Module Objectives
This module introduces the reconnaissance phase of hacking to the reader. It details the aspect of footprinting. On completing this module, you will:
-
Have an overview of the reconnaissance phase
-
Be introduced to footprinting
-
Be able to understand the generic information gathering methodology of hackers
-
Gain insight about the implications that this phase present to the organization
-
Learn about some of the tools used for the reconnaissance phase
-
Be able to advocate countermeasures
The reader is urged to note that there is no 'one way' for hackers to approach a system. This is the basis behind stating that while countermeasures are suggested here, they are proposed in the light of the generic approach of hackers towards a system. There can be several hackers trying to target a system. The intent behind their activities cannot be foreknown and hence all activity must be treated as a threat.
Readers are advised to note that the focus of this course is not to teach the finer aspects of hacking, rather to emphasize on the vulnerability - threat - attack methods - tools - countermeasures threads of discussion.
Hence, we do not go into the diverse details on 'how to' hack, rather focusing the discussion on where you must look for vulnerabilities, what threat is posed by the vulnerability, what are the ways in which a cracker can exploit the vulnerability and what countermeasures should be advocated in the light of the threat. The objective of using tools here is to save on time and resources and defend resources in a proactive and efficient manner. It is assumed that readers possess good programming skills, and familiar with the various technical environments.
There are several tools available to the hacker and this list is ever evolving. This may range from simple code compilation software to source code text files available on the Internet. The point of emphasis is that it is in the interest of the organization to defend itself against vulnerabilities - known and unknown by adopting suitable methodology, tools and techniques to safeguard its assets.
 |
-
Reconnaissance refers to the preparatory phase where an attacker seeks to gather as much information as possible about a target of evaluation prior to launching an attack.
| |
Let us begin by revisiting the discussion on reconnaissance in the last module. We have seen that it refers to the preparatory phase where an attacker seeks to gather as much information as possible about a target of attack prior to launching an attack.
The exact methodology that a hacker adopts while approaching a target can vary. Some may randomly select a target based on vulnerability that can be exploited. Some others may be trying their hand at a new technology or skill level. Others may be methodologically preparing to attack a particular target for any particular reason.
For the purpose of study, we will broadly group these activities under three primary phases to comprise the reconnaissance phase. Network enumeration and scanning will be treated individually in separate modules.
Throughout this module readers are provided with references that go into building stronger conceptual knowledge. It is desirable that readers use them for the stated purpose. Similarly, the tools used in this module are representative of the genre they belong to. They are cited here for their popularity and availability.
The core of this module is non- intrusive information gathering techniques. Here, no system is breached or accessed in order to retrieve information. The core dependency of this technique lies in the information dissemination policy and practices of the organization.
| |
-
Footprinting is the blueprinting of the security profile of an organization, undertaken in a methodological manner.
-
Footprinting is one of the three pre-attack phases. The others are scanning and enumeration.
-
Footprinting results in a unique organization profile with respect to networks (Internet / Intranet / Extranet / Wireless) and systems involved.
| |
Information warfare is not without its battle plans or surveillance techniques. In this context, a strategic map used in a battle would be a close analogy to a footprint. Note that through this course, we use the term 'organization' to represent a target system. This includes discussion pertaining to a single system as well.
| Concept | Footprinting is the blueprinting of the security profile of an organization or target system, undertaken in a methodological manner. |
To elaborate on the above definition; the term 'blueprinting' is used because completion of this activity results in a unique system profile of the organization. It is considered 'methodological' because critical information is sought based on a previous discovery.
There is no single methodology for footprinting, as a hacker can choose several routes to trace the information. However, this activity is essential as all crucial information needs to be gathered before the hacker can decide on the best possible course of action.
| Note | Footprinting therefore, needs to be carried out precisely and in an organized manner. The information unveiled at various network levels can include details of domain name , network blocks, network services and applications, system architecture, intrusion detection systems, specific IP addresses, access control mechanisms and related lists, phone numbers , contact addresses, authentication mechanisms and system enumeration. |
This listing may include more information depending on how various security aspects are addressed by the organization. Information gathered during the footprinting phase can be used as a springboard in narrowing down the attack methodology and also in assessing its merit.
One dubious aspect of the information gathering phase is that most of it can be sought within legal bindings and from publicly available information. It is to be noted that though the Internet originated from the efforts of the defense department and many of the protocols were established to serve the purpose of communicating information reliably, completely and dependably; the speed with which it would penetrate the common world was unpredicted, and so were the security concerns that would arise from the increased networked environment.
| |
-
Ascertain active machines
-
Discover open ports / access points
-
Detect operating systems
-
Uncover services on ports
-
Map the Network
| |
| Note | The information gathering activity can be broadly divided into seven phases. The attacker would first unearth initial information (such as domain name), locate the network range of the target system (using tools such as Nslookup, whois etc), ascertain the active machines (for instance by pinging the machine), discover open ports or access points (using tools such as port scanners ), detect operating systems (for instance querying with telnet), uncover services on ports and ultimately map the network. |
This module details footprinting, which includes the first two phases listed above. Footprinting is considered to be an exacting phase and is intended to give the attacker an assessment of the target system. It also serves in eliminating several possible hacking techniques and allows the attacker to choose the best fit to achieve access to the system. This not only speeds up the real attack process, but also aids in helping the attacker prepare better for covering his tracks and thereby leave a smaller or minimal footprint.
Footprinting is required to ensure that isolated information repositories that are critical to the attack are not overlooked or left undiscovered. Footprinting merely comprises on aspect of the entire information gathering process, but is considered one of the most important stages of a mature hack.
