Lab 5: Information Gathering (Recon)
Objectives In this practical you will perform foot printing activities to
collect information about your target.
CLO: 2, 4
Duration: 60+min
Requirements Lab PC
Kali Linux (installed)
Tasks Task 1: WHOIS
Task 2: DNS Foot Printing
Task 3: Maltego (Independent)
Task 4: SpiderFoot (Independent)
Foot Printing Foot printing is the process of gathering as much
information as possible about a target system (including
organizational, contact, and network data).
Student Notes
1 | Intrusion Detection | Lab Instructor Manual | Dr. Samer Aoudi | Updated
September 2018
Common Foot Printing Techniques
Active vs. Passive Foot Printing:
Active Foot Printing is an intrusive approach whereby the tester/attacker may
leave tracks/evidence of their search.
Passive, on the other hand, is a nonintrusive process that involves public
searches and that usually doesn’t leave unwanted traces.
2 | Intrusion Detection | Lab Instructor Manual | Dr. Samer Aoudi | Updated September
2018
Task 1: WHOIS
Task Objectives
You will use different tools to perform a WHOIS lookup on
selected organizations
ICANN & NETCRAFT
ICANN:
ICANN is the Internet Corporation for Assigned Names and Numbers. It is an
internationally organized non-profit corporation that, among other things,
oversees IP address space allocation and top-level domain (TLD) management.
1. Visit [Link] and type .ae in the search field
Which organization manages the Telecommunication Regulatory
.ae top-level domain (TLD)? Authority (TRA)
What is the WHOIS directory
for [Link]
this TLD?
2. Visit [Link] and perform a WHOIS lookup for HCT
What is the registrar’s name?
Etisalat
What is the name server?
Name one only [Link]
3. Visit [Link] and perform a WHOIS lookup for HCT
Did you get any results back?
no
Why or why not? because there is no registry
RDAP server was identified for
this domain. Attempting lookup
using WHOIS service.
4. Visit [Link] and perform a WHOIS lookup for YouTube and Twitter
5. Fill in the required information in the table below
[Link] [Link]
Registrant Name MarkMonitor Inc. CSC Corporate Domains,
Inc.
Organization Google LLC Twitter, Inc.
Phone +1.2083895740 8887802723
Email abusecomplaints@[Link] domainabuse@[Link]
Registrar WHOIS Server [Link] [Link]
Registration Expiration 2020-02-15 [Link] UTC 2020-01-21T[Link]Z
Date
Name Servers [Link] [Link]
6. Visit [Link] and lookup WHOIS information about YouTube and
Twitter. Fill in the required information in the table below
[Link] [Link]
Hosting Company Google unknown
IP Address [Link] [Link]
OS (For IP address) Linux Linux
Web Server [Link] [Link]
7. Independent Task:
Starting from IANA, find out the WHOIS database and then the domain information
for [Link]
Write the steps in this box:
8. Independent Task:
Find 5 additional internet tools and/or sites that provide WHOIS service
Write the steps in this box:
Task 2: DNS Foot Printing
Task Objectives
You will use tools to perform DNS foot printing on selected targets.
DNS Foot Printing
DNS Lookup Tools:
DIG
HOST
NSLOOKUP
Common DNS Records:
A –IP Address
NS –Name Server
MX –Mail Server
TXT –Generic text record
RP –Responsible Person
SOA –Start of Authority
AXFR –Zone Transfer
1. Power on Kali and open a terminal window
2. Ping [Link]
Note: Ping may be blocked
What is the IP address of
the target?
[Link]
Why Ping is NOT enough
to get the IP address of the ICMD port most of the time is off
a domain?
3. Run the following command: host [Link]
What is the IP address of
the target?
Why do you have multiple For each server IP Address
IP addresses?
What other information did IP Address in IPv4, IPv6 & Domain name
the HOST command provide?
How would you find out Man host
more about the HOST
command and how to use
it?
What is HOST? host is a simple utility for performing DNS lookups.
What options are available -4: Use IPv4 only for query transport.
for the HOST command? -6: Use IPv6 only for query transport.
-a: "All".
