Cybersecurity: Reconnaissance Steps
111 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary function of the Border Gateway Protocol (BGP)?

  • To harvest DNS names from websites
  • To ensure all hosts on the network reach their destination (correct)
  • To allocate IP addresses to users
  • To uniquely identify an IP address range

    • What is the first phase that must always be performed in a reconnaissance?

  • Passive reconnaissance
  • Reconnaissance (correct)
  • Data analysis
  • Active reconnaissance

    • All IP addresses assigned to organizations are actively used.

    False

    The main difference between advanced attackers and less capable attackers is the amount of reconnaissance time spent.

    <p>True</p> Signup and view all the answers

    What does the acronym AS stand for in the context of network allocation?

    <p>Autonomous System</p> Signup and view all the answers

    Name one type of technical data that can be collected during reconnaissance.

    <p>internet-routable subnets, Antivirus software, DNS records</p> Signup and view all the answers

    The process of gathering DNS names from websites to identify hosts is called __________.

    <p>Domain Harvesting</p> Signup and view all the answers

    Passive reconnaissance makes it harder for the target to ______ our activities.

    <p>detect</p> Signup and view all the answers

    Match the following terms with their definitions:

    <p>DNS = System for resolving domain names to IP addresses BGP = Routing protocol of the internet AS Number = Unique identifier for an IP address range Whois = Information about registered domain ownership</p> Signup and view all the answers

    What information is included in the baseline of technical data about an organization?

    <p>Remote access systems</p> Signup and view all the answers

    Which of these is a non-technical data type collected in reconnaissance?

    <p>Geographic locations</p> Signup and view all the answers

    DNS cache snooping can be viewed as a vulnerability.

    <p>True</p> Signup and view all the answers

    Match the type of reconnaissance with its method:

    <p>Active = Can be detected by the target organization Passive = Utilizes sources not owned by the target organization</p> Signup and view all the answers

    What is the purpose of harvesting DNS names?

    <p>To identify as many hosts as possible</p> Signup and view all the answers

    Which of the following is NOT a category of data searched during reconnaissance?

    <p>Tactical data</p> Signup and view all the answers

    List one source from which reconnaissance data can be obtained.

    <p>Physical source, Cyber source</p> Signup and view all the answers

    What is the primary purpose of Cache snooping?

    <p>To enumerate websites and systems requested by users</p> Signup and view all the answers

    A recursive query will only return results if the DNS server has the answer stored locally.

    <p>False</p> Signup and view all the answers

    What does BGP stand for?

    <p>Border Gateway Protocol</p> Signup and view all the answers

    In an ______ query, the DNS server provides a list of other DNS servers for further querying.

    <p>iterative</p> Signup and view all the answers

    Match the following terms with their definitions:

    <p>Cache snooping = Identifying requested websites by users Recursive query = Asking other DNS servers for answers BGP = Routing protocol for dynamic information exchange Port scans = Assessing services exposed to the internet</p> Signup and view all the answers

    Which of the following describes a potential risk of using BGP?

    <p>It can expose networks to unauthorized access.</p> Signup and view all the answers

    Less restrictive firewalls may go unnoticed due to less attention from personnel.

    <p>True</p> Signup and view all the answers

    What is one basic technique for identifying systems and services exposed to the internet?

    <p>Port scanning</p> Signup and view all the answers

    What is the recommended initial approach if you believe the target organization has detection technologies in place?

    <p>Slow and low scan</p> Signup and view all the answers

    All organizations will notice port scanning activities immediately.

    <p>False</p> Signup and view all the answers

    What type of service mentioned is key for remote access in organizations?

    <p>VPN service</p> Signup and view all the answers

    Using a ______ box or proxy for scanning helps maintain anonymity during scans.

