
Explore reconnaissance basics by examining active, passive, and hybrid footprinting, focusing on network, host, and people information gathering using public data and open source intelligence with Calibur 2021.1.
Explore reconnaissance in ethical hacking by learning information gathering, footprinting, scanning, and enumeration, using active and passive methods to profile targets and identify vulnerabilities.
Review essential assumptions for this recon module: lab setup with Kali Linux 2021.1, Metasploitable 3, Windows 10, and web targets. Ensure familiarity with Kali Linux and uphold rules of engagement.
Learn legal reconnaissance by practicing information gathering on designated victims, including on-site VIMS and targets like Treyarch, Actis, Hack the Box, and Hack This Site, with explicit permissions and rules.
Execute passive reconnaissance using open source intelligence, search engines, and terminal commands. Gather public information through DNS, enumerate Netcraft, banner grabbing, and automated tools, without contacting the target.
Explore open source intelligence to map public facing assets, gather external information, and collate findings into actionable intelligence for proactive security and targeted defense.
Learn to use search engines for reconnaissance, exploring shodan and Google hacking database to locate exposed devices, webcams, and servers, and apply query filtering effectively.
Explore Google dorking techniques and search operators like intitle, inurl, filetype, and site to refine queries across engines, while understanding legal and ethical boundaries under the CFA.
Explore common terminal commands for information gathering, using built-in tools and dig, whois, and traceroute to reveal dns records, ip addresses, name servers, and basic web server details.
Explore dns enumeration using multiple methods to collect dns data, hostnames, name servers, a records, subdomains, whois lookups, and zone transfers.
Learn to perform reconnaissance with Netcraft to uncover operating systems, web servers, hosting, encryption, SPF/DMARC, and domain data, then use Dmitry to enumerate subdomains and emails and export results.
Explore banner grabbing, or service fingerprinting, to discover hosts, open ports, operating systems, and versions. Practice active and passive methods—curl, netcat, and HTTP head requests—to gather server details.
Learn to use Recon-ng for reconnaissance by exploring its marketplace, installing and loading the hacker target module, configuring a source, and running it to reveal hosts, subdomains, and geographic data.
Learn to use the harvester to collect emails, subdomains, and hosts for a domain, by configuring search sources such as Google and capping results at 500.
Configure spider foot on the machine, run a seed-target scan (google.com), and crawl interlinked data to reveal DNS records, cookies, and affiliate links for reconnaissance.
execute active reconnaissance by identifying open ports with MAP, reviewing web services with zap and burp, and running vulnerability scans with Open Vost and Nessus.
discover how to use a port scanning tool for reconnaissance, performing fingerprinting and OS detection, and identifying service versions on a local network for footprinting.
Use Nikto to review web services on a site and pull IP address, hostname, port, and header information. Evaluate SSL details and format output to a text document for reporting.
DirBuster searches for hidden directories and files on web servers by brute forcing directory names with word lists, using a multithreaded Java application to reveal accessible but unlinked pages.
Explore how Zap, the web service review tool, acts as a proxy, website crawler, and automated vulnerability tester to crawl a site, identify alerts, and prepare for replay attacks.
Explore Burp Suite, a web service tool with proxy, spider, intruder, repeater, and scanner, using the community edition to intercept, capture, and modify requests.
Compare Nessus and OpenVAS as vulnerability scanners, outlining their pros, cons, and deployment in a network, then explain how scanning, reporting, patching, and re-scanning verify fixes.
Explore Maltego, an open source intelligence tool for reconnaissance that graphically links and analyzes data to gather information, including domains, dns, mx records, emails, and ip addresses.
Apply phase one reconnaissance by practicing active and passive techniques with built-in tools and Google dorking through a guided project that asks you to find answers.
Kali is a penetration testing Linux distribution created by Offensive Security. It holds a repository of multiple tools for security-related engineers including hacking wireless networks, web applications, databases, Reverse engineering, password crackers, and much more! As you can see, Kali is a versatile and powerful tool for anyone looking to do any cybersecurity-related work.
Keep in mind this is a basics course, which means this course is a beginner’s guide Ethical Hacking - Phase 1 – Reconnaissance. We will cover Active and Passive techniques, and the tools used to perform the information gathering and reconnaissance. The main purpose of information Gathering is getting to know the target systems. This is the first process in ethical hacking. Reconnaissance is a set of processes and techniques (Footprinting, Scanning & Enumeration) used to covertly discover and collect information about a target system.
The course is broken into three main sections, and an introduction section, and we wrap up with a project to ensure you understand the process of information gathering and reconnaissance. The goal is to provide you with basic knowledge to get you started so you can take it from there. Remember this is not a field that you have can walkthrough. You will have to grow and adapt as the environment changes.
Remember this is a basic overview of information gathering and reconnaissance, the hope is you get in, understand the principles. Work through the assignments and exercises to help solidify your understanding of the topics covered in this course.