In the following pages we will discuss some of the possible ways of footprinting, the implications they pose to the target systems and the countermeasures that can be adopted.
Adam browsed through the targetcompany site. He had already researched well for his job application and had the company's annual reports , press releases, brochures etc. He decided to search the web for postings on message boards , discussion groups and even checked partner sites. He came across some interesting information that would normally be unavailable.
The next day he dropped at the coffee shop and chatted with a group of insiders. One of them did not seem happy with his work and vented his opinion regarding his employer often. He also seemed to like the attention being paid to his comments.
| |
Commonly includes :
-
Domain name lookup
-
Locations
-
Contacts (Telephone / mail)
Information Sources :
-
Open source
-
Whois
-
Nslookup
Hacking Tool :
-
Sam Spade
| |
It is increasingly clear that several enterprises are positioning their websites to represent their corporate image globally. Often these websites are the starting point of the information gathering phase.
| Concept | Open Source Footprinting is the easiest and safest way to go about finding information about a company. Information that is available to the public, such as phone numbers, addresses, etc. Performing whois requests , searching through DNS tables are other forms of open source footprinting. Most of this information is fairly easy to get, and within legal limits. One easy way to check for sensitive information is to check the HTML source code of the website to look for links, comments, Meta tags etc. |
Typing the company name in any search engine can retrieve its domain name (such as targetcompany.com). The categories of information that can be available from open sources include general information about the target, employee information, business information, information sourced from newsgroups such as postings about systems themselves ), links to company/personal web sites and HTML source code.
| Attack Methods | The attacker may choose to source the information from:
|
Apart from surfing the site for contact information (such as phone numbers, email addresses, human contact information, recent mergers and acquisitions, partners , alliances etc) the attacker can lookup the domain name with a whois client and also do an Nslookup.
| Note | For instance let us take a look at what a whois query on Microsoft might result in. Note that there are several whois lookup clients on the Internet and some may reveal more information than the standard whois lookup, like the one shown below. This whois query gives additional information such as server type, number of DMOZ listings, website status, how may sites the web server is hosting etc. It also renders the monitoring option for the particular site. |
| Website Title: | Microsoft Corporation |
| Server Type: | Microsoft-IIS/6.o |
| DMOZ: | 993 listings |
| Website Status: | Active |
| Web server hosts : | 6 other websites hosted |
| IP Address: | 207.46.249.27 |
| Visit Website: | www.microsoft.com |
| Record Type: | Domain Name |
| Monitor: | Add microsoft.com to My Monitoring List |
| Search all domains: | query: Microsoft |
| Name Server: | DNSi.CP.MSFT.NET DNSi.TK.MSFT.NET |
| ICANN Registrar: | NETWORK SOLUTIONS, INC. |
| Created: | 2-May-91 |
| Expires : | 3-May-12 |
| Status: | ACTIVE |
Note the information on the other websites hosted and the name server details, which can be further queried to obtain information.
| Registrant: | |
| Microsoft Corporation (MICROSOFT-DOM) | |
| |
| |
| |
| |
| |
|
|
| |
| |
| |
| |
| |
| |
| < msnhst@MICROSOFT.COM > |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| 207.46.138.20 |
| 213.199.144.151 |
| 65.54.248.222 |
| 207.68.128.151 |
| 207.46.245.230 |
Some whois clients also provide a reverse query. Here, a known IP can be traced back to its domain. The authoritative resource for whois databases are:
| Note | There are four RIRs, each maintaining a whois database holding details of IP address registrations in their regions . The RIR whois databases are located at:
|
For historical reasons, the ARIN Whois Database is generally the starting point for searches. If an address is outside of ARIN's region, then that database will provide a reference to either APNIC or RIPE NCC. www.allwhois.co m is also considered a comprehensive whois interface.
| Tools | There are tools available to aid a whois lookup. Some of them are Sam Spade (downloadable from www.samspade.org ). Smart Whois (downloadable from www.tamos.com ). Netscan (downloadable from www. netscantools .com ) and GTWhois ( Windows XP compatible) ( www.geektools.com ) etc. Whois client is available in most versions of UNIX. For users with UNIX X and GUI + GTK toolkit, Xwhois (available at http://c64.org/~nr/xwhois/) can be used. |
Readers are encouraged to read the RFCs and standards related to the discussion. Readers may refer to std/std13 - Internet standard for Domain Names - Concepts and Facilities and RFCs 1034, 1035.
| |
| |
| Concept | Several operating systems provide a WHOIS utility. To conduct a query from the command line, the format is: whois -h hostname identifier e.g. whois -h whois.arin.net <query string> |
In order to obtain a more specific response, the query can be conducted using flags. Many of these flags can be specified together to determine a specific output. The syntax requirement is that flags be separated from each other and from the search term by a space.
Flags can be categorized under query types and only one flag may be used from a query type.
-
Query-by-record-type:
n Network address space
a Autonomous systems
p Points of contact
o Organizations
c End- user customers
-
Query-by-attribute:
@<domain name> Searches for matches by the domain-portion of an e-mail address
! <handle> Searches for matches by handle or id
. <name> Searches for matches by name
Searches that retrieve a single record will display the full record. Searches that retrieve more than one record will be displayed in list output.
-
Display flags:
+ Shows detailed (aka 'full' output) display for EACH match
- Shows summary only (aka 'list' output), even if single match returned
However, the + flag cannot be used with the record hierarchy sub query.
-
Record hierarchy:
Records in the WHOIS database have hierarchical relationships with other records.
< Displays the record related up the hierarchy. For a network, displays the supernet, or parent network in detailed (full) format.
