Footprinting
Information Technology System Management
Footprinting
• ethical hacking technique used to gather as much data as possible
about a specific targeted computer system, an infrastructure and
networks to identify opportunities to penetrate them.
• part of reconnaissance process which is used for gathering possible
information about a target computer system or network
• 2 types:
1. Active footprinting
2. Passive footprinting
Footprinting
• Footprinting is basically the first step where hacker gathers as much information as possible to
find ways to intrude into a target system or at least decide what type of attacks will be more
suitable for the target.
• During this phase, a hacker can collect the following information −
• Domain name
• IP Addresses
• Namespaces
• Employee information
• Phone numbers
• E-mails
• Job Information
• https://www.tutorialspoint.com/ethical_hacking/ethical_hacking_footprinting.htm
Active Footprinting
• What is active footprinting? Active footprinting describes the process
of using tools and techniques, like using the traceroute commands or
a ping sweep -- Internet Control Message Protocol sweep -- to
collect data about a specific target. This often triggers the target's
intrusion detection system (IDS).
Ping sweep
• In computing, a ping sweep is a method that can establish a range of
IP addresses which map to live hosts.
• The classic tool used for ping sweeps is fping,[1][2][3] which traditionally
was accompanied by gping to generate the list of hosts for large
subnets,[4] although more recent versions of fping include that
functionality.[1] Well-known tools with ping sweep capability include
nmap for Unix and Windows systems, and the Pinger software from
Rhino9 for Windows NT.[4][5] There are many other tools with this
capability, including:[2][5] Hping, IEA's aping, Simple Nomad's
ICMPEnum, SolarWind's Ping Sweep, and Foundstone's SuperScan.
There is also a ping sweep tool for Windows, Mac, Linux, Android, and
iOS called Fing made by Overlook Soft.
What is an Intrusion Detection System?
• An intrusion detection system (IDS) is a device or software
application that monitors a network for malicious activity or policy
violations.
IDS Detection Types
• There is a wide array of IDS, ranging from antivirus software to tiered
monitoring systems that follow the traffic of an entire network. The
most common classifications are:
• Network intrusion detection systems (NIDS): A system that
analyzes incoming network traffic.
• Host-based intrusion detection systems (HIDS): A system that
monitors important operating system files.
Traceroute
• Information can also be gathered using the command Tracert ("
traceroute"), which is used to trace a path between a user and
the target system on the networks. That way it becomes clear
where a request is being forwarded and through which devices.
In Linux systems, the tracepath and traceroute commands are
also available for doing traceroute operations.[9
Passive Footprinting
• What is passive footprinting?
• As the name implies, passive footprinting involves collecting data
about a specific target using innocuous methods, like performing a
Google search, looking through Archive.org, using NeoTrace,
browsing through employees' social media profiles, looking at job
sites and using Whois, a website that provides the domain names
and associated networks fora specific organization. It is a stealthier
approach to footprinting because it does not trigger the target's IDS.
• crawling websites and social media platforms, among other methods. For
example, tools like tcpdump and Wireshark can be used to capture
packets sent and received by the target system.
Crawling
• Crawling is the process of surfing the internet to get the
required information about the target. The sites surfed can
include the target's website, blogs and social networks. The
information obtained by this method will be helpful in other
methods.
WHOIS
• WHOIS[6] is a web application used to get information about the
target website, such as the administrator's e-mail address and
details about the registration. WHOIS is a very large database
and contains information of approximately all clearnet websites.
It can be searched by domain name
Search engines
• Search engines such as Google can also be used to gather
information about the target system. It depends on how well one
knows how to use search engines to collect information. If used
properly, the attacker can gather much information about a
company, its career, its policies, etc.
Negative web search
• Negative web search will reveal some other websites when
performed on the target website. Negative websites can act as
resources for insight about the flaws of the target website.[10]
• Browsing the target's websitevisiting social media profiles of
employees
• searching for the website on WHOIS
• performing a Google search
#all ways of passive Footprinting
