Footprinting, Reconnaissance, and Scanning
- “Do I Know This Already?” Quiz
- Footprinting
- Scanning
- Summary
- Exam Preparation Tasks
- Review All Key Topics
- Define Key Terms
- Exercises
- Review Questions
- Suggested Reading and Resources
In this sample chapter from CEH Certified Ethical Hacker Cert Guide, 4th Edition, you will review a number of ways individuals can attempt to passively gain information about an organization and interactive scanning techniques.
This chapter is from the book
This chapter is from the book
This chapter is from the book
This chapter covers the following topics:
Footprinting: The process of accumulating data about a specific network environment, usually for the purpose of completing the footprinting process, mapping the attack surface, and finding ways to intrude into the environment. Fingerprinting can be categorized as either active or passive. Active fingerprinting is more accurate but also more easily detected. Passive fingerprinting is the act of identifying systems without injecting traffic or packets into the network.
Scanning: The identification of active machines that is accomplished by means of ping sweeps and port scans. Both aid in an analysis of understanding whether the machine is actively connected to the network and reachable. After all details of a network and its operations have been recorded, the attacker can then identify vulnerabilities that could possibly allow access or act as an entry point.
This chapter introduces you to two of the most important pre-attack phases: footprinting and scanning. Although these steps don’t constitute breaking in, they occur at the point at which a hacker or ethical hacker will start to get information. The goal here is to discover what a hacker or other malicious user can uncover about the organization, its technical infrastructure, locations, employees, policies, security stance, and financial situation. Just as most hardened criminals don’t rob a jewelry store without preplanning, elite hackers and cybercriminals won’t attack a network before they understand what they are up against. Even script kiddies will do some pre-attack reconnaissance as they look for a target of opportunity. For example, think of how a burglar walks around a building to look for entry points.
This chapter begins by looking at a number of general mechanisms individuals can attempt to passively gain information about an organization without alerting the organization. This chapter also discusses interactive scanning techniques and reviews their benefits. Note in this context, the goal of scanning is to discover open ports and applications. This chapter concludes with attack surface mapping techniques.
“Do I Know This Already?” Quiz
The “Do I Know This Already?” quiz enables you to assess whether you should read this entire chapter thoroughly or jump to the “Exam Preparation Tasks” section. If you are in doubt about your answers to these questions or your own assessment of your knowledge of the topics, read the entire chapter. Table 3-1 lists the major headings in this chapter and their corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Review Questions.”
Table 3-1 “Do I Know This Already?” Section-to-Question Mapping
Foundation Topics Section |
Questions |
|---|---|
Footprinting |
1–8 |
Scanning |
9–15 |
Where should an ethical hacker start the information-gathering process?
Interview with company
Dumpster diving
Company’s website
Interview with employees
What common Windows and Linux tool is used for port scanning?
Hping
Amap
Nmap
SuperScan
What does the Nmap -sT switch do?
UDP scan
ICMP scan
TCP full connect scan
TCP ACK scan
Which of the following would be considered outside the scope of footprinting and information gathering?
Finding physical addresses
Attacking targets
Identifying potential targets
Reviewing a company website
During a security assessment, you are asked to help with a footprinting activity. Which of the following might be used to determine network range?
ARIN
DIG
Traceroute
Ping host
You have been asked to gather some specific information during a penetration test. The “intitle” string is used for what activity?
Traceroute
Google search
Website query
Host scanning
During a footprinting exercise, you have been asked to gather information from APNIC and LACNIC. What are these examples of?
IPv6 options
DHCP servers
DNS servers
RIRs
CNAMEs are associated with which of the following?
ARP
DNS
DHCP
Google hacking
Which of the following TCP scan types is also known as the half-open scan?
FIN scan
XMAS scan
SYN scan
Null scan
What scan is also known as a zombie scan?
IDLE scan
SYN scan
FIN scan
Stealth scan
What is the TCP port scan that is used to toggle on the FIN, URG, and PSH TCP flags?
XMAS scan
Null scan
ACK scan
None of these answers are correct
You were hired to perform penetration testing for a local school. You discovered an FTP server in the network. What type of FTP scan technique would make the scan harder to trace?
FTP bounce scan
FTP stealth SYN scan
FTP null scan
Slowloris FTP scan
Which of the following tools can be used to enumerate systems that are running NetBIOS?
Nmap
nbtscan
Metasploit
All of these answers are correct
What type of information can you obtain when successfully enumerating insecure SNMP systems?
Network interface configuration
The device hostname and current time
The device IP routing table
All of these answers are correct
What SMTP command can be used to verify whether a user’s email mailbox exists in an email server?
EXPN
VRFY
RCPT
None of these answers are correct