Module 02: Footprinting and Reconnaissance
Objective
The objective of the lab is to extract information about the target organization that includes, but is not limited to:
Organization Information Employee details, addresses and contact details, partner details, weblinks, web technologies, patents, trademarks, etc.
Network Information Domains, sub-domains, network blocks, network topologies, trusted routers, firewalls, IP addresses of the reachable systems, the Whois record, DNS records, and other related information
System Information Operating systems, web server OSes, location of web servers, user accounts and passwords, etc.
Overview of Footprinting
Footprinting refers to the process of collecting information about a target network and its environment, which helps in evaluating the security posture of the target organizationâs IT infrastructure. It also helps to identify the level of risk associated with the organizationâs publicly accessible information.
Footprinting can be categorized into passive footprinting and active footprinting:
Passive Footprinting: Involves gathering information without direct interaction. This type of footprinting is principally useful when there is a requirement that the information-gathering activities are not to be detected by the target.
Active Footprinting: Involves gathering information with direct interaction. In active footprinting, the target may recognize the ongoing information gathering process, as we overtly interact with the target network.
Lab 1: Perform Footprinting Through Search Engines
Task -1 Gather Information using Advanced Google Hacking Techniques
cache: This operator allows you to view cached version of the web page. [cache:www.eccouncil.org]- Query returns the cached version of the website www.eccouncil.org
allinurl: This operator restricts results to pages containing all the query terms specified in the URL. [allinurl: EC-Council career]âQuery returns only pages containing the words âEC-Councilâ and âcareerâ in the URL
inurl: This operator restricts the results to pages containing the word specified in the URL [inurl: copy site:www.eccouncil.org]âQuery returns only pages in EC-Council site in which the URL has the word âcopyâ
allintitle: This operator restricts results to pages containing all the query terms specified in the title. [allintitle: detect malware]âQuery returns only pages containing the words âdetectâ and âmalwareâ in the title
inanchor: This operator restricts results to pages containing the query terms specified in the anchor text on links to the page. [Anti-virus inanchor:Norton]âQuery returns only pages with anchor text on links to the pages containing the word âNortonâ and the page containing the word âAnti-virusâ
allinanchor: This operator restricts results to pages containing all query terms specified in the anchor text on links to the page. [allinanchor: best cloud service provider]âQuery returns only pages in which the anchor text on links to the pages contain the words âbest,â âcloud,â âservice,â and âproviderâ
link: This operator searches websites or pages that contain links to the specified website or page. [link:www.eccouncil.org]âFinds pages that point to EC-Councilâs home page
related: This operator displays websites that are similar or related to the URL specified. [related:www.eccouncil.org]âQuery provides the Google search engine results page with websites similar to eccouncil.org
info: This operator finds information for the specified web page. [info:eccouncil.org]âQuery provides information about the www.eccouncil.org home page
location: This operator finds information for a specific location. [location: EC-Council]âQuery give you results based around the term EC-Council.
Lab 2: Perform Footprinting Through Internet Research Services
Task 1: Find the Companyâs Domains, Subdomains and Hosts using Netcraft and DNSdumpster
Lab 3: Perform Footprinting Through Social Networking Sites
Task 1: Gather Personal Information from Various Social Networking Sites using Sherlock
Lab 4: Perform Whois Footprinting
Task 1: Perform Whois Lookup using DomainTools
Lab 5: Perform DNS Footprinting
Task 1: Gather DNS Information using nslookup Command Line Utility and Online Tool
Lab 6: Perform Network Footprinting
Task 1: Perform Network Tracerouting in Windows and Linux Machines
Lab 7: Perform Email Footprinting
Task 1: Gather Information about a Target by Tracing Emails using eMailTrackerPro
Lab 8: Perform Footprinting using Various Footprinting Tools
Task 1: Footprinting a Target using Recon-ng
Lab 9: Perform Footprinting using AI
Task 1: Footprinting a Target using ShellGPT
Last updated
