The first section in the Penetration Testing Execution Standard,
once testing begins, is intelligence gathering.
In this phase, we're gathering detailed information about the target of testing,
and we want to do it without revealing our intentions.
First though,
there are two types of intelligence gathering, active and passive. In
active intelligence gathering, we are probing the targets by actively
interacting with them to gain information. We might go to their website and
self‑register an account in order to use it and gather information from the
inside, probe services running and scan networks. As opposed to passive
intelligence gathering where we are gathering information without
interacting with or attracting the attention of the target. We might read
documentation that's been provided, check public information sources, use
our favorite search engines, look at domain registrar information,
use third‑party scanning services, DNS records, and other sources of information.
Metasploit has many capabilities for active intelligence gathering.
You can utilize Metasploit auxiliary modules for actively scanning networks,
ports, service versions, and service configuration.
The fuzzing capabilities can be used in identifying
services with potential vulnerabilities.
All of these techniques actively and interactively probe the target's
systems and services. Passive intelligence gathering with Metasploit
includes some host‑based tools and auxiliary modules.
The MSF console interface can also execute commands that
exist outside of the Metasploit Framework.
There are host‑based tools like WHOIS for domain
information and various DNS query commands.
Metasploit also includes several auxiliary modules, such
as enum_dns to gather DNS records,
a shodan_search, and one for ssllabs to test TLS‑enabled sites.
Next,
let's spend a little more time on the active intelligence gathering options.