Chapter 3: Reconnaissance – A Deeper Dive

Did you know that most organizations give away intel for free! I know, right?! During the reconnaissance stage, it's important to know that by virtue of the internet being the internet, there's so much data freely available online that it makes the job of an attack extremely easy. This type of intel is often referred to as open source intelligence, or, if you want to sound like the cool kids, you say OSINT.

In this chapter, we'll cover the following topics:

• Investigating the target's website
• The Wayback Machine
• What organizations give away for free
• Employees – the weakest link
• Reconnaissance countermeasures

Investigating the target's website

Let's look at how to conduct reconnaissance on a target's website and how we can make use of other research sites. When you're doing reconnaissance, the target website is often where you'll land after a quick online search. That's where you'll learn the business's exact functions, location, contact information, clients, who the leadership team is, and sometimes, way more than that. You'll want to pay close attention to everything on the website.

Figure 3.1 – Investigating a website

In Figure 3.1, we can see a couple of pieces of information on this main page. First, on the left side, they've provided information on how to set up Microsoft Outlook with their particular email product. I already clicked through and saw how to set up via Microsoft Exchange 2003, where they also gave me the Simple Mail Transfer Protocol (SMTP) servers they utilize. Later, I'll describe...

The Wayback Machine

At this point, the internet has been around for quite some time, and there are a number of retired web pages and websites. The Wayback Machine (https://archive.org/web/web.php) allows us to view previous versions of websites that may not even exist anymore. Think of it as the archive of the internet. Once we find the older version of our target site, we can scan for historical data that people didn't mean to expose. Now, before I got my start in security, I had no idea this tool was out there, but it's really interesting to use for fun as well (you know, like showing your kids what Amazon used to look like):

Figure 3.18 – The Wayback Machine home page

You can see here that they have saved over 456 billion web pages. The Wayback Machine goes through websites and detects any changes – if it detects a change, it makes a note and caches that information. As an example, I'll use my old company's website...

What organizations give away for free

When I was about 25 years old, there was a radio station, The Q, in the city where I lived that was holding a big contest that included giving away a big prize package. They would hide this big wooden Q every day, which was about a foot by a foot in depth and in height (30 x 30 cm) and about 2 inches (5 cm) thick, and give out clues for where to find it. If you found the Q, you won a prize package that could include a couple of four-wheelers, a trip to Hawaii, TVs, tons of stuff.

I was tracking the clues that they gave out each day, and I thought I knew where it was, so I looked around for hours in this huge park. After about three or four hours, I gave up. It turned out that I was about 25 feet (8 meters) away from it when I gave up. I still regret that today. It's the same thing here with reconnaissance – you've got to look everywhere, despite the massive amounts of information that become available to you.

The more you...

Employees – the weakest link

Have you ever lost something and it ended up being right in front of you? This usually happens with my glasses. I'll be looking everywhere for them and running around the house saying, "Anybody seen my glasses?" And my wife will turn to me and say, "They're on top of your head."

It's the same concept with different reconnaissance techniques. Some of the data that we gather in the reconnaissance phase is incredibly easy to find. In fact, a lot of the information can be found through online services that we're probably already using:

Figure 3.24 – Online services where information can be gathered

The employee side is where things get scary. For example, if an employee plays games, that may show us their interests and hobbies (not that I think that somebody sits at home with a hammer and crushes candy). This information provides us with a good sense of what people are familiar...

Reconnaissance countermeasures

One of my favorite movies is The Hunt for Red October. When the torpedoes are coming in, Sean Connery yells, "Release the countermeasures!" And this is exactly what we need to do here. We need to understand the countermeasures for reconnaissance and what we need to be looking for when performing penetration tests (pen tests). You might know GI Joe's famous quote, "Knowing is half the battle." This also applies to us. Knowing what you are exposing and knowing what the attacker is capable of is half the battle.

In this section, I'll show you how to put your shields up and implement those countermeasures, as well as some best practices for reconnaissance. I'll also show you how to set up for a pen test and the actual workflow of what you should be tracking when doing reconnaissance.

Countermeasures

So, how do you defend yourself against the kind of reconnaissance techniques we reviewed earlier?

The first thing...

Summary

Our quest led us to investigate how attackers gather information from their target's website to know the target's exact business functions, important contact information, clients and partners, the management team, and so on. We learned how to use WHOIS, the command-line interface, ping and DNS, and SOA to gather information. We learned about more tools that help with reconnaissance and footprinting, such as Sam Spade, Netcraft, and the Wayback Machine.

We saw how what the information organizations give away for free can reveal a ton of vulnerabilities. So do job sites, marketing materials, customer support, social networking profiles, and financial and competitive analysis data.

We also discussed employees as the weakest link. Their hobbies, the things they share or post online, the places they go to after work, what they buy, and more all give attackers the clues they need. We then discussed how attackers use these clues to join the groups their targets frequent...

Questions

As we conclude, here is a list of questions for you to test your knowledge regarding this chapter's material. You will find the answers in the Assessments section of the Appendix:

1. Which information may be gathered using nslookup?
   1. A DNS server location
   2. Hostnames and IP addresses
   3. WHOIS intel
   4. A nameserver and operating systems
2. Which of the following is the most accurate description of footprinting?
   1. Investigating a target
   2. Enumeration of services
   3. Discovery of services
   4. Dialogue with people
3. Which record will disclose details about a domain's mail server?
   1. Q
   2. MS
   3. MX
   4. A
4. What alternative options do you have if you can't collect enough information from a target directly?
   1. Social engineering
   2. EDGAR
   3. Competitive analysis
   4. Scanning