In this lesson,
we will explore the world
of reconnaissance in penetration testing.
Reconnaissance is the initial phase
where the attacker gathers as much information as possible
about the target system.
This information is then used to better plan the attack
and increase its success rate.
So what is reconnaissance?
Reconnaissance is often compared to
a thief casing a home that they plan to rob.
The thief will observe the house,
note when the occupants come and go,
find out if there are any security systems
and things like that.
Similarly, in penetration tests,
reconnaissance involves gathering information
about the target systems such as IP addresses,
domain details, mail servers,
and any potential security or detection systems
that the organization may have in place.
This information can then be used
to identify potential vulnerabilities
that might be exploited by an attacker.
Reconnaissance is a crucial step
in a penetration testing process.
The information gathered during reconnaissance
can help identify potential vulnerabilities
in the target system.
Also, the more information
the attacker has about the target,
the better they can plan their attack,
which can lead to a higher chance of success.
By identifying potential vulnerabilities
and planning the attack carefully,
the attacker can reduce the risk of being detected,
and ultimately, failing in their attempts
to exploit the system.
Reconnaissance is divided into two different types,
active reconnaissance and passive reconnaissance.
In active reconnaissance,
the attacker engages with the target system directly.
They might ping the system, scan ports,
or try to establish a connection.
While this can yield a lot of information,
it also carries a higher risk of detection.
For example, an attacker might use a tool like Nmap
to scan for open ports on the target system
as part of an active reconnaissance technique,
but the system defenders will see the port scanning occur,
and this could identify where the attacker is coming from
based off these port scans.
In passive reconnaissance,
the attacker gathers information
without directly engaging with the target system.
This might involve researching the target online,
using open-source intelligence,
observing network traffic,
or using public databases.
This approach is less likely to be detected,
but can yield a lot less information.
For example, an attacker might use a tool like WHOIS
to gather information about the points of contacts
for a particular domain name
to use as part of their upcoming phishing campaign.
The amount of reconnaissance
and even the need for reconnaissance
does vary based off
the type of penetration test being planned
and the environment that the test will incur inside of.
Generally, we classify the environment
as either a known environment,
a partially known environment,
or an unknown environment.
In a known environment penetration test,
the penetration testers
are provided with detailed information
about the target infrastructure
by the organization before the test commences.
This may include things like network diagrams,
IP addresses, application details,
operating system versions,
and even credentials.
The objective in a known environment test
is not to identify unknown assets,
but rather to thoroughly evaluate
the vulnerabilities and weaknesses
in the already known assets,
while understanding how they can be exploited,
and what potential damages can arise from them.
This type of testing
resembles the insider threat scenario
where an employee or an insider with significant knowledge
about the organization's IT environment poses a threat.
So in a known environment,
the attacker already has a lot of information
about the target and in some cases,
they may not really need to conduct
any type of reconnaissance
since they may already have all the details
they need to begin their attack.
A partially known environment penetration test,
on the other hand,
is a hybrid approach where testers are provided with
limited information about the targeted infrastructure.
The penetration tester
might know some aspects of the system
such as certain IP ranges, or application endpoints,
but other information is withheld.
The aim in a partially known environment test
is to simulate a scenario.
While the attacker might have gained some insider knowledge,
perhaps attained from previous breaches
or insider information,
but still needs to discover
and navigate the broader environment.
This test not only identifies vulnerabilities
and known assets,
but also uncovers hidden or forgotten assets
that might be vulnerable.
In a partially known environment,
reconnaissance is important
so that the attacker can fill in the gaps of their knowledge
by finding out what software is being used,
what versions are installed,
or what configurations are in place.
In an unknown environment penetration test,
penetration testers are given
minimal to no information about the target system.
The attacker might only be given the company's name
or web domain as a starting point.
Here, their objective is to simulate
a real-world external attacker,
where the attacker knows little to nothing about the target,
but aims to find entry points and vulnerabilities.
This type of testing
typically starts with extensive reconnaissance
to discover assets related to the target,
and then moves to identify vulnerabilities
and potential exploit paths.
Unknown environment tests are comprehensive
and provide insights
into how an organization's external security posture
appears to the outside world.
So remember, reconnaissance is a critical first step
in penetration testing and involves
gathering information about the target system
or identifying potential vulnerabilities
and plan the attack.
There are two types of reconnaissance, active and passive.
Active reconnaissance involves
directly interacting with the target system
to gather information,
while passive reconnaissance
collects information without directly engaging
or alerting the target system.
We also have three different types of environments
used in penetration testing, a known environment,
a partially known environment,
and an unknown environment.
A known environment penetration test
provides the penetration testers
with detailed information about the target infrastructure
before the test commences.
A partially known environment penetration test
is a hybrid approach where testers are provided
with limited information about the target infrastructure.
An unknown environment penetration test
gives the tester minimal to no information
about the target system
before the engagement begins.
The amount of reconnaissance needed for each engagement
will vary based on
the type of penetration test being conducted,
but regardless, it's still always
an important part of the penetration testing process.