Hi, I'm Alex Tushinsky. In this module, we're going to review the
various aspects of passive reconnaissance. During a pen test,
recon is one of the more important foundational steps that helps
ensure successful engagement.
So today, we're going to discuss what reconnaissance is,
why it's important, and look at the two types of recon available to us.
We'll then step through some aspects of passive recon to demonstrate some of the
techniques that can be used during this phase of the test.
Let's begin with an overview of reconnaissance.
There are several phases to a penetration test.
While you may see some variations of this list,
everything technically boils down to the following six phases.
First we engage with the customer,
identify what they need, and initiate the project.
Next we need to gather as much intel and information about
the target to ensure we have adequate attack vectors that we
can explore in a later phase.
Gathering intelligence typically involves a passive and an active approach.
The difference here is that we don't directly engage with the
target during the passive reconnaissance phase.
In other words, should our client go to their firewall,
IPS or other locking mechanism, they should not be able to see
any of our IP addresses or handiwork in any of their logs, so the
sources used for passive recon are publicly available and not
proprietary to our client.
After we've gotten enough intel, we may have several
avenues of attack that we can test out.
We use a vulnerability assessment to further refine those vectors and
identify new ones. Here, we're looking for open ports,
vulnerable software running, or unpatched or unprotected
servers that we can work with. Combined with the passive and
active recon, we may have usernames,
passwords, and other information that could be useful in the next phase,
and that next phase is when we attempt to exploit the target based on the
intel and vulnerability assessment findings. Note that without performing
those earlier steps we would have a tough time here, as we wouldn't
necessarily know exactly what attacks may be possible, or we could end up
trying different things to see what works, instead of having a more
educated approach.
What I mean by this is that if we know the user is running a
particular version of Windows on their server,
then we can target attacks that compromise that particular OS. We
wouldn't start with UNIX‑based attacks knowing that the client is
running Windows. These phases are also iterative. As we break into
something, we need to go back and perform reconnaissance and figure
out what we just found.
We then may want to rerun a scan in order to see what new doors are open to
us, and then we can proceed further with exploitation.
We keep repeating this until we exhaust all
possibilities or as many of them as possible.
Lastly, we gather and write all of this down as we go and
eventually produce a report for the client.
After delivering the report and remediation is performed and everything is
retested, we close out the project. So just to reiterate, during passive recon,
we do not directly engage with the target, but instead we rely on public
information to gather some details about our target.
This can be details about the stack they run, employees,
their email information, networking or infrastructure details,
locations, and any files or documents that can help our cause. Active recon,
on the other hand,
is when we start to perform scans against the target and use information
gathered in the passive recon phase to further explain and provide
insight into the target's infrastructure, people, and technical stack.
Passive recon helps us identify attack vectors, because we're able to
find details such as the type of OS the company is running, the type of
database servers, or the fact that they may be using a vulnerable piece
of software.
These types of findings help shape the types of attacks we will
attempt, and save us a lot of time later.
Later we won't have to try UNIX‑based attacks against a Windows server, so
knowing that the target is Windows based eliminates many things that we would
otherwise have to try. And don't get me wrong,
sometimes we end up going in blind and running through the full gamut
of attacks because the client has cleverly disguised or altered their
environment to hide these details from us.