering

22r PING

$ ping [Link]
OR
$ ping [Link]

sending 5 packets
$ ping -c 5 [Link]

set interval in seconds between sending each packet

$ ping -i 3 -c 5 [Link]

“flood ping
$ sudo ping -f [Link]

broadcast
ping -b [Link]

TTL
ping -t 10 [Link]
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r Using Traceroute in Footprinting

22
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r Email Tracking

22 Most email-tracking programs work by appending a domain name to the email address,
such as [Link]. A single-pixel graphic file that isn’t noticeable to the recipient is
attached to the email. Then, when an action is performed on the email, this graphic file
connects back to the server and notifies the sender of the action

ReadNotify Pointofmail
is a certified email service Know who opens your
that lets you know an emails, links and
email you sent was attachments, where and
opened, read, or for how long. Recall and
forwarded send self-destructed
emails.
25 email for free
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r Social Engineering

22 Social engineering is a nontechnical method

of breaking into a system or network. It’s the
process of deceiving users of a system and
convincing them to perform acts useful to
the hacker, such as giving out information
that can be used to defeat or bypass security
mechanisms. Social engineering is important
to understand because hackers can use it to
attack the human element of a system and
circumvent technical security measures. This
method can be used to gather information
before or during an attack. A social engineer
commonly uses the telephone or Internet to
trick people into revealing sensitive
information or to get them to do something
that is against the security policies of the
organization. By this method, social
engineers exploit the natural tendency of a
person to trust their word, rather than
exploiting computer security holes. It’s
generally agreed that users are the weak link
in security; this principle is what makes
social engineering possible
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r Social Engineering

22  A Simple Test
Try to read the COLOR of the word not what the word spells. Do it as fast as
possible, not stopping to think.

This exercise shows it is possible to have “code” execute in the

human brain that might be the opposite of what the person is
thinking or seeing.
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r
22 Types of Social Engineering-Attacks
Online Scam Example

Human-Based
Mail server report Computer-Based
Our firewall determined the e-mails containing worm copies are
 sent
being from [Link]
Impersonating Employee 523/18/10 6:48:09
 Email attachments
AM or Valid User  Fake websites
 Posing as an Important  Pop-up windows
User (intimidation of lower-
Nowadays it happens from many computers, because this is a new
level employee)
virus type (Network Worms).
 Using a Third Person
Using
 the new
Calling bug in Support
Technical the Windows, these viruses infect the
computer unnoticeably.
 Shoulder Surfing
 the
After penetrating
Dumpster Diving into the computer the virus harvests all the e-
mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer

restoring.

Best regards,

Customer support service

 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

Social Engineering Gophish

r
22 Prerequistes:
- Kali Linux
- Gmail Account

STEPS:

1. IN GMAIL ACCOUNT: GIVE ACCESS TO USE SMTP FROM APPS

-go to your google account
- go to security
- scroll to where it says “less secure app access”

2. INSTALL AND CONFIGURE GOPHISH ON KALI:

└─ $ wget [Link]
└─$ mkdir gophish
└─$ unzip [Link] -d gophish
└─$ chmod +x gophish
└─$ ./gophish
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

Social Engineering Gophish

r
22 Prerequistes:
- Kali Linux
- Gmail Account

STEPS:

└─$ ./gophish
time="2022-05-16T06:58:01-04:00" level=warning msg="No contact address has been configured."
time="2022-05-16T06:58:01-04:00" level=warning msg="Please consider adding a contact_address
entry in your [Link]"
goose: no migrations to run. current version: 20200730000000
time="2022-05-16T06:58:01-04:00" level=info msg="Please login with the username admin and the
password 67b49126caaae53e"

- Firefox : [Link]

- [Link]

- Create a new profile (config of Sender and SMTP):

- email and password of gmail account
- SMTP: [Link]

- Send TEST EMAIL

 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

Social Engineering Gophish

r
22 Prerequistes:
- Kali Linux
- Gmail Account

STEPS:

- Create Template : [Link]

- Create Landing Page : [Link]
- Create a Group: [Link]
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

Social Engineering Gophish

r
22 Prerequistes:
- Kali Linux
- Gmail Account

STEPS:

- Create Template : [Link]

<html>
<head>
<link rel="stylesheet" href="[Link]
</head>
<body style="background-color:#A9A9A9">
<div class="container" >
<div class="container" style="background-color:#FFF;">
<br><br>
<p>This email is being sent to all employees with a company email address. If someone on your team does not have an company email,
please refer them to our intranet to read this and other company wide communications. If you have issues accessing our intranet, please
use the attached instructions.</p>
<h1>Breaking News</h1>
<h3>What's been happening at our company?</h3>
<p>We are very proud to talk about what has been happening at our company. There is so much going on to be proud of in multiple
divisions and across the globe. But what make this email more important aside from showing you what is going on in other departments is
discussing how this will effect you.</p>
<p>We want to make sure that no employee feels left out because we value you {{.FirstName}}.</p>
<p>I'm sure you're eager to hear about what's going on at our company, so go ahead and click the link below to read about what's going
on. We appreciate your time and continued dedication as an employee at our company.</p>
<p>Thank you for taking the time to read this email and for all the contributions you've made to our company. Remember you are a
valued employee here and we look forward to hearing from you in the future</p>
<h4><a href={{.URL}}>Exciting News</a></h4>
<br><br><hr>
<p>Best Regards:</p>
<p>The news Team</p>
<p></p>
</div>
</div>
</body>
</html>
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

