Hack Like a Pro: How to Conduct Passive Reconnaissance of a Potential Target « Null Byte :: WonderHowTo

Welcome back, my novice hackers!Most ofmy tutorialsup until this point have addressed how to exploit a target assuming that we already know some basic information about their system. These include their IP address, operating system, open ports, services running, and so on.Several of you have written me asking how to find this information, so for the next few guides here inNull Byte, I'll be covering reconnaissance. In other words, how to get the information needed to hack your target system.Why Passive Recon?Reconnaissance can be divided into at least two categories, active and passive.Active reconnaissancerequires that you interact with the target computer system to gain information about it. Although this can be very useful and accurate, it risks detection. If you're detected doing reconnaissance on a system, the system admin may choose to block your IP address and you'll leave a trail to your subsequent activity.If possible, we would prefer to gather the essential information without ever interacting with the system, thus leaving no trail to trace back to us. That's whatpassive reconnaissanceis.Although there are a number of ways to conduct passive recon, one of the best ways is to use a website likeNetcraft.Step 1: Navigate a Browser to NetcraftLet's open a browser and navigate to theNetcraftwebsite. We should see a webpage that looks like this.Netcraft is a UK company that tracks virtually every website on the planet. From this data, they're able to calculate market share for web servers, uptime, etc., becoming one of the leading authorities for this type of information. They also offer some security services such an anti-phishing extension and phishing alerts.Another service that Netcraft offers is data about nearly every website. This data can be extremely valuable to the hacker. Notice on the right side of the webpage, the area that asks "What's that site running?"We can simply type in a domain name and hit enter.Step 2: Search a DomainAs we can see in the screenshot below, We simply typed in a domain and Netcraft returns results for the domain. Notice that in this case, it returned two sites.Let's click on the report of the second one.Step 3: Open the Site ReportNow we can open the site report and get some critical information about this site. We can see at the top of this report, such information as site rank, primary language, IP address, and nameserver.If we scroll down a bit, we can get some excellent information that would be useful to a potential attacker.We can see under the heading "Hosting History" the netblock owner, IP address(es), operating system, web server, and when the server was last changed. All of this can be useful to the hacker, including the date last changed. This date generally represents the date the system was last rebooted or updated.In the case above, we can see it was last updated Sept. 28, 2007. This would imply that any security OS patches that have been supplied in the interim have NOT been applied to this system. As a hacker, this is juicy information as it tells us that any vulnerabilities to this system that have been found since Sept. 28, 2007 are still available on this system as no vulnerability patches have been applied.Step 4: Site TechnologyWhen we scroll down a bit further, we come to a section titled "Site Technology". Here we get a rundown on the technology the site's running.This listing provides us with information of what technologies the site is running and from here the hacker can seek out vulnerabilities in these named technologies. This is a boon for the hacker as they don't have to guess what technologies are behind the website. As every hack is specific to a technology, knowing what technologies they are running makes it easier for the hacker to find the appropriate hack.It's important to note here that Netcraft data is not foolproof. I would give it an 80-85% probability of being correct, and that's high enough to garner valuable recon info on a website.In my coming coming articles, we will look at additional techniques to scan and do recon on potential targets. Until then, feel free to ask questions on this below, or head theNull Byte forumfor any questions off topic.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCamouflaged soldierandBinoculars soldierphotos via ShutterstockRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHack Like a Pro:The Hacker MethodologyHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHow To:Advanced Penetration Testing - Part 1 (Introduction)How To:The Five Phases of HackingHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Hack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:Abusing DNS for ReconnaissanceVideo:How to Use Maltego to Research & Mine Data Like an AnalystMac for Hackers:How to Organize Your Tools by Pentest StagesHow To:Probe Websites for Vulnerabilities More Easily with the TIDoS FrameworkHack Like a Pro:How to Conduct Active Reconnaissance on Your Target with hping3Recon:How to Research a Person or Organization Using the Operative FrameworkHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Conduct Recon on a Web Target with Python ToolsHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)How To:Gathering Sensitive Information: Basics & Fundamentals of DoXingHow To:Change Resolution & Bit Rate in Filmic Pro for High-Quality Video Up to 4K at 100 MbpsNews:AR-Enabled Moon Model Shoots Past Crowdfunding GoalHack Like a Pro:How to Crack Private & Public SNMP Passwords Using OnesixtyoneHow To:Change Your Step Count Goal in Samsung HealthHow To:Tactical Nmap for Beginner Network ReconnaissanceHow To:Earn the 'Passive Aggressive' Achievement in RageHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapNews:Police Admit To Drugging Occupy Wall Street Protesters; Suspend ProgramNews:What Hand Do I Read, And Why ?Vaccine bombshell:Baby monkeys develop autism after routine CDC vaccinationsNews:Indie and Mainstream Online Games Shut Down by LulzSecNational Ignition Facility:Big, Giant Lasers of Doom... Or Endless Energy?