Penetration Testing Methodology, Part 1/6 — Recon

Instead of creating a clear and structured list of the exact methods for administering tests, I will be approaching these articles as a casual conversation among friends. I will go over the six phases, their definitions, methods, and easily accessible resources that can be utilized to conduct each phase in a laid-back and informal manner.

6 Phases of a Pen Test

1. Reconnaissance

2. Scanning and Enumeration

3. Gaining Access

4. Escalation of Privileges

5. Maintaining Access

6. Covering Your Tracks

Even though I realize that all of these processes may seem overwhelming at first, you may approach and successfully finish a penetration test in a multitude of ways, and the internet is a great source of knowledge and information on all of these steps.

This first post will concentrate on Reconnaissance, the first and, in my opinion, the most enjoyable stage of the approach.

This initial, crucial section of the test will occupy a significant amount of your penetration testing time, so if there's one thing you learn from this series, make it this.

The methodical process of attempting to find and learn more about your subject is known as reconnaissance; some may even call this step "footprinting."

The methods used in foot-printing include "Dumpster-Diving," online research, and social engineering — all of which are a lot of fun.

What then are we trying to find?

The essentials would be contact names within the company, email addresses (which we could use for spear phishing, whaling, or phishing later on), phone numbers of significant company figures (which we could use for vishing), systems used by the company (like Windows or Linux, etc.), and, lastly, job postings or resumes.

Job listings may seem like an odd place to go, but the information they contain can be a veritable goldmine!

You would need to know the system that the organization uses, for example, if you were seeking for a new job as a network administrator. Additionally, the business would have to list such systems in their job offering if they were in need of certain systems expertise. All of the information that the corporation is making available online will be useful to you in the future when you're looking for or developing particular exploits to get access to or keep a foothold on the system.

CVs operate in a very similar way: if an individual has previously worked at SuperHacker Inc., they will most likely include information about their work there in their CV. This information typically includes information about the systems they used, the size of the network they were responsible for, whether or not virtualization was used, and whether or not they had to set up multiple DMZs and HIPSs, among other highly valuable details for a pen tester.

So remember when I said I would also cover the free to use and open source tools that you can use for this phase? Well here is a small list of just a few tools you can use, I will then go through each one in minor detail

• Nslookup
• Traceroute
• Ping
• Whois
• Google
• Social networking (gold mine)

Nslookup

Nslookup is an awesome tool to use when using Kali and is used to resolve a fully qualified domain name into an IP address, for instance if you where to type 'nslookup www.google.com', the basic use of nslookup would return the IP address '8.8.8.8'

We won't cover all of Nslookup's features in this brief introduction to reconnaissance, but you can easily find additional information online.

Traceroute

Traceroute is an excellent tool for determining the path taken by your "ping" before it reaches the system you are attempting to ping. It also shows the firewalls and routers it passes through en route, providing you with more situational awareness about the target.

It's wonderful because of something called a Time-To-Live (TTL). To put it simply, you can see how many "hops" the packets took to reach the target by knowing that the first three packets will only have a TTL value of 1, the following three will have a TTL value of 2, and so on

If the first packet hits the target then you will just receive the time that it took to hit the target system.

When it comes to time taken, this in itself can tell you some small details about the target;

ISDN Line — 40–50 ms

Cellular Modem — 50–150 ms

Satellite Modem — 650–750 ms

Fiber — 5- 40 ms

Cable Modem — 15- 100ms

As with the other tools, there is a ton of information out there and traceroute has a lot more to offer than the small details I have covered.

Even though Ping Ping doesn't require much explanation, we will nevertheless do it.

Ping is primarily used in troubleshooting and is used to verify the connectivity between two devices.

On a Linux system, ping runs continuously until the user stops it. However, there are useful commands for Mac and Windows systems that you should be aware of.

Ping -c www.google.com — will ping 10 times then stop

ping -6 www.google.com — will ping only IPv6 addresses

Whois

Whois offers details on the domain owner, including phone numbers, email addresses, and owner names and addresses.

Since the domain owner is typically the site administrator, he or she will be a good target for social engineering attacks, which is, in my opinion, the finest use case for this tool.

If you choose to phish the aforementioned person, the tool's results can also give you the names of internet and domain service providers, which will help the email appear more legitimate.

Google

The most obvious, but occasionally most useful, tool is Google, which is also the best source for obtaining information about a corporation and accessing all open source data available. It can also feed you information to use in other applications.

Many websites offer advice on "google hacking," explaining how to find companies using the best search techniques that genuinely yield valuable results. For example, you can add a filetype to the end of your search to retrieve all relevant PDFs and XLS files that are related to a company and are available online.

Even while receiving a pdf or xls file from the business might not seem like much, the information it contains could be quite beneficial. Remember the phases that lie ahead: if malware is put to a company's PDF and it is returned to the organization in a phishing assault, owning that document might quickly turn into a weapon.

Social Networks

Social media is a veritable informational gold mine and an excellent platform for spear phishing attacks against individual targets within the targeted organization.

With the availability of social media sites like Facebook, LinkedIn, Twitter, Pinterest, Tumblr, and many more, all it takes to launch a successful attack is a small amount of personal information about the target, such as the name of the nail salon they frequent. This information can be used to create an email that appears authentic and offers a manicure, but with a malicious link added.

The following are more details you can get from these websites:

Facebook: home addresses, family members, and birthdays

Linkdin: Work experience and qualifications

Twitter — Diligent (?) individual opinions

Google+ — Lifestyle and social network

The internet is a tremendous resource for information on this technique, and there are some excellent publications that concentrate only on this exploit. This tool is such a vast topic.

It's time to put all of this knowledge together in order to pass the test now that we have covered a few starting strategies and resources.

By now, you ought to have gathered a tonne of data, including

Names

Numbers to call

Email addresses

Goal systems

Rough target network strength: The target system's network's "thickness" is determined by the TTL test's duration.

addresses of servers

Addresses of mail servers

Valid documents

With the use of this information, you can create phishing and vishing attacks that look more authentic by using real staff names and mimicking the firm email format.

This is the first installment of the penetration testing basics series, and hopefully you learned some useful stuff from it. As I mentioned at the beginning, this will be a very informal, brief, and to-the-point series that won't make you an expert, but it will provide you with the general overview you need to know where to start.

Coming soon Part 2: Scanning and Enumeration