- So, John, what is reconnaissance?
- So, reconnaissance is the very first step
in the entire engagement.
It's really, where you're trying to map
out the entire network, to find out as much as you can
about the environment, before you actually
launch all of you attacks against it,
so, there's really two types.
There's passive and active reconnaissance.
- So, if there are two types of reconnaissance,
what is actually, passive reconnaissance?
- So, passive reconnaissance is
all of your research, that you're doing,
without actually, sending any information
to their target network.
So, you're not scanning their network,
you're not performing phishing,
you're not doing any vulnerability scans,
or port scans, or anything.
You're just researching their environment,
looking up Google searches,
looking up, we'll show you different types of
research that you can actually do,
without actually sending information, to that organization
and you can actually find out a surprising
amount of information about them
without actually tripping off any alarms.
You imagine, if you're doing public searches,
you're not gonna trip off an intrusion detection alarm
or antivirus alarm and they won't know
that you're doing all this research,
but what's really amazing about reconnaissance,
is that, there's so much information
that you can find out about an organization,
without actually attacking it
you can find out open ports on their external network,
you can find out their employees,
you can often find out password that they have,
from public breaches
and all this information you can do,
without tripping off any alarms
and it's often the most overlooked
and skipped part of the entire hacking engagement.
So, Omar, what is wrong
with actually skipping the reconnaissance phase?
- There's a few drawbacks, if you actually skip this phase,
so, especially, the non-active or the passive
reconnaissance phase, so the first one,
is actually like a miss vulnerability,
so, things that you should actually be paying attention to.
Second, is that you can attack the wrong system
and actually, whenever, we talked about
scoping in lesson one,
this is actually when it becomes a little bit more relevant
so, make sure that you actually have a clear scope
of what systems are, of course, within scope
of your testing and what are not
and that's actually on of the most common mistakes
that a lot of people actually do.
In some cases, actually this
can lead into legal problems.
The other one is actually shunning, and also alerts,
so, these are some examples, of course,
there are several of them out there,
but that's why reconnaissance is a really crucial phase
and one of the first ones you do.
So, John, has actually reconnaissance helped you
in a penetration testing engagement?
- Yeah, reconnaissance has really
helped on penetration tests.
Through various penetration tests,
when we performed the reconnaissance phase,
we have found new subnets that weren't listed
and we brought it back to the client
and said, "Are these actually subnets that you own?"
and often times, they'll say,
"Oh, we didn't even know those subnets existed,
"but those are actual ones that we own."
and we've included that in the tests
and those are usually the most vulnerable systems
because they're not being monitored,
they're not on their network diagrams
or one particular case, that I'd like to talk about,
is where, we were working
with a large healthcare environment
where they told us, that their most sensitive system
was this one particular box
and they told us they have a large network,
but we should focus all of our attacks on this one machine.
So, when you first looked at that machine,
that machine was really locked down.
They had all their attention on that,
so, after we looked at that for a little bit,
we performed our usual reconnaissance
and through the reconnaissance we found out that
there were various test machines on the network
that they completely forgot about,
that were all in there,
so, once we targeted those machines,
which were not really monitored by them,
we found them completely through passive reconnaissance,
so, we were looking up what systems they had connected
and we found several systems call test systems
and their actual name was test system
and so, when we targeted those,
we found out, those were actually very easy to get into.
Once, we got into those, we were able to actually get into
the main systems that they were talking about,
so we couldn't actually access the main systems
directly, but through passive reconnaissance
we found several test systems
and we were able to get into the central systems that way.
- Cool.