‫Hello and welcome to this information gathering over the internet lecture in this lecture, you'll learn
‫the types and methods of information gathering, the classic information gathering methods such as who
‫is and banners, how to use search engines to gather information.
‫How to gather information about the people who are related to a target company, how to find more from
‫the archives.
‫And the tools to help you collect valuable information about the target company.
‫The first phase in security assessment is focused on collecting as much information as possible about
‫the target information gathering is one of the most critical steps of hacking or penetration testing.
‫The more information is gathered about the target, the more it becomes possible to customize the attack.
‫In this section, we're going to answer these questions.
‫What can we learn about the target over the internet?
‫How can we collect the information?
‫Where can we find the information about the target?
‫Before we begin, we should answer a basic question, what is the target?
‫Target is the company institute network system or even a person that we want to hack an application,
‫a person, a system will try to collect every bit of information that helps us to hack the target.
‫There are two types of information gathering.
‫The first type is passive information gathering.
‫In this type of information gathering, you don't want to be detected by the target in this regard.
‫You don't use tools that send traffic to the target.
‫Neither from your host nor an anonymous one across the internet.
‫Passive information gathering activities may include, but are not limited to, identifying IP addresses
‫and subdomains, identifying external or third party sites, identifying people who are related to the
‫target.
‫Identifying technologies, identifying content of interest identifying vulnerabilities.
‫You can collect information possibly from web archives, mail archives, social networks, search engines,
‫etc..
‫A second type is active information gathering in this type of information gathering.
‫You scan on the target's systems.
‫Active information gathering requires more preparation for the attacker pen tester because it leaves
‫traces which are likely to alert the target or produce evidence against him in the course of a possible
‫digital investigation.
‫There are a lot of places you can collect data over the Internet, Web archives, suppose that the sensitive
‫data was published accidentally.
‫A few days later, the admins realized the mistake and remove the data from the website.
‫But what if someone has already archived that web site with the sensitive data?
‫Scanning the ports and services, you can find the ports accessible over the internet.
‫The target company opened that service intentionally or unintentionally.
‫Using search engines, you can find enormous pieces of useful information beyond the known weaknesses.
‫Leave traces on the web sites on headers, titles, you URLs.
‫You can easily find these traces using search engines.
‫You can find some useful information about the target company on social networks, for example, Facebook,
‫Twitter or LinkedIn.
‫Suppose the target company is looking for a new system admin to hire.
‫Look at the job sites or LinkedIn.
‫What would you see the information about systems that are used in the target company or tools and programs
‫used to monitor those systems?
‫Look at the experts working for a target company carefully, do they subscribe to forums or email lists?
‫What kind of problems do they share on this forum or these mailing lists asking for help about Java
‫version nine or Hibernate Framework?
‫You take and publish pictures of your secret disaster recovery center on your website.
‫You're sure that it's impossible to understand from the picture where the center is.
‫Are you sure?
‫What about the metadata of the picture?
‫Did you choose the location info?
‫Who is is a Web application used to get information about the target website, such as the administrators
‫email address, details about the registration.
‫Who is is a very large database and contains information of approximately all the websites.
‫It can be searched by domain name or an IP address.
‫Block the protocol stores and delivers database content in a human readable format.
‫You can use the WHO is command of Linux systems to get the WHO is query results.
‫In addition, there are some web sites that help you to get the WHO is query results.
‫You see some of them on the slide.
‫And who is service of Domain 2's websites is also given as an example.
‫If we analyze the banners of the response sent by the Web systems of the target company, we can find
‫some detailed information about the server, the technology used, etc..
‫We sent a request to put 80 of NHS staff at UK website using telnet services and get the response.
‫Look at the server and the exposed by headers.
‫We learned that the application server of NHS staff UK is Microsoft II's version 8.0 and ASP Darknet
‫is used to develop the web application, but hold on.
‫Are we sure?
‫Could the information be fake?