Professional Documents
Culture Documents
2.footprinting - Scanning
2.footprinting - Scanning
EXPERT
FOOTPRINTING
What is footprinting??
“Process of collecting as much information as possible about target or victim”
Active Footprinting Direct interaction with the target to gather the information.
Eg: Using NMAP tool to scan the target.
Passive Footprinting Trying to collect the information of the target without directly
accessing the target. This involves information collection using social media, websites, etc.
Methodology of Footprinting
1. Network Footprinting
2. Domain Footprinting
3. Social Networking Information
4. Google Footprinting
5. Website and Database Footprinting
6. Footprinting through Social Engineering
NETWORK FOOTPRINTING
“It is the process of accumulating data regarding a specific. network environment,
usually for the purpose of finding ways to intrude into the. environment.”
How to find the IP address of own system?
1. Windows
i) Open CMD
CMD stands for Command Prompt. And is used to execute entered commands
and perform advanced administrative functions. This was made in batch
programming. This was the first OS Disk Operating System (DOS) was also
made using batch programming.
ii) Type ipconfig and then hit enter.
iii) This shows both ip address IPV4(32 bits) and IPV6(128 bits).
iv) Here IPv4 is 192.168.1.206
2. Linux
a. Ifconfig is the command for getting the IPV4 of the system.
TTL means "time to live". It is a value on an ICMP packet that prevents that packet
from propagating back and forth between hosts ad infinitum. It's also a measure of how
many hops the packet took.
4. Domain Footprinting
What is domain?
A domain name is your website name. A domain name is the address where Internet
users can access your website. A domain name is used for finding and identifying
computers on the Internet. Computers use IP addresses, which are a series of number.
However, it is difficult for humans to remember strings of numbers.
Eg of domains:
.com, .in, .org, .net, .gov etc.
DOMAIN FOOTPRINTING
DNS (domain name system) The Domain Name System is a hierarchical and
decentralized naming system for computers, services, or other resources connected to
the Internet or a private network. It associates various information with domain names
assigned to each of the participating entities.
This is used because we cannot remember the ip address of all websites so DNS helps
was redirecting to the website using the domain name and .com is the domain, this binds
both of them to the ip address.
1. Registrant A domain name registrant is an individual or entity who registers
a domain name. Upon registration of a domain name, a registrant enters into
a contract with a registrar.
Bluehost
HostGator
GoDaddy
Namecheap
DreamHost
Shopify
ETC …..
PROCESS
Registrant Registrar Registry ICANN
Google Dork Google hacking, also named Google dorking, is a hacker technique that
uses Google Search and other Google applications to find security holes in the configuration
and computer code that websites are using. Google dorking could also be used for OSINT
(Open Source Intelligence).
1. Inurl:
For eg:
www.bank.com is the website and we need to find the admin panel of this
site. But sometimes the panels are hidden in the list of folders, this
becomes difficult to find the admin panel.
So here .inurl: comes in picture as it helps in finding the admin panel
using this syntax
Searching using this syntax will provide the full path of adminlogin panel.
2. Filetype:
This can be used to search sensitive data of the website of the company
Eg:
Consider this website as target
www.abc.com
Type the whole url and in the end type anything like
www.abc.com/anything
This will throw the error of ERROR 404 (which is page not found) and will also
give some other information like server on which website is hosted, open port in
website, which is the web server and its version, etc…
2. Database Footprinting
List of some database:
Mysql
Mongodb
Mariadb
Oracle
Postgresql
ETC…
This website throws the error stating the name of database which is a
vulnerability.
What is scanning?
Scanning is a set of procedures for identifying live hosts, ports and services, discovering
Operating systems and architecture of target system, identifying vulnerabilities and threats in
the network.
Scanning Methodology:
1. Check for Live Systems
2. Check for Running Services and Open Ports
3. Vulnerability Scanning
Ports:
There are two types of ports
1. Physical ports
This can be ports of audio jack, usb connection port, hdmi, projector, ethernet port, etc
2. Logical ports / Virtual ports
In a system we have 65635 virtual ports.
1000 ports are used for running services
Some list of ports
FTP 20, 21
SSH 22
TELNET 23
SMTP 25
HTTP 80
HTTPS 443
DNS 53
SMB 445
NETBIOS 139
MYSQL 3306
NETWORK SCANNING
1. Discover Live Host in Network
a. In windows (can be done using tools)
b. In linux (can be used doing commands)
NOTE: This tools wont work if there are firewalls in the company.
Advanced IP Scanner uses ICMP (Internet Control Message Protocol).
Firewall blocks ICMP so this doesn’t scan properly.
This scans subnet Ips ranging from 0 – 255.
Open Advanced IP Scanner Click SCAN IP and MAC address are displayed after
the scan.
If you want to deep scanning IP address and MAC address are compulsory.
2. System Scanning Scanning multiple device for in depth scanning of files present
in the system.
a. Zenmap (in windows) This is the GUI version of Nmap.
b. Nmap (in linux) 50+ commands to scan devices.
Open Zenmap in Target (enter IP or DOMAIN) Hit Enter Select Intense Scan
(deep scan) This will display OPEN PORTS and can be hacked using servers.
In topology it shows the devices present in between the main system and sever
In ports / hosts it shows the open ports and services that are running.
Open Acunetix Enter Website URL click NEXT Displays the WEBSERVER
Displays vulnerability levels (high/medium/low)