So let's talk about some of the basics when it comes to foot printing.
Remember, foot printing is going to be followed by a discussion of enumeration.
But when it comes to foot printing, I want you to immediately think about the two types, and those
are active and passive.
Let me do a quick example of an active reconnaissance or foot printing type of information session.
Yeah, you guessed it.
We don't have to be fancy.
If I ping some device on my local network, I know my IP address is 192168 127 and I have a 24 bit mask.
So here I am trying to see if there is a network entity alive at 1921681 ten.
Now we are not getting responses to our ping.
This doesn't necessarily mean there is no machine there.
That machine may be in a security posture where it is not responding with echo replies.
Okay.
Well, guess what?
Why don't we try 11?
No, no.
Good there.
Notice a better way for me to go?
Oh, and this is more interesting here.
Notice I am getting a response.
Destination host unreachable.
So it looks like trying to get to that device.
We had a situation where it is being filtered and ICMP responses ended up reaching us, telling us that
that host can't be reached.
So that definitely looks like there's a host there that is not responding.
Let's try to one above the dot one default gateway address and look at that.
We just found a device that is responding to ICMP echoes and it is at 19216812.
What we're doing right now is active foot printing.
And why we consider it active is because we can get caught.
Yes, any network administrator worth their salt is going to be watching out for someone on their network
doing what I'm doing right now.
And that is pinging around trying to footprint the network environment.
This sticks out like a sore thumb to use that expression.
So this is not good.
I mean.
Well, let's back up a minute here.
This is great for the person that's doing the attack because they're getting great information.
But because it is active foot printing, they might get caught.
Okay.
So that's that's the trade off with this style of foot printing.
It's called active.
Now, if you're not actively engaging in foot printing, you're passively engaging in foot printing
in this is scarier because it might go undetected.
So maybe just totally legitimate traffic is being sent from one entity to like a broadcast address.
And then there is a recognition of who received that broadcast and it's just, you know, disguised
amongst other traffic in a passive way.
So it wouldn't be as easily detected.
We're going to be seeing examples of both active and passive foot printing, of course.
Beyond the example I just gave with Ping as an example of actively seeing if something is out there
alive and responding to you, what are the objectives of active and passive type of foot printing attacks
while they're gaining information, maybe they're gaining information about your organization.
Let's keep in mind that this is not always going to be technical in nature.
So they may start to attack you by looking up the many public records about your organization that are
readily available.
They might even pose as a legitimate source for that information.
So they'll pose as some financial entity in your establishment, and they'll be inquiring about public
records, about their own organization, even though they're not in your organization because they're
publicly available, they're given the records just as anyone would be.
But you get the idea they'll masquerade as a corporate employee.
They'll gain information from the network using scanning tools that are designed to get that information.
They will get as much information as they can off the nodes or systems that are connected to your networks.
And if they're hacking you as part of a team, what are their products?
What are they bringing to the rest of their team members after their often long hours?
And by the way, that's an important point.
One of the reasons this is such a challenging area for cybersecurity teams to guard against is the incredible
amount of time that the attackers have in comparison, typically to those of us that are working in
the field, either as a member of a corporate security team or maybe we're on a pen test, we have limited
amounts of time to defend.
They have often times massive quantities, amounts of time.
With which to perform these reconnaissance types of attacks.
So what are they really trying to do?
They're trying to get a great look at the security posture of us or our organization.
They may even know more about the security posture than our own other departments.
And that's.
They're trying to reduce their overall focus, their overall scope.
They're trying to figure out where are the weaknesses so that we can really spend time attacking those.
They're mapping what vulnerabilities might be identifiable in your environment so that they can leverage
those vulnerabilities with exploits.
And sadly, they're making network maps that might even be better than the documentation that you might
find in your own organization.
Yikes.
So these are their, quote unquote products that they would be really loving to gain as deliverables.
Well, I hope you enjoyed just the basics of footprint.
Now we're going to be getting into specific ways to do it and specific tools that might be used against
us.