Active and Passive Information Gathering Techniques — Part 3
Active Information Gathering
Active Information Gathering we can gather more information about targets by actively interacting with them. However, unlike passive information gathering, doing this without authorization can be illegal. Can be use DNS Enumeration, Port Scanning, OS Fingerprinting techniques. Similar to passive information gathering, goal of active information gathering is to gather information as much as possible.
Port scanning- Nmap/Zenmap
Nmap is the most popular port scanner available. It offers many different scanning techniques including:
Other IP Protocols
Due to the firewall actions and security measures on operating systems, some of the scan results might not be accurate.
Scan for TCP Ports
SYN Scan: root@kali:~#nmap -sS 192.168.1.0/28
FIN Scan: root@kali:~#nmap -sF 192.168.1.0/28
ACK Scan: root@kali:~#nmap -sA 192.168.1.0/28
TCP connect () scan: root@kali:~#nmap -sT 192.168.1.0/28
Scan for UDP Ports
The –sU option sends empty UDP packet and waits to receive ICMP “port unreachable” message in return.
root@kali:~#nmap -sU 192.168.1.1/28
Scan for Protocols
root@kali:~#nmap -sO 192.168.1.1
Determine Service applications
Nmap provides a simple method for identifying RPC services (-sR) and a more complex method that can identify a much greater number of services (-sV) version information.
root@kali:~#nmap -sR 192.168.1.1
root@kali:~#nmap -sV 192.168.1.1
Identify a host’s OS (OS Fingerprinting)
root@kali:~#nmap -O 192.168.1.1
DNS Enumeration - dnsenum
DNSenum is a tool that it was designed with the purpose of enumerating DNS information about a domain.
Get the host’s addresses
Get the namservers
Get the MX record
Trying Zone Transfers
Get extra names and subdomains via google scraping
Brute force subdomains from file, can also perform recursion on subdomain that have NS records
Perform reverse lookups on netranges
Write to domain_ips.txt file ip-blocks
dnsenum -enum google.com
Netcat is considered the Swiss-army knife in information security. Basically, it’s capable of numerous additional tasks like chatting, file transfer, port scanning, banner grabbing, opening remote shells to even setting up a honey pot.
Service banners are often used by system administrators for inventory taking of systems and services on the network. The service banners identify the running service and often the version number too. Banner grabbing is a technique to retrieve this information about a particular service on an open port and can be used during a penetration test for performing a vulnerability assessment. When using Netcat for banner grabbing we can actually make a raw connection to the specified host on the specified port. When a banner is available, it is printed to the console.
nc [ip address] [port]
nc 192.168.100.100 21
Web server interaction
Netcat can also be used to interact with web servers by issuing HTTP requests.
nc 192.168.100.108 80
HEAD / HTTP/1.0
To retrieve the top-level page on the web server we can issue.
nc 192.168.100.108 80
GET / HTTP/1.0
File transfers with Netcat
nc –lvp 8080 > receive.txt
nc -lvp 8080 > /root/Desktop/transfer.txt
nc 192.168.100.107 8080 < /root/Desktop/transfer.txt
The objective of this tool is to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database.
Metagoofil is an excellent Information gathering tool that can be used for extracting tons of Information from Word Documents, PDF’s, Excel Sheets , .jpg Images and lots of other formats . Metagoofil therefore can provide a lots of fruitful information during the penetration testing just by scanning the files gathered.
Scan for documents from a domain (-d kali.org) that are PDF files (-t pdf), searching 100 results (-l 100), download 25 files (-n 25), saving the downloads to a directory (-o kalipdf), and saving the output to a file (-f kalipdf.html):
metagoofil -d kali.org -t pdf -l 100 -n 25 -o kalipdf -f kalipdf.html