Downloaded 27 times
Uploaded bySam Bowne
CNIT 124: Ch 5: Information Gathering
Chapter 5 of CNIT 124 covers advanced ethical hacking techniques, particularly focusing on information gathering through open source intelligence (OSINT). It discusses various tools and commands like WHOIS and DIG for DNS queries, as well as methods for email harvesting and port scanning using Nmap. The chapter emphasizes the importance of understanding limitations and risks associated with different scanning techniques in penetration testing.
More Related Content
Similar to CNIT 124: Ch 5: Information Gathering
CNIT 124: Ch 5: Information Gathering
- 1. CNIT 124: Advanced Ethical Hacking Ch5: Information Gathering
- 2.
- 3. Useful Info fora Pentest • Employees who talk too much – Twitter, Facebook, etc. • Archived listservs may have technical questions • What software and hardware are they using? – Defenses such as firewalls – Security problems – Extra systems like ActiveMQ
- 4.
- 5.
- 6. CCSF.EDU • Normal record •Informative • Compare to kittenwar.com • Privacy protections
- 7. Whois Limitations • Datacan be fake or concealed • "whois microsoft.com" has a strange result (NSFW) because it searches the whole FQDN, so people have added joke records • Seems to no longer work as of 9-16-17
- 8.
- 9. DNS Queries • digsamsclass.info • dig samsclass.info aaaa • dig samsclass.info ns • dig samsclass.info soa • dig samsclass.info any
- 10.
- 11. Dig at aspecific server • dig samsclass.info any – 10 records • dig @8.8.8.8 samsclass.info any – 18 records • dig @coco.ns.cloudflare.com samsclass.info any – 10 records
- 12. DNS Cache SnoopingDemo • Make a new DNS record • dig +norecurse @109.69.8.51 test360.samsclass.info • Shows record, if it's in the cache • dig @109.69.8.51 test360.samsclass.info • Caches record
- 13. Find a PublicResolver • Link Ch 5d
- 14. Nonrecursive Query • Serverhas no data in its cache • Doesn't ask other servers (nonrecursive) • Finds no answer – Command works the same way on Kali Linux and Mac OS X
- 15. Recursive Query • DNSserver asks other servers and finds the record • Note its TTL starts at 3600 seconds
- 16. Nonrecursive Query • Nowthe data is in the cache • This shows that someone has resolved that site on this server recently
- 17. Demo: puntCAT Server •Cache Snooping works simply on a single server • Public DNS Servers: Link Ch 5j
- 18. Demo: OpenDNS Cluster •One recursive query puts it in one cache • Cached record observed in 3/12 queries
- 19. Demo: OpenDNS Cluster •Ten recursive queries puts it in more caches
- 20. Demo: OpenDNS Cluster •Cached record observed in 6/10 queries
- 21.
- 22. Zone Transfers • Firstfind SOA
- 23.
- 24. University System ofGeorgia • 1038 records • Link Ch 5e
- 25. Fierce DNS Scanner •included in Kali • Attempts a zone transfer • Then brute- forces domain names
- 26.
- 28.
- 30. Searching for EmailAddresses
- 31. theHarvester • Searches Google. Bing,and other sources for email addresses • Also finds sites hosted at the same IP
- 32.
- 34.
- 35. Manual Port Scanning •Some services show a banner as soon as a connection is made • The banner could be deceptive, however • Many services, like HTTP and DNS, don't deliver a banner so easily
- 36. Nmap SYN Scan •-sS switch • Sends SYN, listens for SYN/ACK • Doesn't complete the handshake, just sends a RST
- 37. Nmap Scan Limitations •Nmap is so popular, IDS and IPS systems often detect it • They may block all results
- 38. SYN Scan ofServer 2008 Took 40 sec.
- 39. Version Scan • -sVswitch • Grabs banners to determine version
- 40. Version Scan ofWindows 2008 Took 110 sec.
- 41. UDP Scans • -sUswitch • Sends packets to commonly-used UDP ports • Packets are valid service requests • Servers running on default ports will reply • Closed ports return an "ICMP Unreachable" packet • Cannot tell an open port that doesn't reply from a filtered port
- 42. UDP Scan ofWindows 2008 Took 1200 sec.
- 43. Scanning Specified Ports •By default, Nmap scans 1000 "interesting" ports • You can specify ports with –p switch • -p 80 will scan one port • -p 23, 25, 80 will scan three ports • -p 1-65535 will scan them all (slow)
- 44. Nmap Version ScanCrashes Server • Rarely happens, but is a possibility