Information Gathering Techniques Quiz

Ethical Hacking and Penetration Testing - Lecture 2: Information Gathering

• The lecture is about information gathering in Ethical Hacking and Penetration Testing.
• Information Gathering or Intelligence Gathering is the reconnaissance process against a target to gather as much information as possible, used to penetrate the target during later stages like target scanning, vulnerability assessment, and exploitation.
• The more information gathered, the more attack vectors can be identified.
• Key types of Information Gathering include:
  • Competitive intelligence
  • Corporate Espionage
  • Information Warfare
  • Private Investigations
  • Pentesting

Competitive Intelligence

• Relies on legal and ethical methods to gather data.
• Over 95% of the information needed by companies to compete successfully comes from the public domain.
• Helps organizations understand their competitive environment to make sound business decisions.

Corporate Espionage

• This involves the illicit collection, collation, and analysis of information to gain economic gain.
• "Trade Secrets" are valuable pieces of information that give a significant advantage over competitors who don't know them.
• Yearly losses to US industries due to corporate espionage exceed $70 billion.

How Espionage is Done

• A majority of illicit activities are internal, such as:
  • Disgruntled employees
  • Bribes from competitors
  • Industrial moles (planted individuals)
  • Companies employing competitors' employees to gain internal knowledge.
  • Applicants interviewing for jobs to get information
  • Spies pretending to be students, journalists, or venture capitalists

Information Warfare

• State sponsored information and electronically delivered actions designed to gain information superiority in support of national military strategy.
• Aims to affect enemy information and information systems while protecting one's own.
• Also involves electronic warfare, surveillance systems, precision strike, and advanced battlefield management.

Useful Information for Attackers

• Structure: Organization charts, departmental diagrams

• Infrastructure: Phone systems, network diagrams, IT support groups, and utility providers

• People: Phone directories, email address books, employee information

• Geography: Locations of the IT department, servers, and other crucial elements

• Security Enforcing Functions: Access control, password policies, hardware reuse, firewall and IDS use, and other policies

• Networks: Detailed network topologies, firewalls, routers, and proxy positions

• Software/Hardware: Machine specifications, operating systems, software versions, and administration policies

Open-Source Intelligence (OSINT)

• A method for compiling intelligence from publicly available sources.
• Involves finding, selecting, and acquiring information from publicly available sources and analyzing it to produce actionable intelligence.
• This type of information gathering is used to identify entry points into an organization (physical, electronic, and human).
• Many companies fail to recognize how public information can be used against them by attackers.
  • Employees also often do not consider the risks of putting personal information online.

OSINT Forms

• Passive: Gather information from archived or stored sources. Can be outdated or incomplete. Useful if you don't want to be detected. (e.g., Google searches).
• Semi-passive: Profile the target using methods that appear as normal internet traffic. Look for metadata, but don't try to actively scan for hidden data. (e.g., WHOIS database).
• Active: Methods that are likely to be noticed by the target. (e.g., sending probe packets to test system vulnerabilities). Should be carefully planned.

Tools Related to OSINT

• Wayback Machine: Website archive
• Google Dorks: Specialized search queries for specific information

Covert Gathering

• On-site: Includes gathering information over several days, observing patterns, and reviewing physical security/employee behavior.
• Off-site: Gathering information about the target's external relationships and their importance to the organization. Analyze openly shared information from websites, corporate webpages, and partner/supplier information.

Organizational Chart

• Position Identification: Identifying important individuals
• Transactions: Mapping changes in an organization (promotions, etc.)
• Affiliates: Understanding connections to affiliate organizations

Electronic Metadata

• Contains information about data or documents, such as author, creation time, location, standards used, etc.
• The provided file, network, and folder paths are also considered electronic metadata.
• Image metadata may contain camera information and coordinates/location.
• Various tools are used to extract metadata (e.g., FOCA, metagoofil, exiftool).

Electronic Communications

• Historical and current marketing materials can often reveal useful information about projects, specific technologies, and contacts. This includes colors, fonts, design components, and company contact details.

Infrastructure Assets

• External Profile: Understanding the target's external infrastructure profile.
• Tools: OSINT searches through forums, mailing lists, and other resources.
• Social Engineering: Use of social engineering against IT organizations and product vendors to gather information.
• Network Blocks: This is information that is passively available via whois searches. DNSStuff is a tool that offers this information.
• Email Addresses: Useful for gathering usernames and domain structure. Sources include the company website and shared email groups like groups.google.com.

Remote Access

• Methods used by employees and clients to connect.
• Application, procedures, and user documentation can reveal details.

Active/Passive Fingerprinting

• Passive: Using publicly available information to understand a target.
• Active: Sending network requests to systems to test blocking patterns, analyze headers, and understand protection mechanisms in place. (e.g., using "ping", "trace route, Nmap, or Banner Grabbing.").

Human Capabilities

• Presence of a company-wide CERT/CSIRT/PSRT team.
• Advertisments for security jobs and developers
• Contract details related to security outsourcing

Individuals - Employees

• Internet Presence: Identifying a target's employees online. Includes email addresses, handles, nicknames, registered domains and static IPs.
• Footprinting: Obtaining information about a target from an external perspective.
• Social Media Presence: Verifying the presence on social media.

Lab and Reading Material

• The lab tasks include gathering insights from tools like Whois, theHarvester, Google Dorks, and the Wayback Machine.
• Reading materials include links to cheat sheets for Google Dorking and information on passive reconnaissance, OSINT, and social engineering.

Next Week

• The following week's material will cover target scanning and enumeration.