> Displays the record(s) related down the hierarchy. For a network, displays the subdelegation(s), or subnets, below the network, in summary (list) format. For an organization or customer, displays the resource(s) registered to that organization or customer, in summary (list) format.
-
Wild card queries:
WHOIS supports wild card queries. Append the query with an asterisk (*). This can also be used in combination with any flags defined above.
Let us take a look at a query for Google. Results of querying whois at internic.net for domain name google.com
| Domain Name: GOOGLE.COM |
|
|
|
|
|
|
|
|
|
|
|
Results of querying whois at internic.net for registrar ALLDOMAINS.COM INC
| Registrar Name: ALLDOMAINS.COM INC. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Results of querying whois at internic.net for nameserver NS2. GOOGLE. COM
|
|
|
|
|
As seen above, a normal query will result in contact information, name of ISP, name servers -that can be resolved further into specific IP address. Let us take a look at what information can be stored with the registrar. This is for the reader to know what goes into a domain name system.
| Concept | A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource information associated with a particular name is composed of separate resource records (RRs). The order of RRs in a set is not significant, and need not be preserved by name servers, resolvers , or other parts of the DNS. |
When we talk about a specific RR, we assume it has the following:
-
Owner - which is the domain name where the RR is found.
-
Type - This is an encoded 16 bit value that specifies the type of the resource in this resource record. Types refer to abstract resources.
A
a host address
CNAME
identifies the canonical name of an alias
HINFO
identifies the CPU and OS used by a host
MX
identifies a mail exchange for the domain.
NS
the authoritative name server for the domain
PTR space
a pointer to another part of the domain name
SOA
identifies the start of a zone of authority
-
Class - This is an encoded 16 bit value which identifies a protocol family or instance of a protocol.
IN
the Internet system
CH
the Chaos system
-
TTL - This is the time to live of the RR. The TTL describes how long a RR can be cached before it should be discarded.
-
RDATA - which is the type and sometimes class dependent data which describes the resource:
A
For the IN class, a 32 bit IP address
For the CH class, a domain name followed by a 16 bit octal Chaos address.
CNAME
A domain name.
MX
A 16 bit preference value followed by a host name willing to act as a mail exchange for the owner domain.
NS
A host name.
PTR
A domain name.
SOA
Several fields.
As seen above, the information stored can be useful to gather further information of the particular target domain. To summarize, there are five types of queries that can be carried out on a whois database.
-
Registrar - Displays specific registrar information and associated whois servers. This query gives information on potential domains matching the target.
-
Organizational - Displays all information related to a particular organization. This query can list all known instances associated with the particular target and the number of domains associated with the organization.
-
Domain - Displays all information related to a particular domain. A domain query arises from information gathered from an organizational query. Using a domain query, the attacker can find the company's address, domain name; administrator and his/her phone number, and the system's domain servers.
-
Network - Displays all information related to a particular network of a single IP address. Network enumeration can help ascertain the network block assigned or allotted to the domain.
-
Point of Contact (POC) - Displays all information related to a specific person, typically the administrative contacts. Also known as query by 'handle'.
| Countermeasure | If the organization is a high security organization, it can opt to register a domain in the name of a third party, as long as they agree to accept responsibility. The organization must also take care to keep its public data updated and relevant for faster resolution of any administrative and/or technical issues. The public data is only available to the organization that is performing the registration and they are responsible for keeping it current. |
| |
-
Nslookup is a program to query Internet domain name servers. Displays information that can be used to diagnose Domain Name System (DNS) infrastructure.
-
Helps find additional IP addresses if authoritative DNS is known from whois.
-
MX record reveals the IP of the mail server.
-
Both Unix and Windows come with a Nslookup client.
-
Third party clients are also available - E.g. Sam Spade
| |
Nslookup is a valuable tool for querying DNS information for host name resolution. It is bundled with both UNIX and windows operating systems and can be accessed at the command prompt. When Nslookup is run, it shows the host name and IP address of the DNS server that is configured for the local system, and then display a command prompt for further queries. This is the interactive mode. Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain.
When an IP address or host name is appended to the Nslookup command, it acts in the passive mode. Non-interactive mode is used to print just the name and requested information for a host or domain.
| Attack Methods | Nslookup allows the local machine to focus on a DNS that is different from the default one by invoking the server command. By typing 'server' <name> (where <name> is the host name of the server you want to use for future lookups) the system focuses on the new DNS domain. A zone transfer can be done if the security is lax, and all information updated from the primary DNS. Let us take a look at an example: $ nslookup Default Server: cracker.com Address: 10.11.122.133 Server 10.12.133.144 Default Server: ns.targetcompany.com Address 10.12.133.144 set type=any ls -d target.com systemA 1DINA 10.12.133.147 1DINHINFO "Exchange MailServer" 1DINMX 10 mail1 geekL 1DINA 10.12.133.151 1DINTXT "RH6.0" |
| Concept | Nslookup employs the domain name delegation method when used on the local domain. For instance, typing 'hr.targetcompany.com' will query for the particular name and if not found, will go one level up to find 'targetcompany.com'. To query a host name outside the domain, a fully qualified domain name (FQDN) must be typed. This can be easily obtained from a whois database query as discussed before. Recall that in our previous example we had queried Google on the whois database and retrieved registrar, domain and name server information. We had also discussed what goes into a domain name record. Let us do an Nslookup with the FQDN we have obtained - google.com. |
| Host | Type | Value |
|---|---|---|
| google.com | NS | ns2.google.com |
| google.com | NS | ns1.google.com |
| google.com | NS | ns3.google.com |
| google.com | NS | ns4.google.com |
| google.com | MX | 20 smtp2.google.com |
| google.com | MX | 40 smtp3.google.com |
| google.com | MX | 10 smtp1.google.com |
| google.com | NS | ns2.google.com |
| google.com | NS | nsl.google.com |
| google.com | NS | ns3.google.com |
| google.com | NS | ns4.google.com |
| ns2.google.com | A | 216.239.34.10 |
| ns1.google.com | A | 216.239.32.10 |
| ns3.google.com | A | 216.239.36.10 |
| ns4.google.com | A | 216.239.38.10 |
| smtp2.google.com | A | 216.239.37.25 |
| smtp3.google.com | A | 216.239.33.26 |
| smtp1.google.com | A | 216.239.33.25 |
The above information was retrieved using the Nslookup interface at http://www.zoneedit.com/lookup.html . Let us take a look at what can be done with Nslookup in an interactive mode. Given below is a listing of the various switches. This has been taken from a windows client.
