Scribd Logo
Upload

Welcome to Scribd!

  • 125 views

    CH 4 - Footprinting and Social Engineering

    Uploaded by

    coder
    The document discusses various techniques for footprinting and social engineering attacks, including using web tools, competitive intelligence, DNS zone transfers, and social engineering tactics. It provides examples of tools like Burp Suite, ZAP, and Maltego that can be used to gather open source intelligence from a target website or organization. The document also covers social engineering techniques like shoulder surfing, dumpster diving, piggybacking, and phishing that target the human element of security. Prevention methods for some of these attacks are also outlined.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CH 4 - Footprinting and Social Engineering

    Uploaded by

    coder
    125 views64 pages
    The document discusses various techniques for footprinting and social engineering attacks, including using web tools, competitive intelligence, DNS zone transfers, and social engineering tactics. It provides examples of tools like Burp Suite, ZAP, and Maltego that can be used to gather open source intelligence from a target website or organization. The document also covers social engineering techniques like shoulder surfing, dumpster diving, piggybacking, and phishing that target the human element of security. Prevention methods for some of these attacks are also outlined.

    Original Title

    Ch 4 - Footprinting and Social Engineering

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses various techniques for footprinting and social engineering attacks, including using web tools, competitive intelligence, DNS zone transfers, and social engineering tactics. It provides examples of tools like Burp Suite, ZAP, and Maltego that can be used to gather open source intelligence from a target website or organization. The document also covers social engineering techniques like shoulder surfing, dumpster diving, piggybacking, and phishing that target the human element of security. Prevention methods for some of these attacks are also outlined.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    125 views64 pages

    CH 4 - Footprinting and Social Engineering

    Uploaded by

    coder
    The document discusses various techniques for footprinting and social engineering attacks, including using web tools, competitive intelligence, DNS zone transfers, and social engineering tactics. It provides examples of tools like Burp Suite, ZAP, and Maltego that can be used to gather open source intelligence from a target website or organization. The document also covers social engineering techniques like shoulder surfing, dumpster diving, piggybacking, and phishing that target the human element of security. Prevention methods for some of these attacks are also outlined.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 64

    Hands-On Ethical Hacking

    and Network Defense

    Chapter 4
    Footprinting and Social Engineering

    Updated 9-27-17
    Objectives
    ■ Use Web tools for footprinting
    ■ Conduct competitive intelligence
    ■ Describe DNS zone transfers
    ■ Identify the types of social
    engineering
    Using Web Tools for Footprinting

    ■ “Case the joint”


    • Look over the location
    • Find weakness in security systems
    • Types of locks, alarms
    ■ In computer jargon, this is called
    footprinting
    • Discover information about
    ■ The organization
    ■ Its network
    Table 4-1 Summary of Web tools
    Table 4-1 Summary of Web tools (cont’d.)
    Conducting Competitive Intelligence

    ■ Numerous resources to find


    information legally
    ■ Competitive Intelligence
    • Gathering information using technology
    ■ Identify methods others can use to find
    information about your organization
    ■ Limit amount of information company
    makes public
    Analyzing a Company’s Web Site

    ■ Web pages are an easy source of


    information
    ■ Many tools available
    ■ BurpSuite
    • Powerful proxy for all platforms (uses
    Java)
    • https://portswigger.net/burp/
    Burp Configuration
    ■ "Proxy" tab, "Intercept" sub-tab
    • Adjust to "Intercept is off"
    ■ "Proxy" tab, "Options" sub-tab
    • Start running on port 8080
    Proxy Settings in Firefox
    ■ At top right, click "3
    bars" icon, then the
    Gear icon
    ■ In "Advanced", on the
    "Network" tab, click
    "Settings”
    Surf an Insecure Site like ietf.org
    ■ "HTTP History" tab shows each
    request and response
    Surf a Secure Site like samsclass.info

    ■ Browser detects Burp's MITM attack


    and warns you
    Demo: Stitcher
    Installing the Burp Certificate
    ▪ On computer, in Firefox, using the
    proxy, visit http://burp
    ▪ Click the "CA Certificate" link
    ▪ Change file extension to .cer
    ▪ Drag file onto Genymotion phone
    ▪ On phone, settings, Security, "Install
    from SD card"
    Demo: Posting a Long Tweet
    Other Proxy Functions
    ▪ Intercept & Modify Requests
    ▪ Can exploit poorly-made shopping sites
    ▪ Spider
    ▪ Finds all the pages in a site
    ▪ Saves a local copy of them
    ▪ Scan for vulnerabilities
    ▪ Get authorization first
    Other Proxies
    ■ Zed Attack Proxy from OWASP
    • Can scan for vulnerabilities
    ■ Tamper Data
    • Firefox plug-in for easy interception and
    alteration of requests
    ■ Chrome Developer Tools
    • Click 3-bars, "More Tools", "Developer
    Tools"
    • Allows you to examine requests and
    responses
    Timeline
    ■ Shows requests & responses even for
    secure sites
    Using Other Footprinting Tools

    ■ Whois
    • Commonly used tool
    • Gathers IP address and domain
    information
    • Attackers can also use it
    ■ Host command
    • Can look up one IP address, or the whole
    DNS Zone file
    ■ All the servers in the domain
    ARIN Whois
    from Linux
    ■ host mit.edu
    ■ nc whois.arin.net
    ■ 18.7.22.69