    <p>bounce</p> Signup and view all the answers

    Match the scanning approaches with their characteristics:

    <p>Slow and low = Minimizes detection risk Hard and fast = Faster but higher risk of detection Port scanning = Important for information gathering Web Service Enumeration = Identifying important services including remote access</p> Signup and view all the answers

    What is the potential next step after obtaining useful information from port scanning?

    <p>Spear phishing</p> Signup and view all the answers

    The slow scanning approach follows strict rules.

    <p>False</p> Signup and view all the answers

    Why might an organization want to change its attack strategy if no remote services are available?

    <p>To deliver a backdoor for remote access.</p> Signup and view all the answers

    Which of the following ports are commonly scanned for web services?

    <p>80, 443, 8080</p> Signup and view all the answers

    Geolocation data can only be obtained from GPS systems.

    <p>False</p> Signup and view all the answers

    What is a popular system used for port scanning in web service exploration?

    <p>nmap</p> Signup and view all the answers

    GPS stands for ______.

    <p>global positioning system</p> Signup and view all the answers

    Match the following web systems with their categorization:

    <p>Teleconference systems = Communication Security camera systems = Surveillance Server administration tools = Management Phone management systems = Telephony</p> Signup and view all the answers

    Which of the following are methods for obtaining reconnaissance data?

    <p>Active and Passive</p> Signup and view all the answers

    Active reconnaissance involves activities that can possibly be detected by the target organization.

    <p>True</p> Signup and view all the answers

    Name one type of technical data that can be collected during reconnaissance.

    <p>Antivirus software used by the organization</p> Signup and view all the answers

    Reconnaissance can be conducted using __________ sources.

    <p>Physical and Cyber</p> Signup and view all the answers

    Match the following types of reconnaissance data with their examples:

    <p>Technical = Geographic locations of the organization Non-Technical = Domain Name Service (DNS) records associated with the organization</p> Signup and view all the answers

    Which of the following is an example of passive reconnaissance?

    <p>Monitoring social media</p> Signup and view all the answers

    What is the primary purpose of reconnaissance in the context of an attack?

    <p>To explore all possible vulnerabilities of an organization.</p> Signup and view all the answers

    Non-technical data during reconnaissance includes information related to major departments within an organization.

    <p>True</p> Signup and view all the answers

    Which of the following ports are commonly associated with web services?

    <p>80</p> Signup and view all the answers

    Geolocation data can be obtained from digital photos via GPS metadata.

    <p>True</p> Signup and view all the answers

    What technology allows automated dialing of phone numbers?

    <p>VoIP</p> Signup and view all the answers

    The use of ______ helps identify systems and services exposed to the internet.

    <p>port scanning</p> Signup and view all the answers

    Match the following web systems with their purposes:

    <p>Teleconference systems = Facilitating remote meetings Server administration tools = Managing server configurations Security camera systems = Monitoring premises Phone management systems = Handling phone call features</p> Signup and view all the answers

    Which of the following best describes a recursive DNS query?

    <p>It returns the answer directly from external DNS servers.</p> Signup and view all the answers

    BGP is primarily used for routing information exchange between multiple ISPs.

    <p>True</p> Signup and view all the answers

    What primary technique is suggested for identifying systems exposed to the internet?

    <p>Port scanning</p> Signup and view all the answers

    The purpose of DNS cache snooping is to ______ websites and systems that users have requested.

    <p>enumerate</p> Signup and view all the answers

    Match the following DNS query types with their descriptions:

    <p>Recursive Query = Asks other DNS servers for an answer Iterative Query = Provides a list of DNS servers to query Cache Query = Returns data stored locally Forward Query = Sends the request to an external server</p> Signup and view all the answers

    What is a potential risk associated with less restrictive firewalls?

    <p>They may be exploited due to unnoticed vulnerabilities.</p> Signup and view all the answers

    Iterative queries provide a direct answer from the DNS server without additional querying.

    <p>False</p> Signup and view all the answers

    Why is DNS server configuration critical for security?