| Switch | Function |
|---|---|
| nslookup | Launches the nslookup program. |
| set debug | Launches debug mode from within nslookup. |
| set d2 | Launches verbose debug mode from within nslookup. |
| host name | Returns the IP address for the specified host name. |
| NAME | Displays information about the host/domain NAME using default server |
| NAME1 NAME2 | As above, but uses NAME2 as server |
| help or? | Displays information about common commands |
| set OPTION | Sets an option |
| Displays options, current server and host. |
| Displays debugging information. |
| Appends domain name to each query. |
| Asks for recursive answer to query. |
| Uses domain search list. |
| Always uses a virtual circuit. |
| Sets default domain name to NAME. |
| Sets domain to N1 and search list to N1,N2, and so on. |
| Sets root server to NAME. |
| Sets number of retries to X. |
| Sets initial timeout interval to X seconds. |
| Sets query type (such as A, ANY, CNAME, MX, NS, PTR, SOA, SRV). |
| Same as type. |
| Sets query class (ex. IN (Internet), ANY). |
| Uses MS fast zone transfer. |
| Current version to use in IXFR transfer request. |
| Sets default server to NAME, using current default server. |
| Sets default server to NAME, using initial server. |
| Fingers the optional NAME at the current default host. |
| Sets current default server to the root. |
| ls [opt] DOMAIN [> FILE] | Lists addresses in DOMAIN (optional: output to FILE). |
| Lists canonical names and aliases. |
| Lists all records. |
| Lists records of the given type (For example, A, CNAME, MX, NS, PTR and so on). |
| View FILE | Sorts the output file from the 'ls' option described earlier and displays it page by page. |
| Exit | Exits Nslookup and returns to the command prompt. |
In addition to this, the attacker can use dig and host command to obtain more information on UNIX systems.
The Domain Name System (DNS) namespace is divided into zones, each of which stores name information about one or more DNS domains. Therefore for each DNS domain name in eluded in a zone, the zone becomes a storage database for a single DNS domain name and is the authoritative source for information.
| Threat | At a very basic level, an attacker can try to gain more information by using the various nslookup switches. At a higher level they can attempt a zone transfer at the DNS level, which can have drastic implications. |
| Countermeasure | The first line of defense that any target system can adopt is proper configuration and implementation of their DNS. As penetration testers, you must be knowledgeable about standard practices in DNS configurations. Inappropriate queries must be refused by the system thereby checking crucial information leakage. In the example (page 20) note the naming of the system as geekL, which might give an idea as to the system runs Linux. The TXT field also reveals the version as Red Hat 6.0! Therefore care must be taken while assigning information that can be viewed on the Internet and no additional information need to be given such as the TXT in the example. |
To check zone transfer, specify exact IP addresses from where zone transfers may be allowed. The firewall must be configured to check TCP port 53 (which unlike UDP port 53 is used for zone transfers instead of DNS queries) access. Another best practice is to use more than one DNS - or the split DNS approach where one DNS caters to the external interface and the other to the internal interface. This will let the internal DNS act like a proxy server and check leaking of information from external queries.
Readers are urged to get their DNS concepts clear by going through RFC 1912, "Common DNS Operational and Configuration Errors", RFC 2182, "Selection and Operation of Secondary DNS Servers", and RFC 2219, "Use of DNS Aliases for Network Services"
| |
Adam knows that targetcompany is based at NJ. However, he decides to check it up. He runs a whois from an online whois client and notes the domain information. He takes down the email ids and phone numbers. He also discerns the domain server IPs and does an interactive Nslookup.
-
Ideally. what extent of information should be revealed to Adam during this quest?
-
Are there any other means of gaining information? Can he use the information at hand in order to obtain critical information?
-
What are the implications for the target company? Can he cause harm to targetcompany at this stage?
| |
Let us take a look at Adam's information quest again. Whois and Nslookup are common tools available to any person and there are several web interfaces where the nature of query required can be as simple as a domain name, to generate IP addresses and even do a reverse DNS lookup. The information gathered at this stage is very well within the legal limits.