-c: class
Query class: This can be used to lookup HS
(Hesiod) or CH
(Chaosnet) class resource records. The default
class is IN
(Internet).
-C: Check consistency: host will query the SOA
records for zone name
from all the listed authoritative name servers
for that zone. The
list of name servers is defined by the NS
records that are found
for the zone.
-d: Print debugging traces. Equivalent to the -v
verbose option.
-i: Obsolete. Use the [Link] domain for
reverse lookups of IPv6
addresses as defined in RFC1886 and
deprecated in RFC4159. The
default is to use [Link] as specified in
RFC3596.
-l: List zone: The host command performs a
zone transfer of zone name
and prints out the NS, PTR and address records
(A/AAAA).
-N ndots: The number of dots that have to be in
name for it to be considered
absolute. The default value is that defined
using the ndots
statement in /etc/[Link], or 1 if no ndots
statement is
present. Names with fewer dots are interpreted
as relative names
and will be searched for in the domains listed in
the search or
domain directive in /etc/[Link].
-r: Non-recursive query: Setting this option
clears the RD (recursion desired) bit in the
query.
-R number: Number of retries for UDP queries
-s: Do not send the query
-t type: Query type
-T, -U: TCP/UDP: By default, host uses UDP
when making queries. The -T
option makes it use a TCP connection when
querying the name server.
-m flag: Memory usage debugging
-v: Verbose output.
-V: Print the version number and exit.
-w: Wait forever: The query timeout is set to the
maximum possible. See also the -W option.
-W wait: Timeout: Wait for up to wait seconds
for a reply.
By default, host will wait for 5 seconds for UDP
responses and 10
seconds for TCP connections.
What is the –t option? Query type: The type argument can be any recognized
query type:
CNAME, NS, SOA, TXT, DNSKEY, AXFR
What is the –l (lower case List zone: The host command performs a zone
transfer of zone name and prints out the NS, PTR and
L) option? address records (A/AAAA).
Together, the -l -a options print all records in the zone.
What happens when no It simply points a hostname to an IP address
type is provided?
Run HOST with the –t a
option. What is the
command and what is
the
output?
Run HOST with the –t
mx option. What is the
command and what is
the output?
Run HOST with the –t
soa option. What is the
command and what is
the output?
Run HOST with the –t
ns option. What is the
command and what is
the output?
Run HOST with the –t
rp option. What is the
command and what is
the output?
Run HOST with the –t
txt option. What is the
command and what is
the output?
4. Another DNS lookup utility is DIG: dig [Link]
Using DIG, perform the following DNS queries for the target [Link]
IP Address Command:
Query type =
Name Servers Command:
Query type =
Start of Authority Command:
Query type =
Responsible Person Command:
Query type =
Text Command:
Query type =
Mail Exchange Command:
Query type =
5. A third DNS lookup utility is NSLOOKUP: nslookup [Link]
Using DIG, perform the following DNS queries for the target [Link]
IP Address Command:
Query type =
Name Servers Command:
Query type =
Start of Authority Command:
Query type =
Responsible Person Command:
Query type =
Text Command:
Query type =
Mail Exchange Command:
Query type =
DNS Zone Transfer is an information gathering (foot printing) method to
copy entire DNS file (all records). Special record type = AXFR (often
used in DNS lookup tools)
Step 1: Get the NS for the target domain
Step 2: Attempt a zone transfer
Let’s attempt a zone transfer on the following target: [Link]
6. In a terminal window, type the following command: host ns [Link]
7. The output of the step above is a list of name servers. Use any in the
following command: host –l [Link] [Link]
Failed Zone Transfer
Let’s try the same target using the AXFR record
8. In a terminal window, type the following command:
host -t axfr [Link] [Link]
Let’s try the same target using DIG
9. In a terminal window, type the following command:
dig axfr @[Link] [Link]
It is very unlikely that a zone transfer will work. It is a relatively old
technique. By itself, it is not an attack, but rather a way to get data and
information that can
help in an attack.
