1
00:00:00,150 --> 00:00:00,983
In this lesson,

2
00:00:00,983 --> 00:00:02,130
we will explore the world

3
00:00:02,130 --> 00:00:04,770
of reconnaissance in penetration testing.

4
00:00:04,770 --> 00:00:06,480
Reconnaissance is the initial phase

5
00:00:06,480 --> 00:00:09,060
where the attacker gathers as much information as possible

6
00:00:09,060 --> 00:00:10,530
about the target system.

7
00:00:10,530 --> 00:00:13,530
This information is then used to better plan the attack

8
00:00:13,530 --> 00:00:15,420
and increase its success rate.

9
00:00:15,420 --> 00:00:17,370
So what is reconnaissance?

10
00:00:17,370 --> 00:00:19,290
Reconnaissance is often compared to

11
00:00:19,290 --> 00:00:22,260
a thief casing a home that they plan to rob.

12
00:00:22,260 --> 00:00:24,030
The thief will observe the house,

13
00:00:24,030 --> 00:00:26,280
note when the occupants come and go,

14
00:00:26,280 --> 00:00:28,350
find out if there are any security systems

15
00:00:28,350 --> 00:00:29,790
and things like that.

16
00:00:29,790 --> 00:00:31,800
Similarly, in penetration tests,

17
00:00:31,800 --> 00:00:33,900
reconnaissance involves gathering information

18
00:00:33,900 --> 00:00:36,900
about the target systems such as IP addresses,

19
00:00:36,900 --> 00:00:39,060
domain details, mail servers,

20
00:00:39,060 --> 00:00:41,760
and any potential security or detection systems

21
00:00:41,760 --> 00:00:44,010
that the organization may have in place.

22
00:00:44,010 --> 00:00:45,750
This information can then be used

23
00:00:45,750 --> 00:00:47,460
to identify potential vulnerabilities

24
00:00:47,460 --> 00:00:50,040
that might be exploited by an attacker.

25
00:00:50,040 --> 00:00:51,810
Reconnaissance is a crucial step

26
00:00:51,810 --> 00:00:53,670
in a penetration testing process.

27
00:00:53,670 --> 00:00:56,100
The information gathered during reconnaissance

28
00:00:56,100 --> 00:00:57,840
can help identify potential vulnerabilities

29
00:00:57,840 --> 00:00:59,400
in the target system.

30
00:00:59,400 --> 00:01:01,080
Also, the more information

31
00:01:01,080 --> 00:01:02,940
the attacker has about the target,

32
00:01:02,940 --> 00:01:04,530
the better they can plan their attack,

33
00:01:04,530 --> 00:01:07,260
which can lead to a higher chance of success.

34
00:01:07,260 --> 00:01:09,420
By identifying potential vulnerabilities

35
00:01:09,420 --> 00:01:11,550
and planning the attack carefully,

36
00:01:11,550 --> 00:01:14,220
the attacker can reduce the risk of being detected,

37
00:01:14,220 --> 00:01:16,320
and ultimately, failing in their attempts

38
00:01:16,320 --> 00:01:18,000
to exploit the system.

39
00:01:18,000 --> 00:01:21,090
Reconnaissance is divided into two different types,

40
00:01:21,090 --> 00:01:24,060
active reconnaissance and passive reconnaissance.

41
00:01:24,060 --> 00:01:25,440
In active reconnaissance,

42
00:01:25,440 --> 00:01:28,620
the attacker engages with the target system directly.

43
00:01:28,620 --> 00:01:30,750
They might ping the system, scan ports,

44
00:01:30,750 --> 00:01:33,030
or try to establish a connection.

45
00:01:33,030 --> 00:01:34,800
While this can yield a lot of information,

46
00:01:34,800 --> 00:01:37,770
it also carries a higher risk of detection.

47
00:01:37,770 --> 00:01:40,890
For example, an attacker might use a tool like Nmap

48
00:01:40,890 --> 00:01:43,530
to scan for open ports on the target system

49
00:01:43,530 --> 00:01:45,900
as part of an active reconnaissance technique,

50
00:01:45,900 --> 00:01:49,710
but the system defenders will see the port scanning occur,

51
00:01:49,710 --> 00:01:52,500
and this could identify where the attacker is coming from

52
00:01:52,500 --> 00:01:54,720
based off these port scans.

53
00:01:54,720 --> 00:01:56,160
In passive reconnaissance,

54
00:01:56,160 --> 00:01:57,630
the attacker gathers information

55
00:01:57,630 --> 00:02:00,600
without directly engaging with the target system.

56
00:02:00,600 --> 00:02:03,150
This might involve researching the target online,

57
00:02:03,150 --> 00:02:05,220
using open-source intelligence,

58
00:02:05,220 --> 00:02:06,570
observing network traffic,

59
00:02:06,570 --> 00:02:08,820
or using public databases.

