[Day 8] 2. VAPT Phase 2 Information Gathering (Reconnaissance)

Passive Information Gathering

• Definition:

  • Indirect method of gathering information about a target.
  • No direct connection exists between the attacker and the target.

• Example:

  • Asking third parties about the target.

Active Information Gathering

• Definition:

  • Directly interacting with the target to gather information.
  • Creates a direct connection between the attacker and the target.

• Example:

  • Directly questioning or probing the target.

Objective of Information Gathering

• Understand the target’s infrastructure:
  • Number of PCs.
  • Number and types of servers (e.g., database, Linux, Windows).
  • Overall network layout.

Passive Information Gathering (Footprinting)

Definition:

• Collecting information without directly interacting with the target.
• Uses open-source tools and publicly available data.

Techniques:

1. Open Web Information Gathering

   • Use open-source intelligence (OSINT) tools and techniques.

2. Google Hacking (Google Dorks):

   • Search for specific data using advanced search operators in Google.
   • Developed by Johnny Long (Hackers for Charity, Twitter: @ihackstuff).

   Examples of Google Dorks:

   • Copy

     filetype:pdf something

   • Copy

     filetype:sql something

   • Copy

     intext:gmail.com intext:password something

   • Explore Google Hacking Database on Exploit-DB.

3. Hosting Types:

   • Shared Hosting: Multiple users share the same server.
   • Dedicated Hosting: Exclusive server for one user or organization.

4. IP and Domain Lookup:

   • IP Lookup:

     • Example: Searching for vehicle-related details in RTO databases, such as:
       • Vehicle type, color, owner, registration, challan, contact info, address.

   • Whois Lookup (ICANN):

     • Determine the owner of a domain.
     • Find contact information and address.
     • For Linux:

       bashCopy
       whois <domain_name>
       which whois  # Checks if `whois` is installed.
       sudo apt install whois  # Install `whois` if not available.
       

5. Shodan:

   • A specialized search engine for finding information about hosts and connected devices on the internet.
   • Extremely useful for identifying public-facing infrastructure.