Information Gathering [Updated 2019]

by Ivan Dimov on May 3, 2019

Learn about passive intelligence gathering

Learn about passive intelligence gathering, one of the key aspects of ethical hacking, in this four-video overview course. This skills course covers

⇒ Passive Intelligence Gathering
⇒ Abusing DNS and SNMP
⇒ TCP-IP for Hackers

Start your free trial

Introduction to Information Gathering

Penetration testing begins with a pre-engagement phase in which the pen tester gets acquainted with the client, the goals, limitations, and scope of the penetration test. After that, the pen tester begins the actual penetration test and usually proceeds with an information gathering endeavor in which the pen tester locates publicly available information related to the client and seeks ways that could be exploited to get into the systems. In this phase, the pen tester also uses tools such as port scanners which can help him/her get an understanding of the systems in the network and the software that is on them. Using that information, the pen tester can pinpoint what impact the different findings may have on the client and the vulnerability analysis part can proceed where the information found is used to locate possible vulnerabilities in the systems and the subsequent exploitation phase where the vulnerabilities are attempted to be exploited to get into the system. Thus, without good information gathering – there would be no vulnerabilities to find and exploit.

Now is the time to make an important distinction – that between passive and active information gathering. Passive information gathering refers to gathering as much information as possible without establishing contact between the pen tester (yourself) and the target about which you are collecting information. Active information gathering involves contact between the pen tester and the actual target. When you actively query systems to gain the information you are moving to a dark legal situation as most countries prohibit (Read more...)