Welcome to the next section on information gathering or recon and scanning in the previous section,
you saw how to do a phishing attack.
You saw how to carry out a spear phishing attack.
When you know some information about the user, you can target those social engineering attacks.
Two together, information about one specific person or one specific organization where you might be
wondering how would you gather information like that?
If you don't know anyone inside the company?
Well, this is a really important set of skills to gather as a hacker.
And we need to know how hackers gather this information if we want to be able to defend against it.
So how to hackers gather lists of names and e-mail addresses for phishing, or how do they gather a
list of servers to attack?
Well, there are two main categories of reconnaissance or recon.
The first one is passive recon that uses open source intelligence or tools that don't intrude on a target's
network.
So if you're wanting information about the news organization, CNN, for example, with passive recon,
you would never scan CNN's network because that alerts them to your presence.
And this is a really important skill set to develop as a white hat or ethical hacker.
So passive recon is where we're going to gather information using open source intelligence or asset
active recon is where we use scanning tools to interact with the target network.
So if we're scanning my university, for example, we would actually run a network mapper or some sort
of scanning tool against that network.
Now, for this one, it's really important to know as ethical hackers, we have to have permission from
that organization before we run any active scanning tools against a network.
It can be illegal not just from the organization itself that might want to prosecute you.
It could be illegal to run over your network, even over your Internet service provider to that organization.
It could be illegal in your city, state, country, et cetera.
So it's really important to make sure you have permission and make sure you know all the applicable
laws before you try active reconnaissance.
So in passive recon, what we're going to see in this lesson is some open source intelligence using
the O.S. framework, where specifically we're going to gather some domain name information from domain
dossier.
Maybe we'll maybe get some important contacts to try against a site for social engineering, for example.
Then we're going to learn about a numeration or listing out accounts, servers on the networks.
This is a really important skill to develop, even for your own home network.
You might want to do some enumeration of hosts or servers.
You might want to gather some information about what's running on your organization's network.
You definitely want to see what hackers can see from outside your organization.
And then finally, we're going to run some active scans.
Now, we're going to do that safely inside our own private net network.
But we're also going to see how you could scan your entire Wi-Fi network for that one.
It's very important that you own and pay for that that local Wi-Fi network, that you not do this in
a building or in a company or in a school, any place where other people whose computers you don't control
or don't own or don't have permission to scan might be active.
But we're gonna see a couple of tools to do that with.
So we'll start off with a little open source intelligence gathering in the next lesson.