Social Engineering Gophish

r
22 Prerequistes:
- Kali Linux
- Gmail Account

STEPS:

Install and configure Ngrok:

- Create account in [Link]
- Sudo ngrok config add-authtoken 1awMePVwXodTcfkBXqtKw7Ag3RX_wHAyXy1Mv9uRuBBMaH2
- Sudo ngrok http 80

Create a Compaign:
- Create account in [Link]
 Gathering Target Information: Reconnaissance,
Chapter Footprinting, and Social Engineering

DNS lookup using DomainHostingView

2 1. Install DomainHostingView : Tools/chapter2/[Link]

[Link]/emFGT
1. Search for [Link]
Chapter

2
OSINT
Open Source INTelligence
 OSINT Open Source INTelligence
Chapter

2 OSINT

 Open-Source Intelligence (OSINT) is intelligence collected from public available

sources

 “Open” refers overt, public available sources

 Its not related to open-source software or public intelligence

 This information comes from a variety of sources: including the social

media pages of your company and staff.

 Government, Finance, Telecom, Critical Infrastructure,

 The OSINT gives opportunities to both the defender and attacker; you can learn

the weakness of a company and fix it while at the same time the weakness could

be exploited.
 OSINT Open Source INTelligence
Chapter
Social networks expose private and

2 professional life…
 OSINT Open Source INTelligence
Chapter
Social networks expose private and

2 professional life…
 OSINT Open Source INTelligence
Chapter
OSINT PROCESS

2  COLLECTION
1. Technology infrastructure
IP, Hostname, Services, Networks,
Software / hardware versions
and OS information,
Geo-location and Network diagrams.
2. Database
Documents, papers, presentations
configuration files
3. Metadata
Email and employee search (name and other personal information)

 PROCESSING

- Eliminate duplicates
- Eliminate False positive
- Stuctured data

 Analysis
- Prediction of possible attack
- Choose of attack vector (pattern)
 OSINT Open Source INTelligence
Chapter
OSINT – End goals

2 Everybody is interested in something

Social Engineering
The information above can lead to the following cyber attacks:

Denial of Service

Password attacks

Target infiltration

Identity theft

Malware attack
 OSINT Open Source INTelligence
Chapter
OSINT – Specialty Search Engines

2 2lingual makes it easy to Google Search Deep Search | visual presentation

in 2 languages

[Link]
[Link]

Way-back machine Organizes search results into topics

[Link]
[Link]

Search by file type

[Link]
 OSINT Open Source INTelligence
Chapter
OSINT – IP, DNS, Web-footprinting

2 IP to Google Maps
DIG service

[Link] [Link]

Tech Reconnaissance
IP numbers, Domain names, etc

[Link] [Link]

dns recon & research, find &

lookup dns records

[Link]
 OSINT Open Source INTelligence
Chapter
OSINT – Breach DATA

2 Check if you have an account that has been

compromised in a data breach

[Link]

[Link]

[Link]
 OSINT Open Source INTelligence
Chapter
OSINT – IOT

2 SEARCH QUERY EXAMPLES

 OSINT Open Source INTelligence
Chapter
OSINT –GOOGLE DORKS

2 allintext
Searches for occurrences of all
the keywords given.

Searches for the occurrences of

allintext:"keyword"

intext keywords all at once or one at a intext:"keyword"

time.

Searches for a URL matching one

inurl inurl:"keyword"
of the keywords.

Searches for a URL matching all

allinurl allinurl:"keyword"
the keywords in the query.

Searches for occurrences of

intitle intitle:"keyword"
keywords in title all or one.

Searches for occurrences of

allintitle allintitle:"keyword"
keywords all at a time.

Specifically searches that

site particular site and lists all the site:"[Link]"
results for that site.

Searches for a particular filetype

filetype filetype:"pdf"
mentioned in the query.

Searches for external links to

link link:"keyword"
pages.

