Download to read offline
![Nmap Command Structure
$ nmap <OPTIONS> [TARGET]
$ nmap 10.10.56.18
$ nmap -p 21,22,80,443 10.10.56.0/24](https://image.slidesharecdn.com/technical-information-gathering-slides-221003141717-3873285f/75/technical-information-gathering-slides-pdf-48-2048.jpg)
![Output Formats
Normal output:
nmap 192.168.10.10 -oN result.nmap
XML output:
nmap 192.168.10.10 -oX result.xml
Grepable output:
nmap 192.168.10.10 -oG | grep [string]
Output all types:
nmap 192.168.10.10 -oA result
[result.nmap, result.xml and result.gnmap]](https://image.slidesharecdn.com/technical-information-gathering-slides-221003141717-3873285f/75/technical-information-gathering-slides-pdf-53-2048.jpg)
![Timing Options
Setting scan speed:
nmap –T [0-5] 192.168.10.10
Slow:0, Fast 5, Default: 3
Delay between probes:
nmap --scan-delay 5 192.168.10.10](https://image.slidesharecdn.com/technical-information-gathering-slides-221003141717-3873285f/75/technical-information-gathering-slides-pdf-54-2048.jpg)
More Related Content
Similar to technical-information-gathering-slides.pdf
![Number_Guessing_Game_Dsbsbssbzboc[1].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/numberguessinggamedoc1-251206215042-a076fc05-thumbnail.jpg?width=640&height=640&fit=bounds)
technical-information-gathering-slides.pdf
- 1. Information Gathering andVulnerability Scanning for CompTIA Pentest+ Technical Information Gathering Ricardo Reimao, OSCP, CISSP Cybersecurity Consultant
- 2. Gathering relevant information aboutyour target
- 3. Information and VulnerabilityGathering Technical Information People Information Vulnerability Information
- 4. CompTIA Pentest+ (PT0-002) 1.Planning and Scoping 2. Information Gathering and Vulnerability Scanning 3. Attacks and Exploits 4. Reporting and Communications 5. Tools and Code Analysis
- 5. Information Gathering andVulnerability Scanning Course Overview Basic Enumeration Concepts Technical Information Gathering OSINT Techniques Active Scanning People Information Gathering Vulnerability Scans Several Demos
- 6. Course Scenario You areexecuting your first pentest against Globomantics Corporation Scope: - 2 External networks (around 40 IPs) - 3 External websites - Social engineering Your job is to enumerate both technical and people information about your target Find vulnerabilities to be exploited in the next phase
- 7. Recommended Knowledge Previous Course: Planningand Scoping for CompTIA Pentest+ Basic understanding of cyber security concepts Moderate networking, operational systems, and scripting skills
- 8. The Overall PentestingProcess Planning and Scoping Information Gathering Vulnerability Analysis Exploitation Post Exploitation Reporting
- 9. Why Information Gathering? Themore you enumerate, the more likely you will find useful vulnerabilities to be exploited Usually vulnerabilities are present in the most hidden services Makes the exploitation phase easier/quicker Provides to the client a picture of how much information is being shared Differentiates a good pentester from the rest
- 10. Understanding Passive andActive Information Gathering
- 11. Information Gathering Types Passive Gatheringinformation without interacting with the target Collect information from third-party sources It is considered stealthy Example: Searching on Google about your target Active Gather information by actively probing your target Collect information directly from the target machines It is considered noisier Example: Performing a port scan against a server
- 12. Importance of PassiveInformation Gathering Gives an initial picture of the target without any interaction - Public facing assets Third part providers are really good sources of information - Google, Shodan, WHOIS, etc. Some engagements might require you to be stealthy Complements the active information gathering
- 13. Open Source Intelligence(OSINT) Collecting data from multiple publicly available sources Google Searches (Dorks) Social Media Scrapping Shodan Threat Intelligence Sources Web Archive etc. https://osintframework.com/
- 14. Examples of PassiveInformation Gathering Technical Information Searching subdomains on Google/Bing Searching open services on Shodan Performing WHOIS lookups Searching sensitive data on GitHub People Information Searching LinkedIn for employees Harvesting emails from search engines Analyzing social media from employees Scrapping public documents
- 15. Importance of ActiveInformation Gathering Extracting further information about your target - Brute forcing domains - Enumerating ports and services - etc. Complements (not replaces) the passive information gathering
- 16. Risks on ActiveInformation Gathering Interacts with the target It’s noisier, generate logs with your IP If being stealthy is a requirement, recommended to use a VPN and slow-scans
