INFORMATION GATHERING IN A PENTEST
By : Syarif @fl3xu5
Cybercrime Investigation Center Mabes Polri Jakarta, 28 Januari 2012
Agenda
About Pentest ( Penetration Testing )
Pentest Phase
How Important do Information Gathering
Passive & Active Information Gathering
Google Hack
Netcraft
Whois
host
dig
About Pentest ( Penetration Testing )
A method to evaluate the security of computer system / network
Practice ( attacking ) an IT System like a ‘hacker’ do
Find a security holes ( systemic weaknesses )
By pass security mechanism
compromise an Organization’s IT System Security
Must have a permission from IT System owner
~ The Person is called a Pentester ~
Pentest Phase
Information Gathering
Vulnerability Analysis
Exploitation
Post Exploitation
Reporting
How Important do Information Gath.
Information Gath. Chance of Successful attack~
Passive & Active Information Gathering
Passive Information Gathering Active Information Gathering
Google Hacking
Netcraft
Whois
Nslookup
Port Scanning
Service Scanning
Nmap
Metasploit
Google Hack
was introduced by Johnny Long
based on google basic usage information :http://www.google.com/help/basics.html!
More : http://www.google.com/help/operators.html
Google Hack ( cont’d )
Google basic search help
Google Hack ( cont’d )
Operators and More Search help
Google Hack ( cont’d )
Examples :
Google Hack ( cont’d )
Examples :
Google Hack ( cont’d )
Examples :
Google Hack ( cont’d )
Other Examples :
Google Hack ( cont’d )
Other Examples :
Google Hack ( cont’d )
More Examples :
Netcraft
an Internet monitoring company based on England
Uptimes
OS detection
web server
Netcraft ( cont’d )
Whois
host
dig
REFERENCES
http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines
http://www.metasploit.com/about/penetration-testing-basics/
Metasploit The Penetration Tester’s Guide : David Kennedy , Jim O’Gorman, Devon Kearns, Mati Aharoni
GHDB , http://johnny.ihackstuff.com/ghdb/
Recommended
