PTES: Intelligence Gathering

Contents
1
General
1.1
Background Concepts
1.1.1
Level 1 Information Gathering
1.1.2
Level 2 Information Gathering
1.1.3
Level 3 Information Gathering
2
Intelligence Gathering
2.1
What it is
2.2
Why do it
2.3
What is it not
3
Target Selection
3.1
Identification and Naming of Target
3.2
Consider any Rules of Engagement limitations
3.3
Consider time length for test
3.4
Consider end goal of the test
4
OSINT
4.1
Corporate
4.1.1
Physical
4.1.1.1
Locations (L1)
4.1.1.2
Pervasiveness (L1)
4.1.1.3
Relationships (L1)
4.1.2
Logical
4.1.3
Org Chart (L1)
4.1.4
Electronic
4.1.4.1
Document Metadata (L1/L2)
4.1.4.2
Marketing Communications (L1/L2)
4.1.5
Infrastructure Assets
4.1.5.1
Network blocks owned (L1)
4.1.5.2
Email addresses (L1)
4.1.5.3
External infrastructure profile (L1)
4.1.5.4
Technologies used (L1/L2)
4.1.5.5
Purchase agreements (L1/L2/L3)
4.1.5.6
Remote access (L1/L2)
4.1.5.7
Application usage (L1/L2)
4.1.5.8
Defense technologies (L1/L2/L3)
4.1.5.8.1
Passive fingerprinting
4.1.5.8.2
Active fingerprinting
4.1.5.9
Human capability (L1/L2/L3)
4.1.6
Financial
4.1.6.1
Reporting (L1/L2)
4.1.6.2
Market analysis (L1/L2/L3)
4.1.6.2.1
Trade capital
4.1.6.2.2
Value history
4.1.6.2.3
EDGAR (SEC)
4.2
Individual
4.2.1
Employee
4.2.1.1
History
4.2.1.2
Social Network (SocNet) Profile
4.2.1.3
Internet Presence
4.2.1.4
Physical Location
4.2.1.5
Mobile Footprint
4.2.1.6
"For Pay" Information
5
Covert Gathering
5.1
Corporate
5.1.1
On-Location Gathering
5.1.2
Offsite Gathering
5.2
HUMINT
5.2.1
Results
6
Footprinting
6.1
External Footprinting
6.1.1
Identify Customer External Ranges
6.1.2
Passive Reconnaissance
6.1.2.1
WHOIS Lookups
6.1.2.2
BGP looking glasses
6.1.3
Active Footprinting
6.1.3.1
Port Scanning
6.1.3.2
Banner Grabbing
6.1.3.3
SNMP Sweeps
6.1.3.4
Zone Transfers
6.1.3.5
SMTP Bounce Back
6.1.3.6
DNS Discovery
6.1.3.7
Forward/Reverse DNS
6.1.3.8
DNS Bruteforce
6.1.3.9
Web Application Discovery
6.1.3.10
Virtual Host Detection & Enumeration
6.1.4
Establish External Target List
6.1.4.1
Mapping versions
6.1.4.2
Identifying patch levels
6.1.4.3
Looking for weak web applications
6.1.4.4
Identify lockout threshold
6.2
Internal Footprinting
6.2.1
Passive Reconnaissance
6.2.2
Identify Customer Internal Ranges
6.2.3
Active Reconnaissance
7
Identify Protection Mechanisms
7.1
Network Based Protections
7.2
Host Based Protections
7.3
Application Level Protections
7.4
Storage Protections
7.5
User Protections
General
This section defines the Intelligence Gathering activities of a penetration test. The purpose of this document is to provide a standard designed specifically for the pentester performing reconnaissance against a target (typically corporate, military, or related). The document details the thought process and goals of pentesting reconnaissance, and when used properly, helps the reader to produce a highly strategic plan for attacking a target.
Background Concepts
Levels are an important concept for this document and for PTES as a whole. It’s a maturity model of sorts for pentesting. Defining levels allows us to clarify the expected output and activities within certain real-world constraints such as time, effort, access to information, etc.
The Intelligence Gathering levels are currently split into three categories, and a typical example is given for each one. These should guide the adding of techniques in the document below. For example, an intensive activity such as creating a facebook profile and analyzing the target’s social network is appropriate in more advanced cases, and should be labeled with the appropriate level. See the mindmap below for examples.
Level 1 Information Gathering
(think: Compliance Driven) Mainly a click-button information gathering process. This level of information can be obtained almost entirely by automated tools. Bare minimum to say you did IG for a PT.
Acme Corporation is required to be compliant with PCI / FISMA / HIPAA. A Level 1 information gathering effort should be appropriate to meet the compliance requirement.
Level 2 Information Gathering
(think: Best Practice) This level can be created using automated tools from level 1 and some manual analysis. A good understanding of the business, including information such as physical location, business relationships, org chart, etc.
Widgets Inc is required to be in compliance with PCI, but is interested in their long term security strategy, and is acquiring several smaller widget manufacturers. A Level 2 information gathering effort should be appropriate to meet their needs.
Level 3 Information Gathering
(think: State Sponsored) More advanced pentest, Redteam, full-scope.  All the info from level 1 and level 2 along with a lot of manual analysis.  Think cultivating relationships on SocNet, heavy analysis, deep understanding of business relationships, most likely a large number of hours to accomplish the gathering and correlation.
An Army Red Team is tasked to analyze and attack a segment of the Army’s network in a foreign country to find weaknesses that could be exploited by a foreign national. A level 3 information gathering effort would be appropriate in this case.
Intelligence Gathering
What it is
Intelligence Gathering is performing reconnaissance against a target to gather as much information as possible to be utilized when penetrating the target during the vulnerability assessment and exploitation phases. The more information you are able to gather during this phase, the more vectors of attack you may be able to use in the future.
Open source intelligence (OSINT) is a form of intelligence collection management that involves finding, selecting, and acquiring information from publicly available sources and analyzing it to produce actionable intelligence.
[1]
Why do it
We perform Open Source Intelligence gathering to determine various entry points into an organization. These entry points can be physical, electronic, and/or human.  Many companies fail to take into account what information about themselves they place in public and how this information can be used by a determined attacker. On top of that many employees fail to take into account what information they place about themselves in public and how that information can be used to to attack them or their employer.
What is it not
OSINT may not be accurate or timely. The information sources may be deliberately/accidentally manipulated to reflect erroneous data, information may become obsolete as time passes, or simply be incomplete.
It does not encompass dumpster-diving or any methods of retrieving company information off of physical items found on-premises.
Target Selection
Identification and Naming of Target
When approaching a target organization it is important to understand that a company may have a number of different Top Level Domains (TDLs) and auxiliary businesses.  While this information should have been discovered during the scoping phase it is not all that unusual to identify additional servers domains and companies that may not have been part of