Reconnaissance is gathering information about a target system or network, to identify vulnerabilities that could be exploited. This process is also known as Footprinting or Information Gathering.
There are two main types of reconnaissance:
Passive:- Passive reconnaissance involves gathering information without directly interacting with the target system. This can be done through publicly available sources, such as websites and search engines.
Active:- Active reconnaissance involves directly interacting with the target system. This can include techniques such as network scans and vulnerability scans and can raise the risk of detection.
-
Network Information.
Domain name
Internal Domain
IP Address
Unmonitored/private websites
TCP/UDP Services
VPN/IDS/IPS/access controls
VPN info
Phone numbers/VoIP
Network topology
Network devices
-
Operating System Information.
Users and group names/info
Banner grabbing
Routing tables
SNMP
System architecture
Remote systems
System names
Passwords
Dumpster diving
Version
Patch level
-
Organization Information.
Organization website
Company directory
Employee information
Business structure
Location details
Comments in HTML source code
Security policies deployed
webserver links
Background of organization
Marketing and advertising
Prevailing events
Partners
Phone
Financial information
An external network refers to a network that is outside of an organization's internal network and is accessible from the internet. Examples of external networks include public Wi-Fi networks, cloud-based services, and other third-party networks. External network reconnaissance is a stage in external network penetration testing where the testers gather information about the target system. The purpose of this phase is to gather information about the target network, including:
-
Network Information
-
Operating systems and applications
-
Publicly accessible information
-
Phone
-
Website Mirroring
-
Archive Sites
-
Github recon
-
Whois
-
Web server Content
-
Email Header
-
Google and Search Engine
-
People Sites
-
Social Network
-
Job Sites
-
Alert Website
Internal network penetration testing is a type of security testing that focuses on evaluating the security of an organization's internal network infrastructure.
-
IP Address
-
Internal DNS
-
Private Website
-
Dumpster Diving
-
Shoulder Surfing
-
Network Information
IP address
Domain name
Network topology
Open ports and services
-
Web Application Information
Web server technology used
Application framework
Source code (if accessible)
Session management
Input validation and data handling
Authentication and authorization mechanisms
-
Web Server Information
Operating system
Web server software version
Server-side scripting language and version
Database management system and version
-
Web Application Components
Dynamic content generation
Client-side scripting languages
Third-party components and libraries