The first step in penetration testing is to gather information.
Usually we have two different kinds of information.
We have the passive information an active information passive information is information that you are
designing from public Web site you are searching on Google you are searching on social media Web site
but you are not interacting with the victim while active information is the opposite.
Gathering information is a very important phase inside.
While you are doing penetration testing and if you spend enough time and enough effort for sure you
will get enough information to let you plan for the attack and to make sure that the attack will be
successful.
So going gonna start about how to gather passive information using tele Linux.
I'm going to start with Google search google search.
It's the first tool of sort of getting passive information except you need to know how to use Google
in a proper way.
But before start thing and before showing you how to search Google and how to use a social OPERATOR
What is the first thing that you're going to check about your target assumes that your target is a company.
So what is the first thing to check.
Definitely is Web site you need to check the Web site.
You need to understand what services they are providing how the sites look like maybe getting some e-mail
and maybe getting a contact information maybe check if the site is well done.
I mean it is a site it's not very well done and prepared and the chairman code it's messy.
Maybe that indicates they didn't spend that much time on so that they didn't spend much time or money
on that Web site and accordingly is Maisie.
Maybe they didn't spend that much time on security if they didn't spend on the site.
So definitely didn't spend anything or they didn't spend that much on security.
So the Web site it's your first searching tool checking the victim Web site.
If your victim is a company.
Now when we are talking about searching
google will help you to get a lot of information about the site.
So for instance if I search for micro soft dot com
so he can search all the Microsoft Web site dot com the domain and the subdomain.
And as you can see this is the amount of results that was found.
Now can I be more specific because maybe you will get me some Web site that do not belong to Microsoft
but inside the site itself.
They mentioned something about Microsoft.
So I got a huge amount of upside.
No I just need Microsoft Web site so I can use a social operator like this operator site
and then
and we can see Microsoft dot com.
So by using the site operator
I can search for only the site that has Microsoft in the site name.
So as you can see I was able to get Microsoft.
I was able to get the subdomain.
This is a supplement from Microsoft.
So I'm getting only as you are.
It has Microsoft inside.
This is by using site I can even extract some of them.
I mean what if I'm looking for all subdomain except the main domain.
I do want the search to have w w w dot Microsoft combat I need the other domain.
And by the way did you notice that the amount of output for the search has decreased.
So I can put the sign minus site
me column
my raw soft dot com.
I'm sorry uh should be w w w dot Microsoft dot com because religious.
So what exactly is operating is saying is saying okay I want you to search for anything that has inside
the site name Microsoft dot com except exclude the W W W got Microsoft the com.
So get me anything except this one w w Microsoft dot com and anything that has this specific site.
And as you can see we are getting everything except the w w w dot Microsoft control getting all the
subdomains okay.
What if I want to search for fine in my inside Microsoft PowerPoint presentation inside Microsoft that
has the term penetration testing.