Footprinting and Reconnaissance
Footprinting is the first phase of ethical hacking: collecting as much information as possible about a target before attacking it.
Passive vs active footprinting
- Passive footprinting gathers information without direct interaction with the target, e.g. search engines, WHOIS, social media, job postings, archived websites (Wayback Machine).
- Active footprinting interacts with the target directly, e.g. DNS zone transfers, ping sweeps, traceroute, social engineering.
Google hacking
Advanced search operators (Google dorks) find exposed information:
| Operator | Purpose |
|---|---|
site: |
restrict results to a domain |
filetype: |
find files of a type, e.g. filetype:pdf |
intitle: |
words in the page title |
inurl: |
words in the URL |
cache: |
Google's cached copy |
The Google Hacking Database (GHDB) on Exploit-DB collects useful dorks.
WHOIS and DNS
WHOIS reveals registrant, registrar, name servers and dates. DNS records to know: A (IPv4), AAAA (IPv6), MX (mail), NS (name server), CNAME (alias), TXT, SOA (start of authority), PTR (reverse lookup).
A DNS zone transfer (AXFR) copies the whole zone; a misconfigured server allows it to anyone:
dig axfr @ns1.example.com example.com
Countermeasures
Limit information on public sites, use WHOIS privacy, restrict zone transfers to authorised secondary servers, and train staff about social engineering.