Yes.
We know this is a critical area when it comes to cyber security, and that is the many, many techniques
that can be used to footprint against our organization.
Yes, this is yet another look at more techniques that could be availed by attackers.
Think about e-mail.
Now, we're not talking about the contents of an e-mail.
No, we're talking about everything that can be gleaned from just capturing the e-mail packets.
Recipient system information would include things like potentially geo location when it was received,
when it was read, how long it was read, whether there was proxies in use, what's the OS, what's
the browser, what's the forward email address?
What's the device type?
What path did the email take notice?
There's a lot of valuable information that attackers could glean here, and we're not even getting into
the details of what they can get from email headers.
This is a virtual treasure trove of information, so it's no surprise that email tracking tools often
beloved by attackers include info gear and email tracker.
Pro again will be adding these to flash cards for you so you can keep them all straight.
Remember, geolocation is possible thanks to public IP addresses.
Giving away location websites to help with this include IP to location and IP location finder.
Plenty of tools leveraging the ability to geo locate.
Now DNS is something else that is really problematic with too much information a lot of times being
shared.
I will never forget the first time I registered a domain with the WHO is service and allowed them to
publish all my personal information.
We're talking your personal phone number, your personal address, your personal email, all of it.
So this is maintained by the right are not easy for me to say.
The registry of internet, whatever.
Right, the RDR and I'll look up the exact ah you know, mnemonic name there, three letter acronym
and I'll flash it on the screen for you.
But this registry service that maintains the WHO is database.
Oftentimes all we need to do is tell them to remove our personal info.
Or when we are registering, like when I register with a WRC, I pay like an extra dollar $0.99 to have
the information proxy.
So my own personal information won't appear.
Now, I'll admit that when I did this mistake, I wasn't hacked.
But what did happen that was a nightmare was I was spammed.
Yes.
So they took my email address, my personal email address, and every single website designer on the
planet started emailing me and some texting me because remember, they had phone number information.
So it's a nightmare.
You don't want to be hacked or spammed.
Watch out for that.
Who is database information that is public?
Look up.
How about reverse lookups?
Let's not forget how DNS normally works.
We have an address, WWE Yahoo.com that we want to go to.
We need the IP address to get there.
Well, reverse lookups do the opposite.
DNS recon, for instance, can take an IP address, go into the DNS system and tell you what you are.
URL that IP address is associated with.
Notice how reverse lookups can be the best friends of the reconnaissance attackers.
They have the IP.
They're trying to figure out what domain is it a part of the review of the DNS records I wanted to do
right here with you so that you understand these are the record types that are often being sought after.
There's the host record type, the fundamental host record, and that is in a record type.
If you see DNS records that carry in acts, these are the domains mail servers is for hostname servers.
And then we have to remember we have a C name record type.
This is how we can alias to a particular host.
For example, maybe we have server one dot acme dot com and we want this to be available at WW W dot
acme icon.
We can create a C name alias so that when someone goes to WW dot acme dot com, they're actually taken
to the server one dot act mi.com.
Notice we can create another alias for some other server purpose.
So C names are very common.
There's the S01 record.
This is the start of a 30 record for the domain.
And then there's SRP service records.
Now, these aren't all of the types of DNS records that you might encounter, but these are ones I want
you to know absolutely verbatim.
Well, we're going to have more fun in this chapter with our discussion of foot printing.
Next up.