Information Gathering: Computer Security Lectures 2014/15 S1
Channel: Z. Cliffe Schreuders
Date: 24/12/2014

This video is part of the computer/information/cyber security and ethical hacking lecture series; by Z. Cliffe Schreuders at Leeds Beckett University. Laboratory work sheets, slides, and other open educational resources are available at http://z.cliffe.schreuders.org. 

The slides themselves are creative commons licensed CC-BY-SA, and images used are licensed as individually attributed.

Topics covered in this lecture include:
Steps of an attack
Information gathering
(this topic)
Exploitation
Post-exploitation
Passive and active techniques
Steps of information gathering
Footprinting: mostly passive identification of network ranges and information about the target organisation
Scanning: active phase, involving identifying IP addresses, ports, and services
Enumeration: querying services for more information
IP addresses
Domain Name System (DNS)
Commands: dig, nslookup, host
Reverse lookup
DNS record types
A : IP address (IPv4)
AAAA : IP address (IPv6)
CNAME: alias of a name to another
MX : mail server
NS : authoritative name server for the DNS zone
SOA : authoritative information about a DNS zone (name server, admin email, etc)
DNS zone transfer
Whois
Regional internet registries
Whois program
TCP Whois protocol (TCP port 43)
Whois websites also provide access to the directory
Whois on an IP address
IP ranges
Subdomains
Brute-forcing subdomains
Tools for automating DNS footprinting: Dnsmap, Fierce, Dnsenum, Dnsrecon
Scanning
To identify IP addresses, ports, and services
NMap
Ping sweep
Nmap host discovery
MAC address (typically unique to NIC)
Important port numbers
Port scan
TCP three way handshake
SYN port scan
Nmap port scan
Banner grabbing
Service identification
Amap
Nmap -sV
OS identification
Scanning the ENTIRE (IPv4) Internet
Zmap: The Internet Scanner
Conclusion