-: Passive reconnaissance.
So, in the past, we've talked
about the active reconnaissance,
where we actually reach out and touch a machine
and do things like port scans or service scans.
Now we're gonna talk about passive reconnaissance.
And passive reconnaissance
is much more difficult than active reconnaissance,
because it relies on things like logs and other data
and maybe packet captures
to get the data you need to do the reconnaissance.
This data you receive may be out of date.
For instance, if you show up on an instant response,
those log files they hand you may be from a month ago.
It depends on what they have available.
And this is often used during your incident responses,
which is why passive is important.
Why do we use passive instead of active?
Well, if you think you have an advanced persistent threat
or some hacker on your network,
you don't wanna go in there and start lighting off
scanning tools that don't look normal,
because that can send a key to the attacker
that you know they're there and you're looking for them.
So, instead, you would do things like passive taps,
using something like Wireshark
that does packet capture and analysis,
and looking at log data through the CIS log server
to try to correlate those issues
and do it passively,
where the bad guy can't know you're there
until you can get into a position to clean the bad guy out.
Now, one of the most common ways to do this
is by looking at log and configuration files.
The local system configuration data and your log files
can be used to build a network map.
Because if you look at log files,
they would have things like your DHCP scope, right?
If you look at the DHCP server logs,
it's gonna tell you which machines
have which IPs based on their MAC addresses.
This is all information that you can correlate
to start building that network picture
without having to go and set ping scans
off around the entire network.
Some other tools are out there
that will actually help you parse configuration files
into a usable topology.
There's a couple of tools out here
that you could take your Cisco configuration files,
dump them into this tool, hit a go button,
and it will take them and build a network topology for you,
and, that way, you can know all
the external connections to your network.
These are helpful tools that you should be looking for,
and, again, these tools change all the time,
so we're not gonna talk about specific tools in this course.
But just knowing that these type of tools exist
and you can look for them
and figure out which commercial provider
is gonna provide the best service for you.
And much of this, though, is still gonna be done manually.
You are gonna have some analyst who's looking at log files
and correlating three and four and five
different log files together to try to figure it out.
Now, if you have a seam system,
where you integrate all your log files into one,
this is gonna make a little easier for your analyst as well.
But, again, some places you go don't have those systems
and you're gonna be relying on what tools they have
when you go in there to conduct the instant response
initially until your tool kit can arrive.