What is Reconnaissance?
Reconnaissance is the information-gathering stage of ethical hacking, where you collect data about the target system. This data can include anything from network infrastructure to employee contact details. The goal of reconnaissance is to identify as many potential attack vectors as possible.
Data collected from reconnaissance may include:
- Security policies. Knowing an organization’s security policies can help you find weaknesses in their system.
- Network infrastructure. A hacker needs to know what type of network the target is using (e.g., LAN, WAN, MAN), as well as the IP address range and subnet mask.
- Employee contact details. Email addresses, phone numbers, and social media accounts can be used to launch social engineering attacks.
- Host information. Information about specific hosts, such as operating system type and version, can be used to find vulnerabilities.
How Does Pentesting Work?
Pen testing utilizes ethical hackers to put themselves in the shoes of malicious actors. Network owners establish a specific pentesting scope that specifies what systems are eligible for testing and the test timeframe.
Determining scope sets guidelines and sets the tone and limitations for what the testers can and cannot do. After a scope and timeframe have been established, the ethical hackers get to work scanning for ways into the network.
Pentesting Techniques
There are few types of Pentesting Techniques available
Black Box
Black box testing, also referred to as external penetration testing, gives the ethical hacker little to no early information about the IT infrastructure or security of the company beforehand. Black box tests are often used to simulate an actual cyberattack.
Tests start from outside the network where the tester doesn’t know about in-place security systems or local network architecture. Since the simulated attack is blind, these tests can be the most time-consuming.
White Box
White box testing is where the tester has full knowledge of the network infrastructure and security systems in place. While these tests don’t mimic what a real outside attack might look like, they are one of the most thorough types of tests you can have performed.
White box tests can also simulate what an inside attack may look like since the tester starts inside the network with insider knowledge of how the network is structured. While white box testing can be completed quickly due to its transparent nature, enterprise organizations with many applications to test may still have to wait several months for complete results.
Gray Box
Gray box is a blend of the first two techniques and allows the tester partial access or knowledge into the company network. Gray box is often used when testing a specific public-facing application with a private server backend. With this combined information, the tester can attempt to exploit specific services to gain unauthorized access into other parts of the network.
The timeframe for a gray box test is usually less than a black box test, but longer than a white box test due to the testers’ limited network knowledge of the network.
Pentest Target
Different areas of a company that may get penetration tested include:
- Web applications
- Wireless networks
- Physical infrastructure
- Social engineering
- Recon-ng
- the Harvester
- nmap
- Zenmap
- DNSRecon
- Netdiscover
- Malego
- Unicornscan
- p0f
- Masscan
- Zmap
Services
- Secure Private Cloud
- Programming
- Secure Websites
- Linux Security
- Windows Security