CMU6XX

Ethical Hacking

Session 2: Reconnaissance & Footprinting

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Differentiate between Passive and Active Reconnaissance.
  • Utilize Open Source Intelligence (OSINT) to map an organization's public footprint.
  • Understand the architecture of the Domain Name System (DNS) for footprinting.
  • Analyze HTTP headers and server responses for active discovery.
  • Identify Subdomain Takeover vulnerabilities based on dangling DNS records.

Seminar Structure (3 Hours)

Part 1: Passive Reconnaissance & OSINT (1.5 hrs)
  • Open Source Intelligence (OSINT)
  • DNS Footprinting & Shodan
  • Task 1: Advanced OSINT Profiling
Part 2: Active Discovery & Subdomains (1.5 hrs)
  • Active Reconnaissance (HTTP Headers, Banners)
  • Subdomain Enumeration
  • Task 2: Subdomain Takeover Analysis

Part 1: Passive Reconnaissance & OSINT

Duration: 1.5 Hours

Passive vs Active Reconnaissance

The first phase of a pentest is information gathering.

  • Passive Reconnaissance: Gathering data without ever interacting directly with the target's infrastructure. The target has no logs indicating you are researching them. (e.g., Google Dorking, WHOIS records).
  • Active Reconnaissance: Sending direct requests to the target's servers. Creates noise and log entries. (e.g., Port scanning, Banner grabbing).
Practical Resource: OSINT Framework

Open Source Intelligence (OSINT)

Exploiting publicly available information to profile the target.

  • Employee Profiling: LinkedIn provides exact job titles and technology stacks (e.g., "DevOps Engineer managing Kubernetes"). Useful for spear-phishing.
  • Google Dorks: Advanced search operators (e.g., site:target.com filetype:pdf "confidential") to uncover indexed files that shouldn't be public.
  • Shodan: The "search engine for hackers." Scans the entire IPv4 space and indexes open ports, banners, and vulnerable IoT devices.

DNS Footprinting

The Domain Name System (DNS) leaks massive amounts of organizational data.

  • WHOIS: Reveals domain registrars and historical administrative contacts.
  • DNS Records:
    • A / AAAA: IPv4/IPv6 addresses.
    • MX: Mail Exchanger. Reveals the email provider (e.g., Google Workspace vs O365).
    • TXT: Often contains SPF/DMARC records or verification strings for third-party services.

Introduction to Task 1

Before launching a single exploit, an attacker builds a comprehensive profile of the target entirely through public records.

We will utilize OSINT techniques to map the infrastructure of a mock target.

Task 1: Advanced OSINT Profiling

Timing: 45 minutes

Using purely passive techniques (your browser and terminal, strictly no port scanners):

  1. Access the mock target website provided on Moodle (e.g., target.local).
  2. Use nslookup or dig to query the MX and TXT records for the mock domain. Identify their simulated email provider.
  3. Construct a Google Dork designed to find exposed .env files or database backups, and discuss how attackers use them theoretically.
  4. Access the simulated Shodan environment on Moodle to search for unauthenticated instances within the lab network. Discuss the ethical implications of using real-world OSINT engines.

15 Minute Break

Please return promptly for Part 2.

Part 2: Active Discovery & Subdomains

Duration: 1.5 Hours

Active Reconnaissance

Engaging directly with the target to map the attack surface.

  • Banner Grabbing: Connecting to an open port (e.g., Telnet, Netcat) to capture the service banner, revealing the exact software version (e.g., Apache/2.4.41 (Ubuntu)).
  • HTTP Header Analysis: Inspecting response headers via curl -I to identify missing security headers (e.g., Strict-Transport-Security) or backend frameworks (e.g., X-Powered-By: PHP/7.4).

Subdomain Enumeration

The main website (www) is heavily fortified. Attackers look for forgotten development environments (e.g., dev.target.com, staging.target.com).

  • Brute Forcing: Using tools like Amass or gobuster to rapidly resolve thousands of common subdomain names against a target DNS server.
  • Certificate Transparency (CT) Logs: Every SSL certificate issued is recorded in a public CT log. Searching these logs (e.g., via crt.sh) instantly reveals all subdomains with valid TLS certificates without sending a single DNS query.

Subdomain Takeovers

A critical vulnerability resulting from poor infrastructure hygiene.

  • A company points blog.target.com via a CNAME record to a third-party service like target-blog.github.io.
  • Later, they delete their GitHub Pages site, but forget to delete the DNS CNAME record.
  • An attacker creates a new GitHub Pages site claiming the name target-blog.
  • Result: The attacker now fully controls the content displayed at blog.target.com. Huge risk for Phishing and Cookie theft.

Introduction to Task 2

Subdomain takeovers are notoriously common in large cloud environments where teams spin up and tear down services rapidly without cleaning up DNS.

We will analyze a simulated DNS infrastructure to identify a dangling record vulnerable to a takeover.

Task 2: Subdomain Takeover Analysis

Timing: 50 minutes

You have enumerated the subdomains of startup.local and discovered the following CNAME records:

  • www.startup.local → startup-main.elasticbeanstalk.com (Resolves, 200 OK)
  • support.startup.local → startup-help.zendesk.com (Resolves, 404 Not Found)
  1. Identify the vulnerable record. Explain exactly why the 404 Not Found response from the third-party provider is the critical indicator.
  2. Map the exploitation process: How would you prove impact to the client in a pentest report?

Summary & Next Steps

  • Reconnaissance dictates the success of the engagement. Time spent footprinting saves time spent exploiting.
  • Infrastructure decay (dangling DNS) is a massive blind spot for modern cloud-native organizations.
Next Week: Scanning & Enumeration (Network Topology & Services)