-: Footprinting the network.
So, one of the first and easiest steps
inside reconnaissance is to footprint your network.
And what this really means is
you're gonna create a map of the network,
the systems, and other infrastructure inside the company.
This is gonna create a mixture of information for us
using many different tools,
and then we're gonna take all of that,
as well as manual research,
and combine them together to create a network map
with the systems, the services,
and the ports that are being used.
There's guidance inside the NIST special publication
800-115, if you remember that's our
penetration testing manual.
And the Open Source Security Testing Methodology Manual,
or OSSTMM, either of those are gonna tell you
the way to do this.
But in this course, we're gonna go through
and show you the different tools
that you can use to do this footprinting as well.
The most common one is gonna be NMap,
which is a network mapping tool.
And it allows us to go through and scan the network,
determine what hosts are online,
what ports are open, and what services and versions
are even running on those hosts.
Now, this is what we call active reconnaissance.
Because I'm gonna reach out, and touch those machines.
This is gonna utilize a host of scanning tools
to gather information about the systems,
the services, and vulnerabilities in the network.
So things like NMap, and ZenMap,
things like Nessus Scanners, or Qualia Scanners,
those are all active reconnaissance tools.
This does not include the exploitation
of the vulnerabilities found though,
and that's a very important distinction.
You're only going to identify them.
So if I run NMap, and I find that there is
port 445 open and that I've done an OS detection
to figure out it was a Windows XP machine,
knowing from experience,
I know that there's probably a vulnerability out there
for the Microsoft 08-067 vulnerability,
which is a Netapi vulnerability.
I can confirm that using something like Nessus
to scan it a verify it.
But I'm not gonna exploit it yet,
because that would take me from the discovery phase,
and active reconnaissance into the exploitation,
or attack phase.
So, you have to remember that permission
needs to be sought out
before conducting active reconnaissance.
Now, why is that?
All I'm doing is scanning networks.
Well, a lot of times, your scans can set off warning bells
and sensors on the defender side,
because they'll think they're under attack,
because you're going and doing port scans against them.
You're going after them and looking at their services.
And they might think they're being attacked by mistake,
so always get permission,
and again you should always have your
get out of jail free letter,
which is your contract and your scope of work
saying you're authorized to scan those things.
Have that in your hand
before you start your active reconnaissance phase,
because that's the proper way to do things, right?
Per the NIST special publication we talked about,
800-115, that's the way to go.
Always have it in your hand.
It's your get out of jail free,
and ensure that you're within the scope of work.
That's the way you want to start your active reconnaissance,
and we'll move on from there, in the next lecture.