Passive and Semi-Passive Information Gathering

Ethical Hacking and Penetration Testing - Lecture 2: Information Gathering

• The lecture covers information gathering, a crucial pre-engagement phase in penetration testing.
• Information gathering, also known as intelligence gathering, involves reconnaissance to collect as much data as possible about a target.
• This data is used to plan further phases, such as target scanning, vulnerability assessment, and exploitation.
• More information gathered during this phase leads to more potential attack vectors.
• Different types of information gathering include: competitive intelligence, corporate espionage, information warfare, private investigation, and penetration testing.

Competitive Intelligence

• Uses legal and ethical methods to gather data.
• Over 95% of needed information is publicly available.
• Helps understand the competitive environment and improve business decisions.

Corporate Espionage

• Involves collecting, collating, and analysing illicitly gained information.
• Often includes theft of trade secrets for economic gain.
• International Trade Commission estimates annual losses to U.S. industries from corporate espionage are over $70 billion.
• Methods often include disgruntled/bribed employees, industrial moles, and false pretenses (e.g., pretending to be a student).

Information Warfare

• State-sponsored electronically delivered actions to achieve information superiority in support of national military strategy.
• Aims to affect enemy information systems whilst protecting own systems.
• Includes electronic warfare, surveillance systems, precision strikes, and advanced battlefield management.

What's Useful to an Attacker

• Organizational structure, departmental diagrams, contact details, IT infrastructure diagrams, support groups.
• Contact information such as phone directories, email addresses, 'who's who' directories.
• Geographic information and location of IT departments, servers, etc.
• Security policies, hardware re-use, firewall / IDS use, e-mail policies, phone-use policies.
• Network topologies, firewalls, routers, proxies, and their positions.
• Server software, host software, database software, web server software, and administration policies.

Open Source Intelligence (OSINT)

• A form of intelligence gathering using publicly available sources.
• Involves finding, selecting and analysing information for actionable intelligence.
• OSINT aims to determine entry points into an organization (physical, electronic, and/or human).
• Many companies fail to consider how publicly available data can be exploited.
• OSINT forms: Passive (no target detection), Semi-passive (normal traffic), and Active (suspicious behavior).

Open Source Intelligence (OSINT) - What it's not

• OSINT data may not be accurate or up-to-date.
• Information sources may be manipulated to misrepresent data.
• Data can be incomplete or obsolete with time.

Tools

• TheHarvester (Python tool) to search for email addresses.
• Wayback Machine (web.archive.org) to see how websites evolved over time.
• Google Dorks (specific search operators for Google).
• WHOIS Database to find domain information.

Information Gathering – Covert Gathering (On-site)

• Select locations for on-site reconnaissance for 2-3 days to identify patterns.
• Conduct physical security inspections.
• Employ wireless and radio frequency scanning.
• Review employee behavior training and examine adjacent facilities.
• Conduct dumpster diving and identify equipment in use.

External Relationships (Off-site)

• Identify offsite locations and their importance to the organization (e.g., data centers, network providers, business partners).
• Analyse publicly available information such as corporate websites, rental company listings, etc.
• Use this data to understand business projects and create social engineering scenarios.

Organizational Chart

• Identify important people and individuals.
• Track transactions and mapping of organizational changes.
• Identify affiliate organizations tied to the business.

Electronic – Document Metadata

• Metadata gives details about the data or document (name, creator, time, date, standards, location).
• Image metadata might contain resolution, camera details, and coordinates.

Electronic - Marketing Communications

• Past marketing campaigns may provide information on retired products or services.
• Current materials may reveal internal information and external contact details.

Infrastructure Assets

• Network blocks are passively gathered, often by utilizing whois search engines (e.g., DNSStuff).
• Open-source search queries for IP addresses give details about the organization's infrastructure.
• Email addresses can reveal usernames and domain structures.

Information Gathering – Continued

• Remote access details (how employees connect remotely) might reveal an entry point.
• Application usage patterns can be identified from documents and public files.
• Defensive technologies (e.g. firewalls, antivirus software) can be tracked.

Information Gathering – Continued

• Passive fingerprinting involves searching forums for information on the target's systems/technology.
• Active fingerprinting uses probe packets to analyze systems' responses, and test for vulnerabilities.
• (Example applications or systems: Email gateways, anti-virus scanners)

Human Capability

• Analyze if a company has an incident response team (CERT/CSIRT/PSRT).
• Check advertisements for security-related positions.
• Check if security is a requirement for non-security roles.
• Determine if agreements or security duties are outsourced.

Individuals - Employees

• Analyze location history, social media presence, email addresses, personal domain names.
• Information to find usernames on the internet, using tools like theHarvester (Python).

Summary

• Summarizes introduced topics covering information gathering, a practical phase of ethical hacking.
• Offers tools and methodology that an ethical hacker can adopt.