-
Ideally, Adam should have obtained information that the target company has found essential to be posted on a public database.
| Threat | The other bits of information that Adam could have obtained are links to rogue sites that link to targetcompany.com (potential gateways), messages posted at Usenet groups or other discussion forums where employees have left behind their email id and the forum has captured the originating IP address (specific IP address to monitor). He could have stumbled on sensitive business information from company research reports available on the Internet (recent merger / acquisition - potential weaker subsidiary in terms of security). |
| Attack Methods | Another method used by attackers is plain smooth talking - termed better as 'social engineering'. Social engineering can be regarded as "people hacking" or the exploitation of the human factor. Basically, it is used for describing a hacker soliciting unwitting participation from a person inside a company rather than breaking into the system independently. This is accomplished by persuading "marks" or "targets" to volunteer or assist with delivering information about critical systems, applications or access to such information. Social engineering is a highly developed skill that is often described by the hacker community as "the art and science of getting people to comply to your wishes". |
| |
Commonly includes:
-
Finding the range of IP addresses
-
Discerning the subnet mask
Information Sources :
-
ARIN (American Registry of Internet Numbers)
-
Traceroute
Hacking Tool :
-
NeoTrace
-
Visual Route
| |
After gathering information from open source, the attacker can proceed to find the network range of the target system. He can get more detailed information from the from the appropriate regional registry database regarding IP allocation and nature of allocation. He can also discern the subnet mask of the domain.
| Tools | The attacker can also trace the route between his system and the target system. In our discussion, we will take a look at two popular traceroute tools - NeoTrace (now, acquired by McAfee and renamed as Visual Trace) and Visual Route. Both these tools are popular for their visualizations and the accessory options they offer. However, this does not mean that these are the only two tools available to a hacker. Some of these tools are based on the POC input of the various ISP/NSP routers (from ARIN, etc., dB) along the way. Therefore there is a possibility that what is being shown on these tools may not be entirely true, as the owner may be elsewhere and the web hosting done elsewhere. Therefore it is always a good practice to check more than one registry. |
| Concept | Information that can be useful to an attacker is the private IP addresses. The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets : 10.0.0.0 - 10.255.255.255 (10/8 prefix), 172.16.0.0 - 172.31.255.255 (172.16/12 prefix), 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) |
| Threat | If the DNS servers are not set up correctly, the attacker has a good chance at obtaining the list of the internal machines. Also, sometimes if an attacker does a traceroute to a machine, he can also get the internal IP of the gateway, which might be of use. |
| |
-
ARIN allows search on the whois database to locate information on networks autonomous system numbers (ASNs), network-related handles and other related point of contact (POC).
-
ARIN whois allows querying the IP address to help find information on the strategy used for subnet addressing.
| |
| Note | ARIN allows search on the whois database to locate information on networks autonomous system numbers (ASNs), network-related handles and other related point of contact (POC). ARIN whois allows querying the IP address to help find information on the strategy used for subnet addressing. |
The ARIN page also has a set of additional tools and links to other sites such as RWhois.net. ARIN would be a good starting point for information gathering as the information retrieved is more elaborate than a standard Whois lookup.
The purpose of discussing information gathering - and footprinting in particular - is that this is the information that both the hacker and the systems administrator can gather in a non-intrusive manner. All the approaches discussed so far are completely passive (with the exception of traceroute, as it can be detected ) and undetectable by the target organization. The information gathered during this phase will be used continuously throughout the penetration test.
Doing a footprinting for an organization can help its systems administrator know what nature of information lies outside the organization and the potential threat it can pose to the organization. He can take preventive measures to see that these are not used as a means of exploit and increase user awareness regarding the use of information assets.
Up to date domain contact information is important not only for addressing administration issues but can also be used by security personnel on other networks to warn of pending attacks or active compromises. By not revealing essential information, more harm can be done.
| |
| |
Let us take a look at the ARIN output for a whois on google.com Note the difference from the standard whois query result where the NetRange was not given. The query has resulted in obtaining the real address of Google, the network range, date of registration / updation and additional contact information.
Search results for: 216.239.34.10
| OrgName: | Google Inc. |
| OrgID: | GOGL |
| Address: | 2400 E. Bayshore Parkway |
| City: | Mountain View |
| StateProv: | CA |
| PostalCode: | 94043 |
| Country: | US |
| NetRange: | 216.239.32.0 - 216.239.63.255 |
| CIDR: | 216.239.32.0/19 |
| NetName: | |
| NetHandle: | NET-216-239-32-0-1 |
| Parent: | NET-216-0-0-0-0 |
| NetType: | Direct Allocation |
| NameServer: | NS1.GOOGLE.COM |
| NameServer: | NS2.GOOGLE.COM |
| NameServer: | NS3.GOOGLE.COM |
| NameServer: | NS4.GOOGLE.COM |
| Comment: | |
| RegDate: | 2000-11-22 |
| Updated: | 2001-05-11 |
| TechHandle: | ZG39-ARIN |
| TechName: | Google Inc. |
| TechPhone: | +1-650-318-0200 |
| TechEmail: | < arin-contact@google.com > |
| Attack Methods | From the Nslookup query, an attacker can find name servers, mail exchange servers and also what class they belong to. The mail exchange servers can be further resolved into IP addresses. He can then enumerate the network further by doing a reverse IP lookup. |
In this case, we look up 216.239.33.25 which is the IP of smtp1.google.com
The query gives the following result.
| 25.33.239.216.in-addr.arpa | PTR | smtp1.google.com |
| 33.239.216.in-addr.arpa | NS | ns1.google.com |
| 33.239.216.in-addr.arpa | NS | ns2.google.com |
| 33.239.216.in-addr.arpa | NS | ns3.google.com |
| 33.239.216.in-addr.arpa | NS | ns4.google.com |
| ns1.google.com | A | 216.239.32.10 |
| ns2.google.com | A | 216.239.34.10 |
| ns3.google.com | A | 216.239.36.10 |
| ns4.google.com | A | 216.239.38.10 |
Note that the IP actually points to .arpa domain. Further, we also retrieve more information on the name servers.
| |
-
Traceroute works by exploiting a feature of the Internet Protocol called TTL, or Time To Live.
-
Traceroute reveals the path IP packets travel between two systems by sending out consecutive UDP packets with ever-increasing TTLs .
