Unknown user at 23:35, 28 October 2024

2024-10-28T23:35:36Z

← Older revision		Revision as of 23:35, 28 October 2024
Line 8:		Line 8:
	* Run the following command:		* Run the following command:

	whois example.com		whois example.com

	'''Example:'''		'''Example:'''
Line 19:		Line 19:
	* Use `dig` to get DNS information.		* Use `dig` to get DNS information.

	dig example.com		dig example.com

	* For more in-depth DNS Enumeration, use `dnsenum`:		* For more in-depth DNS Enumeration, use `dnsenum`:

	dnsenum example.com		dnsenum example.com

	'''Example:'''		'''Example:'''
Line 34:		Line 34:
	* Run `theHarvester` to find information related to a specific domain.		* Run `theHarvester` to find information related to a specific domain.

	theHarvester -d example.com -b anubis		theHarvester -d example.com -b anubis
	theHarvester -d kali.org -l 500 -b duckduckgo		theHarvester -d kali.org -l 500 -b duckduckgo

	You can use sources like Bing, fullhunt, hunternow, and others, such as,		You can use sources like Bing, fullhunt, hunternow, and others, such as,
Line 69:		Line 69:
	* Shodan:		* Shodan:

	shodan host <IP_address>		shodan host <IP_address>

	* Censys:		* Censys:
Line 93:		Line 93:
	* Run the following command to identify the technology behind a website.		* Run the following command to identify the technology behind a website.

	whatweb example.com		whatweb example.com

	'''Example:'''		'''Example:'''

Unknown user: Created page with "For hands-on ethical hacking using Kali Linux 2024.3, we can passively collect target information as part of the reconnaissance stage. Passive information gathering is the pro..."

2024-10-28T23:34:54Z

Created page with "For hands-on ethical hacking using Kali Linux 2024.3, we can passively collect target information as part of the reconnaissance stage. Passive information gathering is the pro..."

New page

For hands-on ethical hacking using Kali Linux 2024.3, we can passively collect target information as part of the reconnaissance stage. Passive information gathering is the process by which we collect data without directly interacting with the target. Here are the steps and examples of tools that can be used:

==Using WHOIS==
WHOIS is a service that allows us to obtain domain-related information such as registrant, contact details, and expiration date.

'''Steps:'''
* Open a terminal in Kali Linux.
* Run the following command:

whois example.com

'''Example:'''
If we run `whois kali.org`, we can find domain registration information, DNS servers, registration dates, and others.

==DNS Enumeration with `dig` and `dnsenum`==
DNS (Domain Name System) information is very important in the information gathering process. We can check the DNS server, mail server, and other records of the target.

'''Steps:'''
* Use `dig` to get DNS information.

dig example.com

* For more in-depth DNS Enumeration, use `dnsenum`:

dnsenum example.com

'''Example:'''
Using `dig kali.org` can return the IP address of the domain and additional information such as mail exchange (MX) and name server (NS).

==Using `theHarvester`==
'theHarvester` is a very useful tool for collecting emails, subdomains, hosts, and usernames from open sources such as search engines.

'''Steps:'''
* Run `theHarvester` to find information related to a specific domain.

theHarvester -d example.com -b anubis
theHarvester -d kali.org -l 500 -b duckduckgo

You can use sources like Bing, fullhunt, hunternow, and others, such as,

* bevigil - Free upto 50 queries. Pricing can be found here: https://bevigil.com/pricing/osint
* binaryedge - $10/month
* bing
* bufferoverun - uses the free API
* censys - API keys are required and can be retrieved from your Censys account.
* criminalip
* fullhunt
* github
* hunter - limited to 10 on the free plan, so you will need to do -l 10 switch
* hunterhow
* intelx
* netlas - $
* onyphe -$
* pentestTools - $
* projecDiscovery - invite only for now
* rocketreach - $
* securityTrails
* shodan - $
* tomba - Free up to 50 searches.
* zoomeye

'''Example:'''
If you run `theHarvester -d kali.org -b zoomeye`, you can get a list of emails and subdomains registered to that domain based on Google results.

==Censys or Shodan for IoT Information==
Shodan or Censys can be used to search for internet-connected devices that have vulnerabilities. This is a way to gather more information without interacting directly with the target.

'''Steps:'''
* Shodan:

shodan host <IP_address>

* Censys:
You must register first, then use the Censys API to search for target devices.

'''Example:'''
If you use Shodan to look up the IP address of a target, you may be able to see IoT devices or services running on the target.

==Social Media Gathering with `Maltego`==
Maltego is a powerful tool for gathering information from social media. You can use it to identify relationships between accounts, locations, and other data.

'''Steps:'''
* Launch Maltego and select the type of entity you want to search for (e.g., domain names or social media accounts).
* Perform a transformation to see the relationships and information available.

'''Example:'''
Using Maltego to analyze someone's social media profile can provide data about their personal and professional connections that may be useful in the attack process.

==Website Metadata with `whatweb`==
`whatweb` allows you to gather information about the technologies used by a website (CMS, framework, server, etc.).

'''Steps:'''
* Run the following command to identify the technology behind a website.

whatweb example.com

'''Example:'''
Using `whatweb` on a target site like `example.com` may reveal that the site uses WordPress, Apache as its web server, and various plugins that could be points of vulnerability.

==Summary==
Passive information gathering is an important step in ethical hacking because it allows us to understand the target without leaving a trace. Tools like `whois`, `dig`, `theHarvester`, Shodan, and Maltego are very effective to use on Kali Linux 2024.3 to gather data before moving on to the exploitation stage.

==Interesting Links==

* [[Ethical Hacking]]

Hands-on: Passive Target Information Gathering (en) - Revision history

Unknown user at 23:35, 28 October 2024

Unknown user: Created page with "For hands-on ethical hacking using Kali Linux 2024.3, we can passively collect target information as part of the reconnaissance stage. Passive information gathering is the pro..."