[MUSIC PLAYING]
Hello, everyone.
Welcome to the information gathering course.
I'm your instructor Alexis Ahmed.
This is going to be a formal introduction to the course
to give you an idea as to what we'll be covering.
And we'll also be taking a look at some of the learning
objectives for this course.
So let's get some of the formalities out of the way.
So who am I?
My name is Alexis Ahmed.
I am a Senior Penetration Tester at HackerSploit.
And I'm also an Offensive Security Instructor
here at INE.
If you want to reach out to me, you
can do so via my email, Twitter, and/or LinkedIn, all of which
have been posted to this particular slide.
So if you want to reach out to me, that's how you can.
So let's get started by getting a high-level overview of what
we'll be covering in this course.
So again, we're starting off with information gathering.
So we'll be getting an introduction to information
gathering, getting an understanding as to what it is
and what it is used for during a penetration test,
and really why it is so important,
or why this phase of a penetration test
is so important.
And of course, it will also be getting an understanding
as to what the differences are between active and passive
information gathering.
Once we know the differences between the two,
we can get started with passive information gathering.
We will be taking a look at the various tools and techniques
that can be used to essentially obtain information
about a target system or a company in and of itself
through publicly-available sources or information.
So the objective with passive information gathering
is to essentially find as much information as possible
about our target from publicly-available sources
like the internet, like Google, like any other database
online that may shed some light or may provide us
with a good idea as to what we're dealing
with regards to the company, or the individual, or the systems
that we are targeting.
We'll then move on to active information gathering.
Active information gathering essentially
entails actively engaging with the target systems
to essentially obtain more specific information.
So an example of this would be, once we have obtained the IP
address of the system that's within the scope of what we are
allowed to test from the passive information gathering stage,
within the active information gathering stage,
we can then start performing a port scan on
that IP address to get an idea as to what services are running
on that system.
We're not going to be exploiting them.
That's something that we're going
to get to after we complete the enumeration course, which
is after this.
So the objective here is to get more specific information
about a system or an individual.
And this can only be done by actively
engaging with that system or that individual
or that company.
So with regards to prerequisites,
the only two prerequisites that are required
is that you need to have a basic familiarity with Linux,
because we're going to be utilizing
Kali Linux as our penetration testing distribution of choice.
So you should have the ability to navigate around the Linux
file system, utilize the Linux terminal to run commands,
so on and so forth.
And of course, because we're going
to be performing a lot of reconnaissance, or information
gathering, on websites and web applications,
you need to have a basic familiarity with web
technologies or, generally speaking, with the web.
So you need to understand the various protocols that
operate on the web, like HTTP, HTTPS, DNS, so on and so forth.
As for the learning objectives, there are really
are three main objectives here.
And of course, I'm being extremely simplistic here.
But students will learn about the difference
between active and passive information gathering.
This is very important, because sometimes when beginners get
started in penetration testing, they sort of mix up the two.
And that can be quite problematic, because you
want to really separate these two phases,
because the information you get from each phase
is going to be different and they're
used for different things.
So that's something that you will learn.
You'll also learn how to perform passive information gathering
by leveraging various tools and resources available online
or that are publicly accessible.
And of course, you learn how to perform active information
gathering.
Of course, we're also going to be taking a look at the tools
and resources that can be used to perform active information
gathering.
With that being said, I just want
to put out a disclaimer that in this particular course,
you will see quite a few examples of tools
and techniques that are being used
on real-world websites or IP addresses,
and it is always good practice or recommended as a penetration
tester to never run any of these tools
or perform any of these techniques showcased
within this course on any other systems
or on any other sets of IPs out there on the internet
without prior permission or authorization.
Because remember, as a penetration tester,
you need to have written permission from your employer
or from your client telling you that,
OK, I'm giving you permission to test these systems.
Without that, what you're doing is illegal.
So you need proper authorization from your client or a company
telling you that you can do whatever you're supposed to do.
So do keep that in mind.
With that being said, now that we have an introduction
to the course, we can actually get
started with the first section of this course, which
will introduce you to information gathering.
And we'll go over the differences
between passive information gathering
and active information gathering.
So I'll be seeing you in the next video.