    <p>It can be vulnerable if configured to allow recursive queries.</p> Signup and view all the answers

    What does an Autonomous System (AS) number uniquely identify?

    <p>An IP address range or subnet</p> Signup and view all the answers

    Organizations often use the same DNS servers for both internal and external operations.

    <p>False</p> Signup and view all the answers

    What is a common purpose of DNS cache snooping?

    <p>To exploit vulnerabilities in the DNS system.</p> Signup and view all the answers

    The Border Gateway Protocol is commonly known as the __________ protocol of the internet.

    <p>routing</p> Signup and view all the answers

    Match the type of IP address with its corresponding description:

    <p>IPV4 = 32-bit address scheme IPV6 = 128-bit address scheme Autonomous System Number = Identifier for IP address ranges DNS = Domain name resolution service</p> Signup and view all the answers

    What is the primary function of harvesting DNS names?

    <p>To identify as many hosts as possible</p> Signup and view all the answers

    Name one type of information included in registrant details.

    <p>Whois information.</p> Signup and view all the answers

    All IP addresses allocated to an organization are actively in use.

    <p>False</p> Signup and view all the answers

    What is a recommended scanning approach if detection technologies are suspected in the target organization?

    <p>Slow and low scan</p> Signup and view all the answers

    Every organization is constantly being scanned by automated programs.

    <p>True</p> Signup and view all the answers

    What is the purpose of using a bounce box or proxy during scanning?

    <p>To maintain anonymity during scans</p> Signup and view all the answers

    If the target organization has a remote access service, we should focus on obtaining a valid set of credentials to use for __________.

    <p>VPN</p> Signup and view all the answers

    Match the scanning approaches with their key characteristics:

    <p>Slow and low = Less likely to be detected by security systems Hard and fast = More aggressive and faster scanning method Bounce box = Anonymity and avoidance of detection Port scanning = Identifying open ports on a system</p> Signup and view all the answers

    Which of the following statements about the frequency of port scanning is true?

    <p>Automated programs scan organizations continually.</p> Signup and view all the answers

    The slow scanning approach operates under strict rules that must always be followed.

    <p>False</p> Signup and view all the answers

    What should be the next focus if no remote services are available in a target organization?

    <p>Delivering a backdoor to provide remote access</p> Signup and view all the answers

    What is the role of Autonomous System (AS) numbers in networking?

    <p>To uniquely identify an IP address range or subnet</p> Signup and view all the answers

    Domain harvesting is a technique used to find the internal hosts of an organization.

    <p>True</p> Signup and view all the answers

    What are the two types of IP address versions mentioned?

    <p>IPv4 and IPv6</p> Signup and view all the answers

    The __________ protocol is commonly known as the routing protocol of the internet.

    <p>Border Gateway</p> Signup and view all the answers

    Match the following DNS records with their purposes:

    <p>A = MX Records B = A Records C = CNAME Records D = PTR Records</p> Signup and view all the answers

    Which type of information is contained in registrant information?

    <p>Autonomous System (AS) number allocations</p> Signup and view all the answers

    Organizations typically do not have separate DNS zones for internal and external use.

    <p>False</p> Signup and view all the answers

    What does DNS stand for?

    <p>Domain Name System</p> Signup and view all the answers

    Which of the following is a method of reconnaissance that minimizes detection risk?

    <p>Passive Reconnaissance</p> Signup and view all the answers

    Technical data obtained during reconnaissance includes information such as geographic locations of the organization.

    <p>False</p> Signup and view all the answers

    What type of data includes items like internet-routable subnets and antivirus software used?

    <p>Technical data</p> Signup and view all the answers

    The ___ phase is crucial in setting the stage for future attacks in any penetration attempt.

    <p>reconnaissance</p> Signup and view all the answers

    Match the following types of data with their descriptions:

    <p>Technical = Includes data such as software used and network configuration Non-Technical = Includes data such as personnel titles and organization structure Physical = Data sourced from physical locations Cyber = Data sourced from online environments</p> Signup and view all the answers

    Which of the following represents a source from which reconnaissance data can be obtained?

