- [Instructor] Footprinting is basically the first step
in the hacking methodology.
It's all about gathering information.
A lot of people refer to footprinting
as reconnaissance or recon.
So if I start mentioning anything
about reconnaissance or recon,
you know that footprinting is part of that, right?
Now, most organizations
share a lot of information online, right?
And a lot of attackers take advantage of that information
and public records
and also information from things like DNS, WHOIS,
and many other things that we're gonna be covering
in the next few lessons
that an attacker can take advantage of
to obtain somewhat of an idea about their target, right?
That's what we call open source intelligence,
which is basically looking at public records,
again, readily available information,
information from social media sites,
many different channels from the company's website,
information about acquisitions
that potentially that company has been doing,
so acquiring other companies
or that they actually have been acquired
by a parent company, right?
So we're gonna go through a lot of different steps
and methodologies throughout the next few lessons
related to this.
Now, one thing that I want to introduce
related to reconnaissance is the MITRE ATT&CK framework.
The MITRE ATT&CK framework is basically a set of matrices
or in this case,
I'm actually showing the attack matrix for Enterprise,
that describes the tactics and techniques from attackers.
And by the way, every time that you see TTPs
referred to on the internet, on documentation and so on,
that stands for tactics, techniques, and procedures.
And those are the adversarial tactics and techniques,
and of course, procedures that are used
to perform different things in the life cycle of an attack.
And talking about the life cycle of an attack,
what you see on the top here are all the different tactics
and tactics actually have different techniques
and sub-techniques.
And what you're seeing here is basically the day in the life
of an attack or the life cycle of an attack
from reconnaissance,
which is what we are actually talking about here right now,
all the way to the impact to the organization
and of course, everything in between from initial access
to execution of exploits and minimal malware,
maintaining persistence, doing post-exploitation attacks
and different tactics and techniques
like previous escalation, evasion, credential access,
discovery, lateral movement, collection,
command and control, and exfiltration.
Even though I went very fast in those different terms,
we will cover each of these elements of an attack
definitely in very detail throughout the next lessons.
Now, talking about reconnaissance,
which is what we're talking about here right now,
if I click on that, the cool thing about the MITRE framework
and the reason that I'm mentioning it here
is because they provide a very detailed documentation
of each of those tactics and techniques,
as well as each of the sub-techniques
for each of the elements of the attack, right?
Now, in the case of reconnaissance, as you see here,
things like active scanning, which, by the way,
we will cover in detail later in the presentation,
or gathering information about a victim,
including emails, credentials, employee names,
and many other things that remember,
this is gathering information both passively,
so passive reconnaissance, or active reconnaissance.
And the main difference is of course,
in active reconnaissance,
you're basically sending IP packets to your victim, right?
So I put here V for victim.
So in this case, of course,
you're interacting with their systems.
Now, in passive reconnaissance,
you're actually going over what we briefly mentioned before,
open source intelligence, public records, DNS information,
even certificate information,
information about the certificates that have been issued
for the web services of that company.
It can be going through social media sites,
going through acquisition and integration documents
that may be public,
also public financial information that you will get,
especially if the company or the organization
is a publicly traded company,
and many, many, many other sources, right?
And we will go over in detail about those sources,
the methodologies, and the tools that will help you automate
the reconnaissance process, right?
But again, if I wanted to actually summarize it,
this resource from attack is invaluable.
So I strongly recommend for you to become familiar,
not only because of reconnaissance,
but throughout the attack life cycle,
with the tactics and techniques that are in the attack
and framework for MITRE
and specifically because these are real life attacks
and real life techniques that we have seen in the industry.
As a matter of fact,
I have contributed to the MITRE ATT&CK framework.
That's why I'm a little bit of a fan here as well.
And specifically in the network attacks
and some observables and some documentation
that we actually have for the matrix for network.
And we will go over a lot of those details,
again, later in the presentation.