Task 3: Maltego (Independent)
Task Objectives
You will use an open source intelligence tool to gather information
about a domain
Maltego
Maltgeo is an Open Source Intelligence Tool (OSIT). It is a tool that can
graphically display the links between pieces of data. It can be used to map
information regarding networks, organizations, people, and files.
Maltego is a client-server platform whereby the client interface sends XML
data to the server which in turn sends the results back to be displayed in
the client.
What’s powerful about Maltego is its ability to collate data from
multiple sources (sometimes as simple as a Google search) and
present them to the tester in a visual format.
Among other things, Maltego searches WHOIS records, DNS records,
public searches, and so on.
1. Power on Kali and open Maltego from Applications 01-Information Gathering
2. The first time you use Maltego, you will be asked to set it up. Click
Next in the Startup wizard
3. Click register and complete your sign up information on the community website
4. You should receive an email confirmation with a link to activate your account
5. Click the link and on the website click the Activate Account button
6. Go back to Maltego and login and click Next
7. Keep the default Public Server and click Next
8. You will get a summary of Maltego initialization. Click Finish
9. The Run a machine option will run start a machine based on your selection. For
now, click Cancel in the Start a Machine popup
10. Click the Create a New Graph icon
11. From the Palette on the left side, select Domain and drag it into the
empty graph area
12. The default website is Paterva (the developer of Maltego). To change it,
double-click the website name and type in [Link] instead
13. To run a Transform on the website, right-click the website icon and
select All Transforms
In Maltego, a Transform is a special code that converts results into something
of interest to the tester.
14. From the transforms list, select To Domain [Find other TLDs] transform
TLD is a Top Level Domain (e.g. .com or .ae)
15. Check the “I accept…” box and click Run!
Always read the disclaimer and make sure you understand it!
In the Community edition of Maltego, you are limited to 12 transforms.
16. View the results. Zoom out using the mouse wheel and select all results
17. Right-click and select All Transforms (as you did before), and then
select the To Website [Quick lookup] transform
This transform checks if there is a WWW entry for these domains
18. Notice that not all TLDs have actual WWW websites. Which ones don’t?
Hint: look for 0 Outgoing connections
18. Notice that not all TLDs have actual WWW websites. Which ones don’t?
Hint: look for 0 Outgoing connections
TLDs with no WWW entries:
19. Save the output file on Kali’s Desktop
What is the Maltego file Maltego is a software used for open-source
extension? intelligence and forensics, developed by
Paterva. Maltego focuses on providing a library of
transforms for discovery of data from open sources,
and visualizing that information in a graph
20. Run other transforms on other websites
Task 4: SpiderFoot (Independent)
Task Objectives
You will install and use an open source intelligence tool to collect
and analyze information about a target system
SpiderFoot
SpiderFoot:
SpiderFoot is an open source intelligence tool. Its goal is to automate
the process of gathering intelligence about a given target, which may
be an IP address, domain name, hostname or network subnet.
SpiderFoot can be used offensively, i.e. as part of a black-box penetration test
to gather information about the target or defensively to identify what
information your organisation is freely providing for attackers to use against
you.
Source: [Link]
1. Download the L4Files folder
2. Unzip [Link] and install it on the lab PC
3. Learn what the tool does and hot to use it ([Link])
4. Apply your knowledge
5. What kind of information can you collect using SpiderFoot?
Its for black-box pentesting to gather information about any target, such as:
DNS, Whois, Web pages, passive DNS, spam blacklists, file meta data,
threat intelligence lists as well as services like SHODAN, HaveIBeenPwned
Review Questions
The following questions are based on the information and activities performed
in the activity you just completed.
1. Which tool is NOT a DNS foot printing tool?
A. dig
B. host
C. nbstat
D. nslookup
2. Which query system is used to lookup registered users and domains online?
A. WHOIS
B. DNS
C. ICANN
D. Foot printing
3. Foot printing is mainly part of what penetration testing phase?
A. Scanning
B. Reconnaissance
C. Planning
D. Assessment
4. Which DNS record is used to perform a zone transfer?
A. A
B. MX
C. ZXFR
D. AXFR
5. What application level protocol is used to perform a DIG or HOST query? And
what transport level protocol is used?
