First step - Investigation
Investigation 🔎, a.k.a. passive recon (reconnaissance) is the first step of the pentester activities.
It involves gathering information about the target from afar 👓️, meaning with no direct interaction with the target 👀.
🌱 The goal is to find as much information as possible.
🚿️ You can also infer data, for instance, if a company has many customers, then they may have a support page/customer service.
Common activities:
-
🧑💻 Learn more about the company (roles, services...), the technologies, programming languages and software they use...
-
🐟 Find a potential attack vector
-
🧑 Find information about their employees, their emails, their social accounts, their leaked passwords...
-
...
Tools and methods 🗺️
- OSINT gathering 🧑💻🧑: any publicly available information
- DNS analysis 🧑💻🐟: DNS records, subdomains, IPs, emails...
- Google dorking 🧑💻🐟🧑: find anything indexed by google
- Shodan 🐟: find exposed and potentially vulnerable IoT devices
- Maltego 🧑💻 🐟: find websites, domains, social media accounts...
- Data leaks 🧑: find leaked data (passwords...)
Websites
- Wayback machine 🐟: see previous versions of the website
Internal Assessments
- Passive Network Discovery 🃏: map the internal network
Others
- TheHarvester (Automated OSINT+DNS checking)
👻 To-do 👻
Stuff that I found, but never read/used yet.
- cloud-based services and platforms investigation
- Wireless network reconnaissance