Cybersecurity Reconnaissance Basics

Reconnaissance Introduction

• Reconnaissance is the essential first step in penetrating an organization.
• Advanced attackers dedicate significant time to reconnaissance, exploring all vulnerabilities.
• Reconnaissance data is categorized as technical and non-technical, and gathered from physical and cyber sources.
• Active reconnaissance involves actions detectable by the target organization.
• Passive reconnaissance utilizes sources not owned by the target, making detection harder.

Data Categories

• Technical Data includes:
  • Internet-routable subnets used by the organization.
  • Antivirus software employed by the organization.
  • Domain Name Service (DNS) records associated with the organization.
• Non-Technical Data includes:
  • Geographical locations of the organization.
  • Key departments within the organization.
  • Important personnel and their titles.

Data Sources

• Physical Sources include:
  • Open-source intelligence (OSINT)
  • Financial intelligence (FININT)
  • Human intelligence (HUMINT)

Technical Data

• Internet Registry Information: Includes Whois data, registered and actively used subnets.
• DNS Information and Records: Provides valuable technical insights.
• Routing and Border Protocol (BGP) Information: Reveals network routing paths and connectivity.
• Username and Email Formats: Assists in social engineering and phishing attempts.
• Remote Access and Login Systems: Identifies potential entry points for attackers.
• Specific Technologies: Reveals security measures in place, such as firewalls, routers, and antivirus software.
• Public Data Sets: Analisis of public data sets can yield valuable information about the target organization.

Registrant Information

• Includes Whois details, IPV4 and IPV6 address allocations, Autonomous System (AS) number allocations, and DNS reverse record delegation.
• Organizations register in different registries depending on their location, such as ARIN (American Registry for Internet Numbers) and AfriNIC (African Network Information Center).

Network Allocation

• IPV4 and IPV6 addresses assigned to customers are listed under the "Networks" heading.
• IP addresses can be unused by organizations.

Autonomous Systems

• AS numbers identify IP address ranges or subnets using a 16-bit or 32-bit number.
• These IP addresses are commonly used by Border Gateway Protocol (BGP).
• BGP ensures communication between network hosts, identifying alternative paths if routing fails.

DNS Information and Records

• Domain Name System (DNS) provides valuable technical and non-technical information.
• Key DNS records include:
  • Start of Authority (SOA): Identifies name servers and domain administrators.
  • Mail Exchange (MX): Indicates mail servers for sending mail to the domain.
  • Pointer Records (PTR): Returns a CNAME record for a given IP address.
  • Canonical Name Records (CNAME): Returns an alias for another host record.
  • AAAA: The host record for the IPv6 address.
  • TXT: Text or arbitrary "human-readable" data.
  • Sender Policy Framework (SPF): Indicates legitimate mail sources for a domain to combat spam.

Domain Harvesting

• Identifying all potential hosts within a target domain.
• Tools like dnsrecon and theharvester scrape Google and other data sources for domain names.

DNS Zones

• Organizations may have separate DNS zones and servers for internal and external uses.
• External DNS records may not fully reflect internal network infrastructure.

DNS Cache Snooping

• Enumerates websites and systems requested by users or systems at the target organization.
• Requires a DNS server configured to allow recursive queries.

Port Scanning

• Techniques for discovering open ports and services on a target network.
• Types of scans include:
  • Slow and Low: Used when stealth is crucial.
  • Hard and Fast: Employed when detection is less likely.
• Information from port scanning informs spear-phishing strategies.

Web Service Enumeration

• Identifies remote access services and other services on a target network.
• Organizations often use SSL/web VPN systems, web email access, or portals for remote access.

Real-Time and Historical Geodata

• Valuable for targeting individuals remotely or determining their location at specific times.
• Tools like Geostalker gather geolocation metadata from images shared online.

Data from the Phone System

• VoIP technology enables automated scanning of phone numbers.
• Tools like Warvox facilitate mass phone scanning, sort and analyze data, and enable listening to phone call recordings.

DNS Records

• DNS Records contain information about a domain, such as its name servers, mail servers, and IP address.
• Start of Authority (SOA) records specify the authoritative name server for a domain, along with contact information for the administrator.
• Mail Exchange (MX) records define the mail servers responsible for handling email for the domain.
• Pointer (PTR) records provide the CNAME record associated with a specific IP address.
• Canonical Name (CNAME) records act as aliases for other host records.
• AAAA Records are used to store IPv6 addresses.
• TXT Records store text data that is human-readable.
• Sender Policy Framework (SPF) records indicate authorized mail sources for a domain to combat spam.

Domain Harvesting

• Domain harvesting involves collecting domain names associated with a target organization.
• Tools like dnsrecon and theharvester can scrape Google and other online sources for domain names.
• Theharvester can also collect email addresses, phone numbers, and other information.

DNS Zones

• Organizations often maintain separate DNS zones and servers for internal and external network traffic.
• Different DNS zones can result in different responses for the same domain name, depending on the query source.
• Third-party vendors may also host domain names for organizations.

DNS Cache Snooping

• DNS cache snooping allows enumeration of websites and systems accessed by users or systems within an organization.
• Recursive Queries occur when a DNS server contacts other servers to resolve a request and returns the answer to the client.
• Iterative Queries involve the DNS server providing a list of other DNS servers that the client can query directly.
• For cache snooping, the DNS server must be configured to allow recursive queries.

Border Gateway Protocol (BGP)

• BGP is the primary routing protocol for the internet, enabling decentralized and dynamic exchange of routing information.
• Organizations with multiple internet service provider (ISP) connections often prioritize one connection, with the other serving as backup.
• This configuration means that firewalls protecting the organization might have different settings, potentially leading to variations in security levels.
• Commands such as "show ip bgp" can help reveal BGP configurations.

System and Service Identification

• Port scanning and ping sweeps are essential for identifying systems and services exposed to the internet.
• Nmap is a versatile tool for port scanning, offering different scan modes for various levels of stealth.
• Slow and low scans are more stealthy, while hard and fast scans are faster but more likely to be detected.
• The information gained from port scanning can guide subsequent attack phases, such as spear phishing.

Web Service Enumeration

• Web service enumeration involves identifying web services running on a target network.
• Common web service ports include 80 (HTTP), 443 (HTTPS), and 8080.
• Nmap and grep can be used to analyze port scan results for web services.

Web Service Exploration

• Web cloning can create copies of websites for gathering information or launching attacks.
• Identifying web services can reveal valuable information about the target organization, such as remote access systems, teleconference tools, and administrative systems.
• Web service identification and version enumeration can be performed with Nmap's –A option.

Geolocation Information

• Geolocation data provides information about the physical location of assets associated with a target organization.
• Geolocation data sources include:
• Geo-metadata: GPS coordinates embedded in digital photos.
• Geo-IP data: Location associated with specific IP addresses.
• GPS data: Real-time or historical location data from GPS devices.
• Non-technical sources like social media posts can also reveal location information.

Data from the Phone System

• VoIP technology enables automated scanning of phone numbers for reconnaissance.
• Warvox is a tool that provides a web interface for automated VoIP scanning, supporting multiple phone lines and service providers.
• Warvox capabilities include:
• Scanning numerous numbers simultaneously.
• Sorting and analyzing call data.
• Listening to audio from captured calls.
• VoIP scanning can help identify internal systems and provide data on employee availability.