Reconnaissance

• It can be defined as a preliminary survey or observation of our target (client) without alerting them to our activities.
• Reconnaissance can be broken down into two parts — Passive Reconnaissance and Active Reconnaissance.

Taxonomy of Reconnaissance

• Passive Recon:
  • Can be carried out by watching passively.
  • Doesn’t require interacting with the target i.e. we aren't sending any packets or requests to the target.
  • It relies on publicly available information that is collected and maintained by a third party.
  • Open Source Intelligence (OSINT) is used to collect information about the target.
  • For example - We might collect Domain names, IP address blocks, email addresses, employee names, and job posts.
• Active Recon:
  • Requires interacting with the target by sending requests and packets and observing how it responds.
  • An example of Active recon- Using Nmap to scan target subnets and live hosts.
  • Information that we would want to discover - Live hosts, running servers, listening services and version numbers.
  • It can be classified as:
    • External Recon: Conducted outside the target network. Example - Running Nikto from outside the target company network.
    • Internal Recon: Conducted from within the target company’s network. Example - Using Nessus to scan the internal network using one of the target’s computers.

Built-In Tools

WHOIS

• It is a request and response protocol that follows the RFC 3912 specification.
• A WHOIS server listens on TCP port 43 for incoming requests.
• The domain registrar is responsible for maintaining the WHOIS records for the domain names.
• whois queries the WHOIS server to provide all saved records.
• whois provides us with:
  • Registrar WHOIS server
  • Registrar URL
  • Record creation date
  • Record update date
  • Registrant contact info and address (unless withheld for privacy)
  • Admin contact info and address (unless withheld for privacy)
  • Tech contact info and address (unless withheld for privacy)
  • At the end of the whois query, we find the authoritative name servers.

nslookup

• It uses the default DNS server to get the A and AAAA records related to domain.

  

dig (Domain Information Groper)

• It provides a lot of query options and even allows us to specify a different DNS server to use.

• For example - We can use Cloudflare DNS server:

  $ dig @1.1.1.1 tryhackme.com