-
As each router processes a IP packet, it decrements the TTL. When the TTL reaches zero, it sends back a "TTL exceeded" message (using ICMP) to the originator.
-
Routers with DNS entries reveal the name of routers, network affiliation and geographic location.
| |
The best way to find the route to the target systems is to use the traceroute utility provided with most operating systems. Traceroute utility can detail the path IP packets travel between two systems. It can trace the number of routers the packets travel through, the time duration in transiting between two routers, and, if the routers have DNS entries, the names of the routers and their network affiliation and geographic location. This is a great deal of information for an attacker if he can exploit them for his attack.
Traceroute works by exploiting a feature of the Internet Protocol called TTL, or Time To Live. The TTL field is interpreted to indicate the maximum number of routers a packet may transit. Each router that handles a packet will decrement the TTL count field in the ICMP header by 1. When the count reaches zero, the packet will be discarded and an error message will be transmitted to the originator of the packet.
| Concept | Let us see how traceroute works. Traceroute sends out a packet destined for the destination specified. It sets the TTL field in the packet to 1. The first router in the path receives the packet, decrements the TTL value by 1, and if the resulting TTL value is o, it discards the packet and sends a message back to the originating host to inform it that the packet has been discarded. Traceroute records the IP address and DNS name (if available) of that router, then sends out another packet with a TTL value of 2. This packet makes it through the first router, then times-out at the next router in the path. This second router also sends an error message back to the originating host. Traceroute continues to do this, recording the IP address and name of each router until a packet finally reaches the target host, or until it decides that the host is unreachable. In the process, traceroute records the time it took for each packet to travel round trip to each router. |
Let us see what a tracert 216.239.36.10 command at the command prompt for windows results in.
C:\>tracert 216.239.36.10 |
Tracing route to ns3.google.com [216.239.36.10] over a maximum of 30 hops: |
1 1262 ms 186 ms 124 ms 195.229.252.10 |
2 2796 ms 3061 ms 3436 ms 195.229.252.130 |
3 155 ms 217 ms 155 ms 195.229.252.114 |
4 2171 ms 1405 ms 1530 ms 194.170.2.57 |
5 2685 ms 1280 ms 655 ms dxb-emix-ra.ge6303.emix.ae [195.229.31.99] |
6 202 ms 530 ms 999 ms dxb-emix-rb.so100.emix.ae [195.229.0.230] |
7 609 ms 1124 ms 1748 ms iar1-so-3-2-0.Thamesside.cw.net [166.63.214.65] |
8 1622 ms 2377 ms 2061 ms eqixva-google-gige.google.com [206.223.115.21] |
9 2498 ms 968 ms 593 ms 216.239.48.193 |
10 3546 ms 3686 ms 3030 ms 216.239.48.89 |
11 1806 ms 1529 ms 812 ms 216.33.98.154 |
12 1108 ms 1683 ms 2062 ms ns3.google.com [216.239.36.10] |
Trace complete. |
While this is what a simple traceroute might result in, there are web interfaces where a more detailed traceroute can be done and more information obtained. One such interface is available at http://www.opus1.com Take a look at the same traceroute query done on the same IP.
traceroute to 216.239.36.10 (216.239.36.10), 30 hops max, 40 byte packets |
1 manny.Firewall.Opusl.COM (192.245.12.95) [AS22772/AS3908/AS6373/AS5650] Postmaster@Opus1.COM 4.883 ms |
2 Opus-GW (207.182.35.49) [AS22772/AS6373] Postmaster@Opus1.COM 14.648 ms |
3 66.62.80.165 (66.62.80.165) [AS6983] root@in-tch@com.80.62.66.in- addr.arpa 18.554 ms |
4 laxl-core-02.tamerica.net (66.62.5.194) [AS6983] root@in- tch@com.5.62.66.in-addr.arpa 47.849 ms |
5 slcl-core-01.tamerica.net (66.62.3.6) [AS6983] root@in- tch@com.3.62.66.in-addr.arpa 48.825 ms |
6 slcl-core-02.tamerica.net (66.62.3.33) [AS6983] root@in- |
tch@com.3.62.66.in-addr.arpa 50.778 ms |
7 denl-core-01.tamerica.net (66.62.3.22) [AS6983] root@in- tch@com.3.62.66.in-addr.arpa 49.801 ms |
8 denl-edge-01.tamerica.net (66.62.4.3) [AS6983] root@in- tch@com.4.62.66.in-addr.arpa 50.778 ms |
9 den-core-01.tamerica.net (205.171.4.177) [AS209/AS3909] dns- admin@qwestip.net 48.825 ms |
10 den-core-03.tamerica.net (205.171.16.14) [AS209/AS3909] dns- admin@qwestip.net 49.802 ms |
11 iar2-so-2-3-0.Denver.cw.net (208.172.173.89) [AS3561] hostmaster@cw.net 49.801 ms |
12 acr2.Denver.cw.net (208.172.162.62) [AS3561] hostmaster@cw.net 51.754 ms |
13 agr3-loopback.Washington.cw.net (206.24.226.103) [AS3561] hostmaster@cw.net 97.650 ms |
14 dcrl-so-6-2-0.Washington.cw.net (206.24.238.57) [AS3561] hostmaster@cw.net 97.650 ms |
15 bhrl-pos-0-0.Sterlingldc2.cw.net (206.24.238.34) [AS3561] hostmaster@cw.net 100.579 ms |
16 216.33.98.154 (216.33.98.154) [AS3967] hostmaster@exodus.net 101.556 ms |
17 209.225.34.218 (209.225.34.218) [AS3967] hostmaster@exodus.net.34.225.209.in-addr.arpa 101.556 ms |
18 216.239.48.94 (216.239.48.94) [AS15169] dns-admin@google.com 108.391 ms |
| Tools | Note that this method allows for anonymity (goes through Opus firewall - see initial hops) as well as retrieves ASN numbers, POC information and DNS numbers. |
| Attack Methods | Sometimes, during traceroute, an attacker may not be able to go through a packet filtering device such as a firewall. |
| |
| |
| Tools | NeoTrace is a diagnostic and investigative tool. It traces the network path across the Internet from the host system to a target system anywhere on the Internet. Automatic retrieval of data includes registration details for the owner of each computer on the route (address, phone, email address) and the network each node IP is registered to. Easy to read views of the data include a world map showing the locations of nodes along the route, a graph showing the relative response time of each node along the path, and a configurable list of node data. |
In the screenshot shown above, we have done a traceroute for www.google.com The 3.20 version had node view, map view and list view. Note that the DNS entries have been retrieved for the various nodes and the map view allows the user to see relatively easily if a particular system is based geographically where it claims to be.