    <p>Physical Source</p> Signup and view all the answers

    Active reconnaissance is often undetectable by the target organization.

    <p>False</p> Signup and view all the answers

    Name one type of non-technical data that can be collected during reconnaissance.

    <p>Major departments within the organization</p> Signup and view all the answers

    Which of the following ports are commonly used to identify web services?

    <p>80</p> Signup and view all the answers

    Geolocation data can only be obtained from GPS systems.

    <p>False</p> Signup and view all the answers

    What technology allows for the automated dialing of phone numbers?

    <p>VoIP</p> Signup and view all the answers

    The GPS system uses __________ to calculate the current location on Earth.

    <p>satellites</p> Signup and view all the answers

    Match the following systems with their uses:

    <p>Teleconference systems = Real-time remote communication Security camera systems = Surveillance and monitoring Server administration tools = Managing server operations Phone management systems = Managing phone communications</p> Signup and view all the answers

    What is a requirement for a DNS server to be vulnerable to cache snooping?

    <p>It must allow recursive queries.</p> Signup and view all the answers

    An iterative DNS query returns results directly to the client without querying other DNS servers.

    <p>False</p> Signup and view all the answers

    What is the primary purpose of using the Border Gateway Protocol (BGP)?

    <p>To allow decentralized and dynamic exchange of routing information on the internet.</p> Signup and view all the answers

    Performing ______ sweeps is one basic approach to identifying systems exposed to the internet.

    <p>ping</p> Signup and view all the answers

    Match the following query types with their characteristics:

    <p>Iterative query = Provides a list of other DNS servers for queries Recursive query = Queries other servers and returns a direct answer BGP = Facilitates decentralized routing information exchange Port scanning = Identifies open services on a network</p> Signup and view all the answers

    What might be a consequence of having two firewalls with different configurations?

    <p>Potential for exploitation due to less oversight on one firewall.</p> Signup and view all the answers

    DNS cache snooping can be used as a technique to identify the systems that users have accessed.

    <p>True</p> Signup and view all the answers

    List one basic technique for identifying services exposed to the internet.

    <p>Port scanning</p> Signup and view all the answers

    Which scanning approach is recommended if you suspect the target organization has detection technologies?

    <p>Slow and low</p> Signup and view all the answers

    Organizations typically provide remote access services using non-standard ports.

    <p>False</p> Signup and view all the answers

    What type of information can the results of port scanning inform the next phase of an attack?

    <p>Spear phishing</p> Signup and view all the answers

    Using a ______ box or proxy helps maintain anonymity during scans.

    <p>bounce</p> Signup and view all the answers

    Match the scanning approaches with their intended use:

    <p>Slow and low = Discreet scanning to avoid detection Hard and fast = Rapid scanning when detection is unlikely Bounce box = Maintains anonymity during scans Port scanning = Identifies open services on a network</p> Signup and view all the answers

    What is a potential action if there are no remote services available during scanning?

    <p>Focus on delivering a backdoor</p> Signup and view all the answers

    Why is it important to perform multiple scans?

    <p>To gather the most useful information</p> Signup and view all the answers

    It is assumed that most scanning activities will go unnoticed by organizations.

    <p>True</p> Signup and view all the answers

    Study Notes

    Reconnaissance Steps

    • Reconnaissance must be performed before any other step in an attack.
    • Advanced attackers spend a lot of time on reconnaissance.

    Data Categories

    • Technical data includes information about an organization’s systems like subnets, antivirus software, and DNS records.
    • Non-technical data includes information about an organization’s physical location, departments, and key personnel.

    Data Sources

    • Physical sources are any sources that are not obtained digitally, such as documents or videos.
    • Digital sources are obtained automatically over the internet or from technology.