[Link]
Chapter

2
OSINT Open Source INTelligence

OSINT | Open-source
Tools
 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2
PHOTON
fast crawler designed for OSINT (websites)

Installation

$ git clone [Link]

$ cd Photon
$ python3 -m pip install -r [Link]

Usage
sudo python3 [Link] --url [Link]
 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2 INFOGA - EMAIL OSINT

Gathering email accounts informations (ip,hostname,country,...) from
different public source (search engines, pgp key servers and shodan)
and check if emails was leaked using [Link]

Installation
$ git clone [Link]
$ cd Infoga
$sudo python [Link] install
$ python [Link]

Usage
python [Link] --domain [Link]
 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2 MOSINT - EMAIL OSINT

•Email validation
•Check social accounts with Socialscan
•Check data breaches
•Find related emails
•Find related domains
•Scan Pastebin Dumps
•Google Search
•DNS Lookup
•IP Lookup
•Find subdomains of domain

Installation
git clone [Link]
cd mosint
pip3 install -r [Link]

Usage
go run [Link] -e example@[Link] -all
 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2
THEHARVESTER
Gathering to help determine a company's external threat landscape on the interne
The tool gathers emails, names, subdomains, IPs and URLs using
multiple public data sources that include:

Usage
theHarvester -d [Link] -l 10 -b google
 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2 Fast Google Dorks Scan

 Prequisites:
Kali-Linux VM

 Installation

$ git clone [Link]

$ cd Fast-Google-Dorks-Scan
$ chmod +x [Link]

 Usage

root@kali:~# ./[Link] [Link]

 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2  Prequisites:
Kali-Linux VM

 Installation

root@kali:~# pip install r3con1z3r

 Usage

root@kali:~# r3con1z3r -d [Link]

root@kali:~# firefox [Link]
 OSINT Open Source INTelligence
Chapter
OSINT | Kali-linux

2 SPIDERFOOT
open source intelligence (OSINT) automation
tool. It integrates with just about every data
source available

Installation
#clone the repo
git clone [Link]
#change the working directory
$cd spiderfoot
# install the requirements
$ pip3 install -r [Link]

Usage
python3 ./[Link] -l [Link]:5001
Chapter

2
SOCIAL ENGINEERING
Chapter 5 COMMON TYPES OF PHISHING

2
Chapter 5 COMMON TYPES OF PHISHING

2
 PHISHING MAIL : SETOOLKIT
Chapter

2 Objectif: Create a phishing gmail login page

1. Install ngrok :
┌──(kali㉿kali)-[~]
└─$ sudo curl -s [Link] | sudo tee
/etc/apt/[Link].d/[Link] >/dev/null && echo "deb [Link]
[Link] buster main" | sudo tee
/etc/apt/[Link].d/[Link] && sudo apt update && sudo apt install
ngrok

- Sign up ([Link]
- ngrok config add-authtoken (your-token-from-web-interface)

┌──(kali㉿kali)-[~]
└─$ sudo ngrok http 80
2. Use setoolkit :
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo setoolkit

1) Social-Engineering Attacks
2) Website Attack Vectors
3) Credential Harvester Attack Method
1) Web Templates
ENTER
2. Google
 SPOOFING EMAIL : SWAKS
Chapter

2 └─$ Dig MX [Link]

 [Link]

└─$ swaks --server [Link] --to victim@[Link] --from

attacker@[Link] --header "Subject:contract“ --body

This is a test
 PHISHING ATTACK USING HIDDENEYE
Chapter

2  Prequisites:
Kali-Linux VM

 Installation
[Link]/39qSQQV
- git clone [Link]
- cd HiddenEye
- sudo apt install python3-pip
- sudo pip3 install -r [Link]
- chmod 777 [Link]

 Usage

- python3 [Link]

- you will have an url for you phishing site like : [Link]

- Once victim access to page and enter credentials you will have it on your

HiddenEye screen
 IPlogger
Chapter

2 1. Go to : [Link]

2. Create an account
3. [Link]
4. Send it to someone
5. Verify information after victim opened image
6. Try to escape browser filter:
- Create a hidden image in iplogger
- create html file and insert an image :
Hello how are you ?
<img src="[Link]

7. Send link and see result

 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r
22 Chapter 2 Review Questions
 Gathering Target Information: Reconnaissance,
Chapte
Chapter Footprinting, and Social Engineering

r
22
1. Which of the following is a tool for performing footprinting undetected?
A. Whois search
B. Traceroute
C. Ping sweep
D. Host scanning

2. What is the next immediate step to be performed after footprinting?

A. Scanning
B. Enumeration
C. System hacking
D. Bypassing an IDS

3. How does traceroute work?

A. It uses an ICMP destination-unreachable message to elicit the
name of a router.
B. It sends a specially crafted IP packet to a router to locate the
number of hops from the sender to the destination network
C. It uses a protocol that will be rejected by the gateway to determine
the location
D. It uses the TTL value in an ICMP message to determine the number
of hops from the sender to the router.
 Gathering Target Information: Reconnaissance,
Chapter Footprinting, and Social Engineering

4. What information-gathering tool will give you information regarding the

2 operating system of a web server?

A. NSlookup
B. DNSlookup
C. tracert
D. Netcraft

5. Faking a website for the purpose of getting a user’s password and

username is which type of social-engineering attack?
A. Human-based
B. Computer-based
C. Web-based
D. User-based

6. Which of the following is a type of social engineering?

A. Shoulder surfing
B. User identification
C. System monitoring