| Concept | There are two aspects to traceroute - depth and breadth. There are two basic methods for searching graphs - breadth and depth. Breadth searches branch out examining all nodes within a certain hop distance, slowly increasing until the destination is discovered . Depth first search follows one path until it is exhausted, and then backs up slowly recalculating all the permutations of the preceding paths. Traceroute generates an UDP message to an unused port and sends this message with an increasing TTL value. The search ends when a port unreachable message is received. |
There are many ICMP error messages that can be generated. One of these messages is ICMP port unreachable (since ports exist in TCP or UDP). However, the port unreachable message must be distinguished from such messages generated from different applications - such as from a packet filtering device.
| |
| |
| Tools | VisualRoute is a graphical tool that determines where and how traffic is flowing on the route between the desired destination and the user trying to access it, by providing a geographical map of the route, and the performance on each portion of that route. |
VisualRoute delivers the functionality of key Internet "ping," "whois," and "traceroute" tools, in a visually integrated package. In addition, VisualRoute has the ability to identify the geographical location of routers, servers, and other IP devices. This is valuable information for identifying the source of network intrusions and Internet abusers. It helps in establishing the identify of the originating network, the web software that a server is running, detecting routing loops and identifying hosts that have the ICMP TTL bug.
VisualRoute's traceroute provides three types of data: an overall analysis, a data table, and a geographical view of the routing. The analysis is a brief description in of the number of hops, areas where problems occurred, and the type of Web server software running at the destination site. The data table lists information for each hop, including the IP address, node name, geographical location and the major Internet backbone where each server resides.
The World map gives a graphical representation of the actual path of an Internet connection. Users can zoom in/out and move the map around to position it as desired. A mouse click on a server or network name opens a pop-up window with the whois information including name, telephone and email address, providing instant contact information for problem reporting.
The screenshot above shows traceroute done to www.google.com VisualRoute can be downloaded at http://www.visualware.com/download/index.html#visualroute [1]
| |
| |
| Tools | SmartWhois is a network information utility that allows the user to find all the available information about an IP address, hostname, or domain, including country, state or province , city, name of the network provider, administrator and technical support contact information. |
Unlike standard Whois utilities, SmartWhois can find the information about a computer located in any part of the world, intelligently querying the right database and delivering all the related records in a short time. The program can retrieve information from more than 20 servers all over the world. SmartWhois can also save obtained information to an archive file. This is particularly useful in tracking incidents and incident handling. It allows users to load this archive the next time the program is launched and add more information to it. Thus, the list is updated on a regular basis. This feature allows building and maintaining a user defined database of IP addresses and hosting names. Alternatively, users can also load a list of IP addresses as a text file and have SmartWhois process the whole list. SmartWhois is available for download at www.tamos.com SmartWhois is capable of performing both IP address/hostname and domain name queries. TamoSoft, Inc. also hosts a tools interface at http://all-nettools.com/tools1.htm where a compilation of all the utilities discussed above are given. SmartWhois also has a visual interface that allows easier comprehension of the query.
| Countermeasure | Probably, the advantage of SmartWhois over regular whois is the ability to archive and update archived information. This is more useful if the user can save his notes along with the IP for later reference. Custom queries can also be made to find additional information that is not returned by standard queries. [2] |
| |
Adam makes a few searches and gets some internal contact information. He calls the receptionist and informs her that the HR had asked him to get in touch with a specific IT division personnel. It's lunch hour , and he says he'd rather mail to the person concerned than disturb him. He checks up the mail id on newsgroups and stumbles on an IP recording. He traces the IP destination.
-
What preventive measures can you suggest to check the availability of sensitive information?
-
What are the implications for the target company? Can he cause harm to targetcompany at this stage?
-
What do you think he can do with the information he has obtained?
| |
| Attack Methods | Revisiting Adam... The scenario described here is one of the many ways social engineering can take place. For instance, an attacker may come across a newbie posting / verbose posting on a discussion forum, where personal email information is given. The attacker can use the information in the posting as a reason to solicit the user over his private mail and gain more information. |
Adam may even ask some of his new friends for their email ID on the pretext of sending across an interesting read. There are several resources on the topic of social engineering, but it needs to be remembered that hackers are creative people who can come up with more than one way of getting information. Let us assume that Adam is in possession of some inside information and that he has bypassed the firewall. Is there any means of detecting his action?
An oft repeated hacker advice is to target the system during business hours as the log files would be overwhelming and probably the intrusion would go undetected. IP Spoofing is the technique used by attackers to gain access to a network by sending messages to a computer with an IP address indicating that the message is coming from a trusted host.