60
00:02:08,820 --> 00:02:11,310
This approach is less likely to be detected,

61
00:02:11,310 --> 00:02:13,740
but can yield a lot less information.

62
00:02:13,740 --> 00:02:16,770
For example, an attacker might use a tool like WHOIS

63
00:02:16,770 --> 00:02:19,500
to gather information about the points of contacts

64
00:02:19,500 --> 00:02:20,940
for a particular domain name

65
00:02:20,940 --> 00:02:23,940
to use as part of their upcoming phishing campaign.

66
00:02:23,940 --> 00:02:25,380
The amount of reconnaissance

67
00:02:25,380 --> 00:02:27,420
and even the need for reconnaissance

68
00:02:27,420 --> 00:02:28,620
does vary based off

69
00:02:28,620 --> 00:02:30,960
the type of penetration test being planned

70
00:02:30,960 --> 00:02:33,630
and the environment that the test will incur inside of.

71
00:02:33,630 --> 00:02:36,090
Generally, we classify the environment

72
00:02:36,090 --> 00:02:37,620
as either a known environment,

73
00:02:37,620 --> 00:02:39,000
a partially known environment,

74
00:02:39,000 --> 00:02:41,310
or an unknown environment.

75
00:02:41,310 --> 00:02:43,800
In a known environment penetration test,

76
00:02:43,800 --> 00:02:45,030
the penetration testers

77
00:02:45,030 --> 00:02:47,010
are provided with detailed information

78
00:02:47,010 --> 00:02:48,570
about the target infrastructure

79
00:02:48,570 --> 00:02:51,960
by the organization before the test commences.

80
00:02:51,960 --> 00:02:54,810
This may include things like network diagrams,

81
00:02:54,810 --> 00:02:57,450
IP addresses, application details,

82
00:02:57,450 --> 00:02:58,890
operating system versions,

83
00:02:58,890 --> 00:03:00,510
and even credentials.

84
00:03:00,510 --> 00:03:03,060
The objective in a known environment test

85
00:03:03,060 --> 00:03:05,280
is not to identify unknown assets,

86
00:03:05,280 --> 00:03:07,380
but rather to thoroughly evaluate

87
00:03:07,380 --> 00:03:09,120
the vulnerabilities and weaknesses

88
00:03:09,120 --> 00:03:10,890
in the already known assets,

89
00:03:10,890 --> 00:03:13,260
while understanding how they can be exploited,

90
00:03:13,260 --> 00:03:16,110
and what potential damages can arise from them.

91
00:03:16,110 --> 00:03:17,550
This type of testing

92
00:03:17,550 --> 00:03:20,280
resembles the insider threat scenario

93
00:03:20,280 --> 00:03:23,520
where an employee or an insider with significant knowledge

94
00:03:23,520 --> 00:03:27,450
about the organization's IT environment poses a threat.

95
00:03:27,450 --> 00:03:29,310
So in a known environment,

96
00:03:29,310 --> 00:03:31,620
the attacker already has a lot of information

97
00:03:31,620 --> 00:03:33,780
about the target and in some cases,

98
00:03:33,780 --> 00:03:35,310
they may not really need to conduct

99
00:03:35,310 --> 00:03:36,480
any type of reconnaissance

100
00:03:36,480 --> 00:03:38,580
since they may already have all the details

101
00:03:38,580 --> 00:03:40,740
they need to begin their attack.

102
00:03:40,740 --> 00:03:43,350
A partially known environment penetration test,

103
00:03:43,350 --> 00:03:44,370
on the other hand,

104
00:03:44,370 --> 00:03:47,250
is a hybrid approach where testers are provided with

105
00:03:47,250 --> 00:03:50,430
limited information about the targeted infrastructure.

106
00:03:50,430 --> 00:03:51,870
The penetration tester

107
00:03:51,870 --> 00:03:53,760
might know some aspects of the system

108
00:03:53,760 --> 00:03:57,510
such as certain IP ranges, or application endpoints,

109
00:03:57,510 --> 00:03:59,700
but other information is withheld.

110
00:03:59,700 --> 00:04:02,280
The aim in a partially known environment test

111
00:04:02,280 --> 00:04:03,780
is to simulate a scenario.

112
00:04:03,780 --> 00:04:06,870
While the attacker might have gained some insider knowledge,

113
00:04:06,870 --> 00:04:08,970
perhaps attained from previous breaches

114
00:04:08,970 --> 00:04:10,560
or insider information,

115
00:04:10,560 --> 00:04:11,820
but still needs to discover

116
00:04:11,820 --> 00:04:14,070
and navigate the broader environment.