- 17. Examples of ActiveInformation Gathering Technical Information Scanning IP ranges DNS Queries Port scans Web application scans People Information Social engineering Calling reception and asking for information Emailing executives phishing for information
- 18. Passive Technical InformationGathering
- 19. Types of RelevantData Domains Subdomains Hosts Networks Users and Groups Web Pages Applications and Services Sensitive Documents Tokens and Keys
- 20. Main Sources ofData • Google • Bing • Baidu • Shodan Search Engines • LinkedIn • Facebook, Instagram, etc. • Job Postings Social Media • Threat Intelligence Platforms • Data Breach Compilations • Web Archive • WHOIS, Certificate Databases Third Party Information Databases
- 21. Main Techniques Certificate Database Searches DNSLookups WHOIS and Reverse WHOIS Job Posting Enumeration Search Engine Enumeration Website Crawling
- 22. Main Tools Sn1per OWASP AmassMaltego Recon-NG theHarvester
- 23. Searching Third-Party Sourcesof Information
- 24. What are Third-PartySources of Information? Services that collect and centralize information Main examples: - Search engines - Shodan - Web archives - etc.
- 25. Search Engine Enumeration Gathering informationfrom search engines (Google, Bing, Baidu, etc.) Google Dorks Find all PDFs in a domain: site:nasa.gov filetype:pdf Find log files containing usernames: site:nasa.gov filetype:log allintext:user Find browsable directories: site:nasa.gov intitle:"Index of /" Google Hacking Database (GHDB): https://www.exploit-db.com/google-hacking-database
- 26. Shodan.io Advanced type ofsearch engine Allows you to search for specific technologies and services Example: Find servers with port 21 open Allows you to search for metadata
- 27.
- 28. Password Dump Databases Searchfor accounts that were compromised in previous data breaches People reuse passwords Main sources: - HaveIBeenPwned - Collection #1-#5
- 29.
- 30. Website Archives Services thatallow you to search for old versions of websites You can use to find information that is not publicly available anymore Most used service: https://archive.org/web/
- 31.
- 32. CVE/CWE Searches Common VulnerabilityEnumeration (CVE) Common Weakness Enumeration (CWE) Helps you to find vulnerabilities associated to a product/service Describe the vulnerabilities/weaknesses and how to mitigate them Supported by several cybersecurity tools
- 33. Public Document Enumeration GoogleDorks https://www.exploit-db.com/google-hacking-database FOCA https://github.com/ElevenPaths/FOCA Metagoofil https://github.com/opsdisk/metagoofil
- 34. GitHub Searches Sometimes peopleupload code to GitHub and forget to remove sensitive data Search for GitHub pages containing sensitive information - Usernames, passwords, private keys, tokens, IPs, domains, etc. Tools: - GitLeaks (https://github.com/zricethezav/gitleaks) - TruffleHog (https://github.com/trufflesecurity/truffleHog)
- 35. Actively Gathering Domains/IPAddresses
- 36. Why Enumerating Domainsand IPs? Passive recon is really useful but might not find all available domains/IPs Actively probing the targets might return more information Active enumeration complements passive enumeration (does not replace)
- 37. Main Techniques forDomain/IP Enumeration DNS Queries Domain Brute-forcing Website Crawling Discovery Scans (Ping Scans)
- 38. Active Enumeration Considerations Mightgenerate a lot of traffic to the targets Might cause instability It is important to validate with the client Use slow enumeration for slow networks Ensure the IPs/Domains are part of the scope - Be careful with cloud environments
- 39. Demo Installing OWASPAmass Discovering domains and IPs - DNS queries - Domain brute-forcing - WHOIS searches - Passive enumeration
- 40. Demo Finding specific serviceswith Shodan Enumerating subdomains with Recon-ng
- 41. Actively Gathering Port andService Information
- 42. Why Gathering Portand Service Information? Helps you to understand the technologies that the client uses Enumerate the services and their versions Find vulnerabilities for the specific services Gives an overall picture of the exposure of the client
- 43. Main Tools/Techniques for Portand Service Enumeration Packet Analysis/NCAT Shodan Custom/Manual Scripts Nmap
- 44. Considerations for Port/ServiceEnumeration Port scans might impact slow networks - Scan in non-business hours - Use slow scans It might not be stealthy Port scans might leave traces on the security detection tools (SIEM, Firewalls, IPS, WAF, etc.) It is important to document well everything you find - Take notes of the ports/services you find
- 45. Demo NetCat Usage How tointeract with a service Enumerating a service with NetCat
- 46.
