ETHICAL HACKING – PROCESS ( Reconnaissance )
Reconnaissance
Reconnaissance is the process of collecting data about a target system. During reconnaissance, a hacker tries to gather as much data about a target system as possible.
Seven steps are carried out during reconnaissance :
-
Gather initial information
-
Determine the network range
-
Identify active machines
-
Discover open ports and access points
-
Fingerprint the operating system
-
Uncover services on ports
-
Map the network
Reconnaissance takes place in two parts :
Active Reconnaissance and Passive Reconnaissance
Active Reconnaissance
In this process, we will learn about process of gaining information by direct interaction with computer. This information can be relevant and accurate. But there is a risk of getting detected if we are working in it without permission. If we are detected, then system admin can take severe action against us that can ruin our whole life.
Passive Reconnaissance
In this process, we will not be directly connected to a computer system. This process is used to gather essential information without ever interacting with the target systems.
Footprinting
Footprinting is a part of reconnaissance process which is used for gathering possible information about a target computer system or network. Footprinting could be both active or passive. Reviewing a company’s website or application is an example of passive footprinting, whereas attempting to gain personal information through social engineering is an example of active information gathering.
Footprinting is basically the first step where hacker gathers as much information as possible to find ways to include into a target system or at least decide what type of attacks will be more suitable for the target.
During footprinting, hacker can collect the followings data :
-
Domain name
-
IP address
-
Namespaces
-
Employee information
-
Phone numbers
-
E-mails
-
Job information
Domain Name Information
we can use https://www.whois.com/whois website to get detailed information about a domain name information including its owner, its registrar, date of registration, expiry, name server, owner’s contact information, etc.
Finding IP Address
We can use ping command at our prompt. This command is available on Windows as well as on Linux OS.
Finding Hosting Company
Once we have the website address, we can get further detail by using www.ip2location.com website. Here the ISP row gives the detail about the hosting company because IP addresses are usually provided by hosting companies only.
IP Address Ranges
Small sites may have a single IP address but large companies may have more than 1 IP addresses serving different domains and sub-domains.
We can obtain a range of IP addresses assigned to a particular company using https://www.arin.net/ Internet Numbers ( ARIN ). We can enter company name in the highlighted search box to find out a list of all the assigned IP addresses to that company.
History of the Website
It is very easy to get the history of websites using https://arcjive.org/ou can enter a domain name in the search box to find out how the website was looking at a given point of time and what were the content available in the website on different dates.
Quick Tips
Its always recommendation to keep domain name, profile, a private one which should hide the above-mentioned information from potential hackers. If a computer system or network is likely with the internet directly, then we cannot hide the IP address and the related information such as the hosting company, it’s location, ISP, etc. if we have a server containing very sensitive data, then it is recommended to keep it behind a secure proxy so that hackers cannot get the data directly. Another best way to hide the data is by using VPN.
