Reconnaissance in penetration testing and ethical hacking

Recon, short for reconnaissance, is the initial phase of the penetration testing and ethical hacking process. It involves gathering as much information as possible about a target system to find potential vulnerabilities. The goal is to collect data that can be used in later stages of an attack or security assessment. Recon can be divided into two main types: passive and active.

Types of Recon

1. Passive Reconnaissance:
   • Involves gathering information about a target without directly interacting with it.
   • Techniques include:
     • WHOIS Lookup: Querying domain registration details to find information about the domain owner.
     • DNS Enumeration: Discovering information about domain names and associated IP addresses.
     • Social Media Profiling: Collecting information from social media profiles of employees or the organization.
     • Public Records Search: Looking for publicly available documents, job postings, and other records.
2. Active Reconnaissance:
   • Involves direct interaction with the target system, which can be detected by the target.
   • Techniques include:
     • Port Scanning: Scanning target systems to identify open ports and services.
     • Network Mapping: Identifying the topology and devices within a network.
     • Service Enumeration: Identifying the versions of services running on open ports.
     • Web Application Scanning: Analyzing web applications for vulnerabilities.

Example of Recon

Let’s consider an example of recon on a target website, example.com.

Passive Reconnaissance

1. WHOIS Lookup:
   • Use a WHOIS lookup tool to gather information about the domain example.com.
   • Example: whois example.com
   • Result: Domain registration details, contact information, and domain expiry date.
2. DNS Enumeration:
   • Use a tool like nslookup or online services to discover subdomains and IP addresses.
   • Example: nslookup example.com
   • Result: IP address associated with example.com.
3. Social Media Profiling:
   • Search for the company and its employees on LinkedIn, Twitter, and Facebook.
   • Result: Information about key employees, their roles, and potentially their email addresses.

Active Reconnaissance

1. Port Scanning:
   • Use a tool like Nmap to scan for open ports on example.com.
   • Example: nmap -sS example.com
   • Result: List of open ports and services running on those ports.
2. Service Enumeration:
   • Use Nmap or other tools to identify versions of services running on open ports.
   • Example: nmap -sV example.com
   • Result: Versions of services such as HTTP, FTP, and SSH.
3. Web Application Scanning:
   • Use tools like OWASP ZAP or Burp Suite to scan the website for vulnerabilities.
   • Example: Using OWASP ZAP to crawl and scan example.com.
   • Result: List of potential vulnerabilities in the web application.

Conclusion

Reconnaissance is a critical step in identifying the attack surface of a target. By collecting detailed information through both passive and active methods, an ethical hacker can better understand the target system and plan further testing or attacks. It is important to conduct recon ethically and with proper authorization when working on real systems.