- 47. Importance of Nmap Oneof the most used tools by pentesters Allows you to enumerate hosts, applications, services, banners, vulnerabilities and much more From a simple ping scan to complex vulnerability checks Highly customizable
- 48. Nmap Command Structure $nmap <OPTIONS> [TARGET] $ nmap 10.10.56.18 $ nmap -p 21,22,80,443 10.10.56.0/24
- 49. Target Selection IP: nmap192.168.18.56 IP Range: nmap 192.168.18.10-25 Network: nmap 192.168.18.0/24 IP Mask: nmap 192.168.*.10 Hostnames: nmap mail.globomantics.com List of targets: nmap –iL targets.txt
- 50. Port Selection Most commonports: nmap 192.168.10.10 Specific port: nmap -p 22 192.168.10.10 List of ports: nmap -p 22,23,80 192.168.10.10 Range of ports: nmap -p 1-2014 192.168.10.10 Top 100 ports: nmap -F 192.168.10.10 Scan all ports: nmap -p- 192.168.10.10
- 51. Scan Types (TCPConnect vs SYN) SYN (HELLO?) SYN – ACK (HELLO, HOW ARE YOU?) ACK (I’m fine!) Data TCP Connect Scan: Nmap does a full TCP connection on each port TCP SYN Scan: Nmap receives the “SYN-ACK” and drops
- 52. Scan Types TCP ConnectScan: nmap -sT 192.168.10.10 SYN Scan: nmap -sS 192.168.10.10 ACK Scan: nmap -sA 192.168.10.10 UDP Scan: nmap -sU 192.168.10.10
- 53. Output Formats Normal output: nmap192.168.10.10 -oN result.nmap XML output: nmap 192.168.10.10 -oX result.xml Grepable output: nmap 192.168.10.10 -oG | grep [string] Output all types: nmap 192.168.10.10 -oA result [result.nmap, result.xml and result.gnmap]
- 54. Timing Options Setting scanspeed: nmap –T [0-5] 192.168.10.10 Slow:0, Fast 5, Default: 3 Delay between probes: nmap --scan-delay 5 192.168.10.10
- 55. Intensity Options Version detectionintensity: nmap --version-intensity 9 192.168.10.10 Few probes = lower number Default: 7 Aggressive scan: nmap –A 192.168.10.10
- 56. Nmap Scripts Several scriptsto expand the NMAP Capabilities You can create your own custom scripts smb-vuln-ms-010 (eternal blue) smb-enum-shares (enumerate SMB shares) ftp-anon (FTP Anonymous login) $ nmap -p 445 --script smb-os-discovery 192.168.0.56
- 57. Demo Nmap basics Scanningan IP Exploring important arguments Understanding the output
- 58. Website Scrapping andCrawling
- 59. Importance of Crawling/ScrappingWebsites Gather target information Find new URLs and subdomains Extract people information Names, email addresses, phone numbers Extract potential sensitive information API tokens, in-code password, etc. Allows you to quickly process a whole website Avoids loading times
- 60.
- 61. Difference between activeand passive information gathering Passive technical information gathering - Search engine (Dorks), Shodan, etc. Active technical information gathering - Domain brute-forcing, Nmap scans, etc. Several demos: - OWASP Amass, Recon-ng, Shodan, NetCat, Nmap, etc. Summary
- 62. Next up: People InformationGathering