117
00:04:14,070 --> 00:04:16,740
This test not only identifies vulnerabilities

118
00:04:16,740 --> 00:04:18,000
and known assets,

119
00:04:18,000 --> 00:04:21,300
but also uncovers hidden or forgotten assets

120
00:04:21,300 --> 00:04:22,680
that might be vulnerable.

121
00:04:22,680 --> 00:04:24,660
In a partially known environment,

122
00:04:24,660 --> 00:04:26,100
reconnaissance is important

123
00:04:26,100 --> 00:04:29,100
so that the attacker can fill in the gaps of their knowledge

124
00:04:29,100 --> 00:04:31,620
by finding out what software is being used,

125
00:04:31,620 --> 00:04:32,880
what versions are installed,

126
00:04:32,880 --> 00:04:35,073
or what configurations are in place.

127
00:04:35,910 --> 00:04:38,610
In an unknown environment penetration test,

128
00:04:38,610 --> 00:04:40,260
penetration testers are given

129
00:04:40,260 --> 00:04:43,290
minimal to no information about the target system.

130
00:04:43,290 --> 00:04:45,930
The attacker might only be given the company's name

131
00:04:45,930 --> 00:04:48,570
or web domain as a starting point.

132
00:04:48,570 --> 00:04:50,460
Here, their objective is to simulate

133
00:04:50,460 --> 00:04:52,410
a real-world external attacker,

134
00:04:52,410 --> 00:04:55,110
where the attacker knows little to nothing about the target,

135
00:04:55,110 --> 00:04:58,380
but aims to find entry points and vulnerabilities.

136
00:04:58,380 --> 00:04:59,790
This type of testing

137
00:04:59,790 --> 00:05:02,190
typically starts with extensive reconnaissance

138
00:05:02,190 --> 00:05:05,100
to discover assets related to the target,

139
00:05:05,100 --> 00:05:07,260
and then moves to identify vulnerabilities

140
00:05:07,260 --> 00:05:09,600
and potential exploit paths.

141
00:05:09,600 --> 00:05:11,550
Unknown environment tests are comprehensive

142
00:05:11,550 --> 00:05:12,630
and provide insights

143
00:05:12,630 --> 00:05:15,210
into how an organization's external security posture

144
00:05:15,210 --> 00:05:16,833
appears to the outside world.

145
00:05:17,700 --> 00:05:21,630
So remember, reconnaissance is a critical first step

146
00:05:21,630 --> 00:05:23,340
in penetration testing and involves

147
00:05:23,340 --> 00:05:25,800
gathering information about the target system

148
00:05:25,800 --> 00:05:28,140
or identifying potential vulnerabilities

149
00:05:28,140 --> 00:05:29,640
and plan the attack.

150
00:05:29,640 --> 00:05:33,900
There are two types of reconnaissance, active and passive.

151
00:05:33,900 --> 00:05:35,430
Active reconnaissance involves

152
00:05:35,430 --> 00:05:37,920
directly interacting with the target system

153
00:05:37,920 --> 00:05:39,210
to gather information,

154
00:05:39,210 --> 00:05:40,800
while passive reconnaissance

155
00:05:40,800 --> 00:05:43,320
collects information without directly engaging

156
00:05:43,320 --> 00:05:45,480
or alerting the target system.

157
00:05:45,480 --> 00:05:48,000
We also have three different types of environments

158
00:05:48,000 --> 00:05:51,570
used in penetration testing, a known environment,

159
00:05:51,570 --> 00:05:53,100
a partially known environment,

160
00:05:53,100 --> 00:05:55,320
and an unknown environment.

161
00:05:55,320 --> 00:05:57,360
A known environment penetration test

162
00:05:57,360 --> 00:05:59,010
provides the penetration testers

163
00:05:59,010 --> 00:06:02,070
with detailed information about the target infrastructure

164
00:06:02,070 --> 00:06:03,630
before the test commences.

165
00:06:03,630 --> 00:06:05,870
A partially known environment penetration test

166
00:06:05,870 --> 00:06:08,670
is a hybrid approach where testers are provided

167
00:06:08,670 --> 00:06:11,730
with limited information about the target infrastructure.

168
00:06:11,730 --> 00:06:14,040
An unknown environment penetration test

169
00:06:14,040 --> 00:06:16,650
gives the tester minimal to no information

170
00:06:16,650 --> 00:06:17,700
about the target system

171
00:06:17,700 --> 00:06:19,710
before the engagement begins.

172
00:06:19,710 --> 00:06:22,830
The amount of reconnaissance needed for each engagement

173
00:06:22,830 --> 00:06:23,820
will vary based on

174
00:06:23,820 --> 00:06:25,950
the type of penetration test being conducted,

175
00:06:25,950 --> 00:06:28,590
but regardless, it's still always

176
00:06:28,590 --> 00:06:31,293
an important part of the penetration testing process.