Passive Reconnaissance:#

  • Rely on publicly available knowledge. It is the knowledge that you can access from publicly available resources without directly engaging with the target. Think of it like you are looking at target territory from afar without stepping foot on that territory. For Example:
  • Looking up DNS records of a domain from a public DNS server.
  • Checking job ads related to the target website.
  • Reading news articles about the target company.

Whois:#

  • WHOIS is a request and response protocol that follows the RFC 3912 specification. A WHOIS server listens on TCP port 43 for incoming requests.
  • The domain registrar is responsible for maintaining the WHOIS records for the domain names it is leasing. The WHOIS server replies with various information related to the domain requested such as Registrar, Contact info of registrant, Creation &update & expiration dates, Name Server.
  • To get this information, we need to use a whois client or an online service.
  • The syntax is whois DOMAIN_NAME, where DOMAIN_NAME is the domain about which you are trying to get more information. For example: whois tryhackme.com

nslookup (name server lookup):#

  • Used to find IP address of domain name
  • command format: nslookup domain_name. For example nslookup tryhackme.com
  • Or we can also provide options to get desired response,
  • nslookup OPTIONS domain_name dns_server
  • Most popular dns servers: Cloudflare offers 1.1.1.1 and 1.0.0.1, Google offers 8.8.8.8 and 8.8.4.4, and Quad9 offers 9.9.9.9 and 149.112.112.112.
  • OPTIONS include: A- ipv4, AAAA - ipv6, CNAME - conical name, MX - Mail servers, SOA - Start of authority, TXT - TXT Records.
  • For example, nslookup -type=A tryhackme.com 1.1.1.1 returns all the ipv4 addresses of tryhackme.com
  • nslookup --type=MX tryhackme.com returns all the mail servers and configurations from the tryhackme.com

dig (Domain Information Grouper):#

  • Also, used to gather info about the dns records.
  • command format: dig @DNS_SEVER DOMAIN_NAME TYPE
  • For example: dig tryhackme.com MX
  • dig returns more info than nslookup such as TTL by default

How to discover subdomains of particular domain:#

  • https://dnsdumpster.com - it will return all the collected DNS information in easy-to-read tables and graph. It will also provide any collected information about the listening servers. (resolve dns, and geolocate ips, provides owner info as well)

Active reconnaissance#

  • It requires direct engagement with the target. Think of it like you check the locks on the doors and windows, among other potential entry points. For example:
  • Connecting to one of the company servers such as HTTP, FTP, and SMTP.
  • Calling the company in an attempt to get information (social engineering).
  • Entering company premises pretending to be a repairman.

Web browser:#

Ping:#

tracroute (tracert in windows):#

  • The purpose of a traceroute is to find the IP addresses of the routers or hops that a packet traverses as it goes from your system to a target host.
  • commannd format traceroute ip_or_hostnaame

Telnet:#

  • The TELNET (Teletype Network) protocol was developed in 1969 to communicate with a remote system via a command-line interface (CLI). Hence, the command telnet uses the TELNET protocol for remote administration.
  • The default port used by telnet is 23. From a security perspective, telnet sends all the data, including usernames and passwords, in cleartext.
  • Knowing that telnet client relies on the TCP protocol, you can use Telnet to connect to any service and grab its banner. Using telnet 10.49.153.206 PORT, you can connect to any service running on TCP and even exchange a few messages unless it uses encryption.
  • GET / HTTP/1.1 or specify something other than the default index page, you can issue GET /page.html HTTP/1.1 with HTTP version 1.1 for communication

nmap:#