    Data Methods

    • Active reconnaissance is detectable by the target organization.
    • Passive reconnaissance uses sources that the target organization does not own, making it harder to detect.

    Target Data

    • The target's IP address ranges, DNS records, and Autonomous System (AS) number allocations provide important information about their infrastructure.

    DNS Techniques

    • Domain harvesting allows attackers to identify many hosts by collecting DNS names from websites.
    • DNS cache snooping can enumerate websites and systems that users or systems at the target organization have requested.

    BGP Information

    • Companies typically have multiple internet providers each with a firewall, which could have different security configurations.
    • This information can be used to find an easier path for attack.

    Port Scanning

    • Port scanning helps identify systems and services exposed to the internet, which is crucial for planning future attack phases.
    • To avoid detection, attackers use a “slow and low” approach for stealthy scans or a “hard and fast” approach for rapid information gathering.

    Web Service Enumeration

    • Identifying remote access services, such as VPNs or web portals, is crucial for understanding the target organization's security postures.
    • Understanding the target organization's use of web-based services can be helpful for attack planning, especially if the target uses teleconferencing systems, server administration tools, or security camera systems.

    Geolocation Information

    • Metadata from digital photos, especially GPS coordinates and timestamps, can be used to gather geolocation data about target individuals or assets.

    Phone System Information

    • VoIP technology allows attackers to automatically dial phone numbers, gather voice traffic, and use automated dialers for reconnaissance.

    Reconnaissance

    • Reconnaissance is the first and most crucial step in an attack.
    • It involves gathering information about the target organization to identify vulnerabilities.
    • Advanced attackers spend significant time on reconnaissance to thoroughly understand the target.
    • Reconnaissance data is categorized as technical or non-technical and obtained from physical or cyber sources.
    • Two main methods for gathering data are active and passive reconnaissance.

    Technical Data

    • Examples of technical data: internet-routable subnets, antivirus software, DNS records.
    • Key technical data to collect: user names and email formats, remote access systems.
    • Registrant information: Whois and registrant information, IP address allocations, Autonomous System numbers, DNS reverse record delegation.
    • Network allocation: IPV4 and IPV6 address space assigned to the organization.
    • Autonomous Systems: AS number uniquely identifies an IP address range or subnet.
    • DNS Information: DNS records provide technical and non-technical information about the organization.

    Domain Harvesting

    • Identify hosts by harvesting DNS names from websites using specialized tools.
    • Organizations can have separate DNS zones for internal and external use.
    • Third-party vendors might host domain names belonging to the target organization.

    DNS Cache Snooping

    • Enumerates websites and systems accessed by users or systems at the target organization.
    • Requires DNS server configured for recursive queries, making it vulnerable.
    • Iterative query: DNS server responds with a list of other DNS servers for the client to query.
    • Recursive query: DNS server queries other servers and returns the result directly to the client.

    Border Gateway Protocol (BGP)

    • The primary routing protocol for the internet.
    • Enables decentralized and dynamic exchange of routing information.
    • BGP configuration can prioritize provider connections, leading to different firewall configurations.
    • One firewall might be less restrictive than the other, providing potential exploit paths.

    System and Service Identification

    • Identify systems and services exposed to the internet through ping sweeps and port scans.
    • Port scans are essential for identifying systems, services, and information for future attack phases.
    • Consider using slow and low scans for organizations with security technologies.
    • Harden fast scans can be used for organizations with fewer security measures.
    • Use bounce boxes or proxies to mask scanning activities.
    • Information obtained from port scanning is crucial for spear phishing attacks.
    • Identifying remote access services like VPNs can help focus on obtaining valid credentials for remote access.

    Web Service Enumeration

    • Identify remote access services operating over web ports.
    • Modern organizations prioritize user-friendly remote access methods like web VPNs, webmail, and portals.
    • Identify other web services used by the organization, including teleconference systems, administration tools, security cameras, and phone management systems.
    • Focus on common web ports like 80, 443, and 8080 using tools like nmap.

