‫Hello and welcome to this information gathering over the Internet lecture.
‫The first phase and security assessment is focused on collecting as much information as possible about
‫the target, information gathering is one of the most critical steps of hacking or penetration testing.
‫The more information is gathered about the target, the more it becomes possible to customize the attack.
‫In this section, we're going to answer these questions.
‫What can we learn about the target over the Internet?
‫How can we collect the information?
‫Where can we find the information about the target?
‫Before we begin, we should answer a basic question, what is the target?
‫Target is the company institute network system, or even a person that we want to hack an application,
‫a person, a system will try to collect every bit of information that helps us to hack the target.
‫There are two types of information gathering, the first type is passive information gathering in this
‫type of information gathering.
‫You don't want to be detected by the target in this regard.
‫You don't use tools that send traffic to the target, neither from your host nor an anonymous one across
‫the Internet.
‫Passive information gathering activities may include, but are not limited to identifying IP addresses
‫and subdomains, identifying external or third party sites, identifying people who are related to the
‫target, identifying technologies, identifying content of interest, identifying vulnerabilities.
‫You can collect information possibly from web archives, e-mail archives, social networks, search
‫engines, etc..
‫A second type is active information gathering.
‫In this type of information gathering, you scan on the target systems.
‫Active information gathering requires more preparation for the attacker pen testor because it leaves
‫traces which are likely to alert the target or produce evidence against him in the course of a possible
‫digital investigation.
‫There are a lot of places you can collect data over the Internet, Web archives, supposedly sensitive
‫data was published accidentally.
‫A few days later, the admins realized the mistake and remove the data from the website.
‫But what if someone has already archived that Web site with the sensitive data?
‫Scanning the ports and services, you can find the ports accessible over the Internet.
‫The target company opened that service intentionally or unintentionally using search engines.
‫You can find enormous pieces of useful information beyond the known weaknesses.
‫Leave traces on the Web sites, on headers, titles, you URLs.
‫You can easily find these traces using search engines.
‫You can find some useful information about the target company on social networks, for example, Facebook,
‫Twitter or LinkedIn.
‫Suppose the target company is looking for a new sys admin to hire.
‫Look at the job sites or LinkedIn.
‫What would you see the information about systems that are used in the target company or tools and programs
‫used to monitor those systems?
‫Look at the experts working for a target company carefully, do they subscribe to Forbes or mail lists?
‫What kind of problems do they share on this forum or these mail lists asking for help about Java Version
‫nine or Hibernate framework?
‫You take and publish pictures of your secret disaster recovery center on your website, you're sure
‫that it's impossible to understand from the picture where the center is.
‫Are you sure?
‫What about the metadata of the picture?
‫Did you choose the location info?
‫Who is is a Web application used to get information about the Target Web site, such as the administrators,
‫email address, details about the registration, who is is a very large database and contains information
‫of approximately all the websites.
‫It can be searched by domain name or an IP address, block the protocol stores and delivers database
‫content in a human readable format.
‫You can use the who is command of Linux systems to get the who is query results.
‫In addition, there are some websites that help you to get the WHO is query results.
‫You see some of them on the slide and who is service of domain tools.
‫Websites is also given as an example.
‫If we analyze the banners of the response sent by the web systems of the target company, we can find
‫some detailed information about the server, the technology used, et cetera.
‫We sent a request to put 80 of NHS UK website using town that services and get the response.
‫Look at the server and the X powered by headers, we learned that the application server of NHS Start
‫UK is Microsoft, Dash is version eight point zero and ASPE Dot Net is used to develop the Web application.
‫But hold on.
‫Are we sure?
‫Could the information be fake?