Identifying the Target Passive Reconnaissance in Kali Linux

Reconnaissance is the first step of the kill chain when conducting a penetration

test or an attack against a network or server target. An attacker will typically dedicate up to seventy-five percent of the overall work effort for a penetration test to reconnaissance, as it is this phase that allows the target to be defined, mapped, and explored for the vulnerabilities that will eventually lead to exploitation. There are two types of reconnaissance: passive reconnaissance, and active reconnaissance.

Passive reconnaissance is concerned with analyzing information that is openly available, usually from the target itself or public sources online. On accessing this information, the tester or attacker does not interact with the target in an unusual

Manner—requests and activities will not be logged, or will not be traced directly to the tester. Therefore, passive reconnaissance is conducted first to minimize the direct contact that may signal an impending attack or to identify the attacker.

Basic principles of reconnaissance

Reconnaissance, or recon, is the first step of the kill chain when conducting a penetration test or attack against a data target. This is conducted in before the

actual test or attack of a target network. The findings will give a direction to where

additional reconnaissance may be required, or the vulnerabilities to attack during

the exploitation phase.

Reconnaissance activities are segmented on a gradient of interactivity with the target network or device.

i)             Passive reconnaissance (no direct interaction)

ii)            Normal interaction

iii)           Active reconnaissance

iv)           More information greater chance of detection

Passive reconnaissance does not involve direct interaction with the target network.

The attacker's source IP address and activities are not logged (for example, a Google

search for the target's e-mail addresses). It is difficult, if not impossible, for the target

to differentiate passive reconnaissance from normal business activities. In general, passive reconnaissance focuses on the business and regulatory environment, the company, and the employees. Information of this type is available on the Internet or other public sources, and is sometimes referred to as open source intelligence, or OSINT.

•           Passive reconnaissance also involves the normal interactions that occur when

an attacker interacts with the target in an expected manner. For example, an attacker will log on to the corporate website, view various pages, and download documents for further study. These interactions are expected user activities, and are rarely detected as a prelude to an attack on the target.

•               Active reconnaissance involves direct queries or other interactions (for example, port scanning of the target network) that can trigger system alarms or allow the target to capture the attacker's IP address and activities. This information could be used to identify and arrest an attacker, or during legal proceedings. Because active reconnaissance requires additional techniques for the tester to remain undetected.

Penetration testers or attackers generally follow a process of structured information gathering, moving from a broad scope (the business and regulatory environments) to the very specific (user account data).

To be effective, testers should know exactly what they are looking for and how the data will be used before collection starts. Using passive reconnaissance and limiting

the amount of data collected minimizes the risks of being detected by the target.