    ■ This shows
    registration
    information for the
    domain
    Sam Spade

    ■ GUI tool
    ■ Available
    for UNIX
    and
    Windows
    ■ Easy to use
    Maltego
    Using E-mail Addresses
    ■ E-mail addresses help you retrieve
    even more information than the
    previous commands
    ■ Find e-mail address format
    • Guess other employees’ e-mail accounts
    ■ Tool to find corporate employee
    information
    • Groups.google.com
    Using HTTP Basics
    ■ HTTP operates on port 80
    ■ Use HTTP language to pull
    information from a Web server
    ■ Basic understanding of HTTP is
    beneficial for security testers
    ■ Return codes
    • Reveal information about server OS
    Using HTTP Basics (continued)
    ■ HTTP methods
    • GET / HTTP/1.1. is the most basic
    method
    • Can determine information about server
    OS from the server’s generated output
    Using the OPTIONS Method
    Using the GET Method
    Other Methods of Gathering
    Information
    ■ Cookies
    ■ Web bugs
    Detecting Cookies and Web Bugs
    ■ Cookie
    • Text file generated by a Web server
    • Stored on a user’s browser
    • Information sent back to Web server
    when user returns
    • Used to customize Web pages
    • Some cookies store personal information
    ■ Security issue
    Viewing Cookies
    ■ In Firefox
    ■ Tools, Options
    ■ Privacy tab
    ■ Show Cookies
    Detecting Cookies and Web Bugs
    (continued)
    ■ Web bug
    • 1-pixel x 1-pixel image file (usually
    transparent)
    • Referenced in an <IMG> tag
    • Usually works with a cookie
    • Purpose similar to that of spyware and
    adware
    • Comes from third-party companies
    specializing in data collection
    Ghostery

    ■ Firefox & Chrome extension to reveal Web bugs


    Using Domain Name Service (DNS)
    Zone Transfers
    ■ DNS
    • Resolves host names to IP addresses
    • People prefer using URLs to IP addresses
    ■ Zone Transfer tools
    • Dig
    • Host
    Primary DNS Server
    ■ Determining company’s primary DNS
    server
    • Look for the Start of Authority (SOA)
    record
    • Shows zones or IP addresses
    Using dig to find the SOA
    ■ dig soa mit.edu
    ■ Shows three
    servers, with IP
    addresses
    ■ This is a start at
    mapping the MIT
    network
    Using (DNS) Zone Transfers
    ■ Zone Transfer
    • Enables you to see all hosts on a
    network
    • Gives you organization’s network
    diagram
    ■ MIT has protected their network – zone
    transfers no longer work
    ■ dig @BITSY.mit.edu mit.edu axfr
    ■ Command fails now
    Blocking Zone Transfers
    • See link Ch 4e
    Introduction to Social Engineering
    ■ Older than computers
    ■ Targets the human component of a
    network
    ■ Goals
    • Obtain confidential information
    (passwords)
    • Obtain personal information
    ■ Link Ch 4l
    ■ Link Ch 4m
    HB Gary Federal Hacked

    ■ Link Ch 4n
    Tactics
    • Persuasion
    • Intimidation
    • Coercion
    • Extortion/blackmailing
    Introduction to Social Engineering
    (continued)
    ■ The biggest security threat to networks
    ■ Most difficult to protect against
    ■ Main idea:
    • “Why to crack a password when you can
    simply ask for it?”
    • Users divulge their passwords to IT
    personnel
    Social Engineer Studies Human
    Behavior
    • Recognize personality traits
    • Understand how to read body language
    Introduction to Social Engineering
    (continued)
    ■ Techniques
    • Urgency
    • Quid pro quo
    • Status quo
    • Kindness
    • Position
    Preventing Social Engineering
    ■ Train user not to reveal any
    information to outsiders
    ■ Verify caller identity
    • Ask questions
    • Call back to confirm
    ■ Security drills
    DEF CON Social Engineering Contest

    ■ Link Ch 4k
    The Art of Shoulder Surfing
    ■ Shoulder surfer
    • Reads what users enter on keyboards
    ■ Logon names
    ■ Passwords
    ■ PINs
    Tools for Shoulder Surfing
    ■ Binoculars or telescopes or cameras
    in cell phones
    ■ Knowledge of key positions and
    typing techniques
    ■ Knowledge of popular letter
    substitutions
    • s equals $, a equals @
    The Art of Shoulder Surfing
    (continued)
    ■ Prevention
    • Avoid typing when someone is nearby
    • Avoid typing when someone nearby is
    talking on cell phone
    • Computer monitors should face away
    from door or cubicle entryway
    • Immediately change password if you
    suspect someone is observing you
    Dumpster Diving
    ■ Attacker finds information in victim’s
    trash
    • Discarded computer manuals
    ■ Notes or passwords written in them
    • Telephone directories
    • Calendars with schedules
    • Financial reports
    • Interoffice memos
    • Company policy
    • Utility bills
    • Resumes of employees
    The Art of Dumpster Diving (continued)

    ■ Prevention
    • Educate your users about dumpster
    diving
    • Proper trash disposal
    • Use “disk shredder” software to erase
    disks before discarding them
    ■ Software writes random bits
    ■ Done at least seven times
    • Discard computer manuals offsite
    • Shred documents before disposal
    Piggybacking
    ■ Trailing closely behind an employee
    cleared to enter restricted areas
    ■ How it works:
    • Watch authorized personnel enter an area
    • Quickly join them at security entrance
    • Exploit the desire of other to be polite
    and helpful
    • Attacker wears a fake badge or security
    card
    Piggybacking Prevention
    • Use turnstiles
    • Train personnel to notify the presence of
    strangers
    • Do not hold secured doors for anyone
    ■ Even for people you know
    • All employees must use secure cards
    Phishing
    ■ Deceptive emails or text messages
    ■ Can take money, passwords, or install
    malware on your computer

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy