CCTC Networking Reconnaissance perfect solution latest

rated A+

Passive Recon

✓ Watching a target, surveillance, only using traffic created by the target

- IP addresses/Sub-domains
- People
- Technologies
- Content of Interest
- Vulnerabilties

Active Recon

✓ Poking around, searching for information, creating data, leaves more artifacts behind

OSINT

✓ Open Source Intelligence

Gathering publicly available information, typically from the internet

Social Engineering Techniques

- Pre-Texting
- Reciprocity
- Scarcity
- Authority
- Social Proof
- Sympathy

Tactics
- Mental Buffer Overflow
- Primed Questions

Scapy

✓ Port scanning
Packet building

Netcat

- Transfer Files
- Port Scan
- Banner Grabbing (fingerprinting)
Nmap

- Port scanning
- Fingerprinting

What are the Stealth Scans

✓ FIN
Null
X-Mas

SYN Scan

✓ -sS

--> SYN
<-- SYN-ACK
--> RST

Half opens the port (no ACK in handshake)

Not quite stealthy

ACK Scan

✓ -sA

--> ACK

Maps out firewall rules, determine if they are stateful and which are filtered

TCP Connect Scan

✓ -sT

--> SYN
<-- SYN-ACK
--> ACK
--> RST

Completes full 3 way handshake

Very loud

Null Scan

✓ -sN

TCP header is set to 0, no bits sent

Stealthy
FIN Scan

✓ -sF

--> FIN

Sends only FIN

Stealthy

X-Mas Tree Scan

✓ -sX

--> FIN-PSH-URG

Lights up flags like Christmas tree

Stealthy

UDP Scan

✓ -sU

Sends empty UDP packet

No response means port is open
Might bypass a stateful firewall

ICMP will respond with Destination Unreachable/Port Unreachable (3/3) message

Prevent ICMP packets from getting out of the network to protect your system

Linux TCP Scan Response

✓ Closed Ports: RST

Open Ports: No Response

Windows TCP Scan Response

✓ Closed Ports: RST

Open Ports: RST

Gratuitous ARP

✓ Should disable on network

Broadcast ARP message not prompted by an ARP request

ICMP Redirect

✓ Should disable on network

Sent to router to update routing table based off a more optimal route

Source Routing

✓ Source dictates path packet takes

p0f

- Fingerprinting tool
- Requires root privileges