Reconnaissance

Reconnaissance, or recon for short, relates to observing your target to gather strategic information that can be used in your favor. Recon is critical to an ethical hack activity; conversely, it is also used by real-world attackers. In this phase, you focus on information gathering, where this information is used to plan your attack. The more information you gain, the better equipped you are.

As we’ll be focusing on recon, in this chapter, we’re going to cover the following main topics:

• What is reconnaissance?
• Passive information gathering
• Active information gathering
• Wi-Fi recon
• Performing recon in the cloud
• Putting what you have learned into practice
• Best practices

Technical requirements

To follow along with this chapter, you will need the following:

• Kali Linux 2022.1 or later
• A wireless network adapter capable of working in monitor mode

What is reconnaissance?

“If you know the enemy and know yourself, your victory will not stand in doubt”

– Sun Tzu, The Art of War

I love this quote from the book The Art of War, by Sun Tzu. It’s a quote that is often used when it comes to reconnaissance or information gathering. To understand this quote, think about playing the role of an attacker. When you attack an enemy – in our case, a target system – you need to gather as much information as possible. On the other hand, the defenders will need to know what the adversary could discover on their systems or network. As you can see, information gathering is performed irrespective of whether you are an attacker or a defender.

Reconnaissance can be defined as a survey that is performed to obtain as much information as possible about a target. Reconnaissance aims to enable you to obtain an initial foothold in your target environment.

Note

Often, the terms reconnaissance and information...

Performing recon on wireless networks

As you saw in the previous sections, information gathering is crucial and can provide you with a lot of tangible information. The same holds for information gathering on wireless networks. When you perform information gathering on a wireless network, it does not necessarily mean that you should already have access to that network. By making use of a compatible wireless network adapter, you will be able to capture wireless network packets that you can use later to perform actions such as cracking the authentication key and more.

Note

You will need to use a wireless network adapter that supports packet injection. The Alfa range of network adapters is an excellent choice. There are online resources that show the various wireless adaptors that support packet injection. Here’s an example: https://deviwiki.com/wiki/List_of_Wireless_Adapters_That_Support_Monitor_Mode_and_Packet_Injection.

Let’s focus on using the Aircrack-NG tool...

Performing recon in the cloud

As organizations start to make use of cloud services, it’s a no-brainer that cloud platforms should be on your list of targets when performing reconnaissance. When you perform reconnaissance on cloud targets, the approach would be the same as we have covered in the rest of the sections of this chapter. You would still need to perform passive and active information gathering on a cloud target, irrespective of the vendor. At the end of the day, if a cloud service is exposed to the internet, you can enumerate information from it.

When it comes to specialized tools that focus purely on cloud environments, there are a few that can be found on the internet. Let’s focus on some of them; we’ll begin with one that looks at GitHub for any sensitive data: Gitleaks.

Gitleaks

As organizations work with code repositories, GitHub and many others are often selected. Focusing on GitHub, Gitleaks serves as a tool to detect hardcoded secrets...

Putting what you have learned into practice

As you work with reconnaissance, please keep in mind that the reconnaissance phase is the most important in an ethical hack. During this phase, you can discover a wealth of information that can help you along the way.

The following list of activities aims to give you a feel for using various tools. Please remember to stay ethical and don’t conduct reconnaissance activities on any organization that would be deemed illegal.

DNS domain enumeration

The steps are as follows:

1. Try to perform a zone transfer using dnsrecon on the zonetransfer.me domain.
2. Try to perform a brute-force attack using a file with sub-domains and the dnsenum tool on the zonetransfer.me domain.
3. If you own a domain, try to use the available DNS tools to enumerate details about your domain.

Performing OSINT with Shodan

The steps are as follows:

1. Work with Shodan.io to discover databases that exist on the internet that have been...

Best practices

In this chapter, we focused on different reconnaissance attacks. When it comes to DNS, enumerating your domain on a public DNS server cannot be avoided. However, protecting against zone transfers is critical to keeping your domain secure. You can leverage further DNS protections such as DNSSEC for this, which requires domain name lookups to be authenticated. You can further protect your domain by separating your internal and external DNS servers. The internet is filled with DNS security articles that can help guide you.

In this chapter, you saw the power of Shodan. Many people consider Shodan an offensive tool. However, look at Shodan as a great tool that can discover publicly accessible assets within your organization. Rather than blocking Shodan, integrate it into your security hardening process. It will ensure that you protect your public-facing assets correctly.

Cloud assets can be difficult to control; however, major cloud providers provide security suites...

Summary

In this chapter, we have covered several reconnaissance tasks. We started by defining what reconnaissance is and how OSINT fits in. We then worked through the various tools that can be used within passive and active information gathering. Following this, you learned how to perform reconnaissance on wireless networks and in cloud environments. In the next chapter, we will take our reconnaissance activities to the next level by starting to scan for open ports and access.