Reconnaissance is one of the most important preparatory steps to hacking. In order to attack a system or
or a service
a hacker must know the operating system, the open ports or the service and the application versions
that are running on the target host.
This is in most cases the first phase of an attack. Reconnaissance is important for both white and
black hat hackers.
Ethical hackers use reconnaissance techniques to find and then patch vulnerabilities on their own networks
or the networks
they audit while black hat hackers use reconnaissance to discover the vulnerabilities of the target
that later will be exploited. In the reconnaissance
stage attackers act like detectives gathering information to deeply understand their targets. Every single
detail counts and the goal is to know the network better than the people who run and maintain it.
There are two types of reconnaissance: a passive and an active one. Passive reconnaissance means gathering
information about the target without sending any packet to it.
You do not interact with the target system in any way.
Most of the time this is done through publicly available sources such as Open Source Intelligence also
known as OSINT, Google dorks, Shodan searchers and many more. We'll dive deep into Google dorks and
Shodan searchers in the next lectures.
This is for example a Google Dork
and
this is a showdown search that displays a Apache Tomcat results from Sydney, Australia.
On the other hand, in the process of active reconnaissance the heck out it will directly interact
with the target host or network to gain information which in most cases is more relevant and accurate
than in the case of passive reconnaissance.
Note that there is a risk of getting detected if you are planning active reconnaissance without permission
and depending on what you do it can be legal in some countries.
My advice is to never scan networks without permission. The process of reconnaissance is carried out
by Footprinting, Scanning, and Enumeration
These three are the subprocesses of reconnaissance and help hackers to build a complete view of the
targets. There are a number of tools that are used for reconnaissance and scanning such as hping,
arp-scan or netdiscover,
but nmap is the standard when it comes to scanning.
I strongly recommend you to master n map
if you want to be an effective ethical hacker.
We'll get more into these tools in the next lectures.