To engage in IP spoofing, an attacker must first find an IP address of a trusted host and then modify the packet headers so that it appears that the packets are coming from that host. As routers only use the "destination IP" address in order to forward packets through the Internet, but ignore the "source IP" address which is only used by the destination machine when it responds back to the source. These attacks exploit applications that use authentication based on IP addresses.
| |
VisualLookout provides high level views as well as detailed and historical views that provide traffic information in real-time or on a historical basis.
In addition the user can request a "connections" window for any server, which provides a real-time view of all the active network connections showing
-
who is connected,
-
what service is being used,
-
whether the connection is inbound or outbound, and
-
how many connections are active and how long they have been connected.
| |
| Tools | Visual Lookout is a real time TCP/IP monitor that can help detect intrusions that have crossed the firewall. This tool is discussed here as it shares features with the other visualware products. Readers please note that this is basically an IDS tool that can help in analyzing and checking intrusions. The tool provides a range of alarm mechanisms including email, SNMP and Visual alerts. |
| Countermeasure | Traffic is an important measure when identifying possible hacker attacks or even Denial of Service (DOS) attacks. A change in traffic patterns from normal values is an important first clue to possible unwanted visitors . VisualLookout provides the ability to view any of the important traffic metrics as a graphical representation both from a real-time and historical perspective. VisualLookout provides the ability to capture connection activity for any server or computer system that it is monitoring. The search feature locates any connection activity based on inbound or outbound port or IP address/domain name, and can replay the history period of interest as though the session were in real time. |
| |
| |
E-mail spoofing is a security concern that most organizations face. This is often part of a social engineering tactic employed by attackers. Sometimes, even passwords are easily obtained, if user awareness of the consequences is not there. The reason why this is a sought after information is because SMTP (Simple Mail Transfer Protocol) lacks authentication and hence spoofing is easy.
| Attack Methods | An Nslookup can reveal a MX server. The attacker can connect to the SMTP port and issue commands (in accordance with that protocol), can breach the security of the firm / user if a vulnerability can be exploited. The attacker can use this to send email that will appear to be from the address of the target user. The attacker can even send a mail asking users to change passwords on behalf of the system administrator. |
| Countermeasure | The best way to eliminate IP spoofing attacks is to install a filtering router that restricts the input to the external interface by not allowing a packet through if it has a source address from the internal network. In addition, the organization should filter outgoing packets that have a source address different from the internal network to prevent a source IP spoofing attack from originating from its site. The combination of these two filters would prevent outside attackers from sending the target system packets pretending to be from the internal network. It would also prevent packets originating within the network from pretending to be from outside the network. |
| |
| |
| Tools | Let us take a look at a tool which can help security personnel in tracking a spoofed mail or even ordinary email. This mail tracker is part of VisualRoute which was discussed previously. This is useful when the email address is the only information available at hand. |
| Threat | An attacker might use this to track the user to their e-mail server. An added benefit is that he will be able to see what SMTP software the mail server is running (many times with version information as well). Information about the mail server can help if the attacker knows a vulnerability that can be exploited in order to gain more access to other resources or to cause damage to the system. |
In the screenshot above, we can see the various IP addresses in the concerned domain, the time zone, the network involved as well as the location. An attacker can search for vulnerable hosts on the same network or if on the same network, can initiate a DOS attack to the target machine and use the target IP (when the target dies) to spoof his way to additional resources.
Readers who are interested in reading a real scenario may refer to the 'Bunratty Attack' by Vince Gallo. It shows how he created covert channels using valid mapi email. A copy of the presentation is available at http://chi-publishing.com/isb/backissues/ISB 2001/ISB0605/ISB0605VG.pdf
It demonstrates how one can use a valid application (in this case mapi email) to covertly communicate with and even remotely control a system on an otherwise protected network. All traffic appears to be valid email.
The other tool that can analyze email headers is eMailTrackerPro, which is discussed next.
| |
| |
| Tools | eMailTrackerPro analyzes the e-mail header and provides the IP Address of the machine that sent the e-mail. This can then be used to track down the sender. This is especially helpful in preventing spamming and spoofing. |
An email spoofer may just be trying to cause trouble or discredit the person being spoofed by sending some truly vile message to the recipient. The built-in location database tracks e- mails to a country or region of the world. eMailTrackerPro also provides hyperlink integration with VisualRoute.
Example: Received: from BBB (dns-name [ip-address]) by AAA ...
For tracking purposes, we are most interested in the from and by tokens in the Received header field. Where: name is the name the computer has named itself. dns-name is the reverse dns lookup on the ip-address. ip-address is the ip-address of the computer used to connect to the mail server that generated this Received header line. The ip-address is important for tracking purposes.
| Note | Always base tracking decisions based upon the IP Addresses that are in the header information and not on host names (which are a lookup from the IP Address anyway). Because mapping an IP Address into a host name and then back into an IP Address may yield a different IP Address. However, attackers can defeat this by using an 'anonymizer' service for web based emails -- where they can use the IP Address of the 'anonymizer' company, and open mail relay servers for normal emails. |
| |
-
Information gathering phase can be categorized broadly into seven phases.
-
Footprinting renders a unique security profile of a target system.
-
Whois, ARIN can reveal public information of a domain that can be leveraged further.
-
Traceroute and mail tracking can be used to target specific IP and later for spoofing.
-
Nslookup can reveal specific users and zone transfers can compromise DNS security.
| |
[1] (Source: www.visualware.com)
[2] (Source: www.tamos.com)
EAN: N/A
Pages: 109