Information Gathering, Footprinting and Reconnaissance

• Identify common information-gathering tools and techniques.

• Job postings give valuable clues into how its infrastructure is organized
• Example:
  • Advanced knowledge of Microsoft Windows 8, Windows 10, Server 2008, Server 2012, Server 2016, Microsoft Office 2010, Office 2013, Office 2016, Microsoft SQL Server, Microsoft IIS, Visual Basic
  • Relevant experience/knowledge: Cisco PIX; Check Point Firewall helpful but not necessary
  • VMWare, SAP, and other data-gathering systems
  • Knowledge of Active Directory
  • Experience with Symantec Security Suite

• Goal is to locate useful information using techniques already provided by the search engine, in new ways
  • Can use Yahoo and Bing as well

1. Use the site: operator to search for armchairs on IKEA’s site, www.ikea.com.

2.Use the Advanced Search form to find the page whose title is “Detect Plagiarism.” 3.Find all pages on google.com but not on answers.google.com nor on directory.google.com whose titles include the words “FAQ” or “help.” 4.Use the link: operator to see who links to googleguide.com, your company’s website, or your favorite website.

5.Find pages whose titles include surfing that are not about surfing the World Wide Web.

6.How can you search for [ google help ] on Google Guide, www.googleguide.com, and on the UC Berkeley library website, www.lib.berkeley.edu?

http://www.betterwhois.com http://geektools.com www.all-nettools.com www.smartwhois.com www.dnsstuff.com http://whois.domaintools.com

Queries databases that hold registration information Designed to interrogate the Internet DNS and return domain ownership, addresses, location, phone number, etc.

Accessibility of tool depends on operating system

• American Registry for Internet Numbers (ARIN)
  • North America and parts of the Caribbean
• Réseaux IP Européens Network Coordination Centre (RIPE NCC)
  • Europe, the Middle East, and Central Asia
• Asia-Pacific Network Information Centre (APNIC)
  • Asia and the Pacific Rim
• Latin American and Caribbean Internet Addresses Registry (LACNIC)
  • Latin America and parts of the Caribbean region
• African Network Information Centre (AfrNIC)
  • Africa

• Software program that helps to determine the path a data packet traverses to get to a specific IP address
• One of the easiest ways to identify the path to a targeted website
• In Windows operating systems, the command is tracert traceroute
• In UNIX/Linux, the command is
• Traceroute displays list of routers on a path to a network destination by using time-to-live (TTL) time-outs and Internet Control Message Protocol (ICMP) error messages

• Information that can be uncovered online:
  • Posted photographs, videos, or information
  • Posted content about personal activities, political or activist affiliations, and beliefs
  • Posting derogatory information about previous employers, coworkers, or clients
  • Discriminatory comments or fabricated qualifications

• Facebook, LinkedIn, Twitter, etc.
• Be aware of potentially malicious URLs
  • Example: Clicking a video can be linked to malicious site that steals victims’ credentials or other information
  • Website could install malicious software onto the user’s system
• Innocent-looking items (trivia items, fantasy sports, etc.) may distribute or publish user information
• Profile information valuable to ethical and nonethical hackers

• Information gathering––reasons, tools, and techniques
• Footprinting as a data-gathering technique
• Footprinting countermeasures
• Google hacking