    Web Service Exploration

    • Identify the services offered by web systems identified through port scanning and DNS harvesting.

    Geolocation Information

    • Gather physical location data of assets owned by or related to the target organization.
    • Location data often associated with specific employees or shared among employees.
    • Metadata from digital photos can provide geolocation data, including GPS coordinates, time, and date.

    Data from the Phone System

    • Phone systems can be used for reconnaissance, ranging from manual to automated methods.
    • VoIP enables automated dialing of phone numbers.

    APT Approach to Reconnaissance

    • Reconnaissance is the most important step for an APT attack and must always be performed first.
    • APT attackers spend a significant amount of time on reconnaissance to explore vulnerabilities.
    • There are two main categories of data: technical and non-technical.
    • Technical data includes internet-routable subnets, antivirus software, and DNS records.
    • Non-technical data includes geographic locations, major departments, and important personnel.

    Data Categories

    • Data can be obtained from Physical and Cyber sources.
    • Active reconnaissance is any activity detectable by the target organization.
    • Passive reconnaissance leverages sources not owned by the target, making detection harder.

    Registrant Information

    • Whois information provides valuable data such as registrant details, IP addresses, and autonomous system numbers.

    Network Allocation

    • IPV4 and IPV6 address allocations are listed under "Networks."
    • Many organizations have large ranges of unused IP addresses.

    Autonomous Systems

    • Autonomous systems (AS) are uniquely identified by a 16-bit or 32-bit number.
    • AS numbers are used in the Border Gateway Protocol (BGP), which is the "routing protocol of the internet."

    Domain Harvesting

    • Domain harvesting identifies hosts by collecting DNS names from websites.
    • Various tools are available to assist with this process.

    DNS Zones

    • Organizations can have separate DNS zones for internal and external use.
    • Internal systems might use distinct domain names.
    • Third-party vendors might host domain names for the target organization.

    DNS Cache Snooping

    • DNS cache snooping allows enumeration of websites and systems requested by users or systems at the target organization.
    • The DNS server must be configured to allow recursive queries for this to work.

    Border Gateway Protocol (BGP)

    • BGP is the primary routing protocol for the internet.
    • It facilitates a decentralized and dynamic exchange of routing information.
    • Different ISP providers can offer DNS subnets over their links.
    • Firewall configurations on backup networks may be less restrictive, providing potential exploit paths.

    System and Service Identification

    • Port scans and ping sweeps are basic techniques for identifying exposed systems and services.
    • Slow and low scans minimize detection risk, while hard and fast scans are used when detection is unlikely.
    • Bounce boxes or proxies are used to conceal scanning activities.
    • Information from port scans is crucial for future attack phases like spear phishing.

    Web Service Enumeration

    • Remote access services are prioritized targets for identification.
    • Organizations often use standard web ports or helper services for remote access.
    • SSL, web VPN systems, web email access, and portal systems are common remote access methods.
    • Other web services, like teleconference, administration tools, security cameras, and phone management systems, can provide valuable information.

    Web Service Exploration

    • Nmap is used to identify hosts with common web services like ports 80, 443, and 8080.
    • Tools like theharvester help identify web systems from port scans and DNS hostnames.

    Geolocation Information

    • Geolocation data refers to physical locations associated with the target organization.
    • Metadata from digital photos, particularly GPS coordinates, is often used to gain geolocation data.
    • Cameras and smartphones typically embed GPS coordinates, time, and date in their photos.

    Data from Phone System

    • Phone systems provide opportunities for reconnaissance.
    • VoIP (Voice over Internet Protocol) enables automated dialing of phone numbers.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Chapter 4 - APT Reconnaissance - PDF

    Description

    This quiz delves into the vital reconnaissance steps in cybersecurity. It covers technical and non-technical data categories, data sources, and methods, including active and passive reconnaissance. Test your knowledge on how attackers use reconnaissance to gather critical information.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser