Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Introduction
The basic stages of hacking described by the textbook are passive reconnaissance, active
reconnaissance, exploitation, and post-exploitation. Although this lab involves tools and procedures for
passive reconnaissance, a quick review of each stage is warranted in order to understand how
thorough passive reconnaissance plays a critical role in the later stages of hacking.
A good analogy for passive reconnaissance is a burglar casing a home from the outside, noting its
possible vulnerable entry points. The burglar has not committed any active penetration of the home or
peeked through a window to see the contents of the home, so his actions do not violate any laws at
this particular point in time. The burglar is just getting the lay of the land.
Passive reconnaissance is the act of gathering information about a target without using or interacting
with the target. It is like spying on the target with binoculars or interviewing the target's acquaintances
or coworkers but not actually speaking with the target just yet.
In a real-world situation, a hacker will conduct passive reconnaissance to gather information that can
be used to formulate an attack against users and systems. Passive reconnaissance is typically
followed by active reconnaissance, also called the scanning and enumeration phase, in which the
hacker attempts to actively probe the systems identified during passive reconnaissance. Passive
reconnaissance is also sometimes referred to as open-source intelligence gathering (OSINT), as it
uses publicly available sources to collect intelligence on a target.
The exploitation stage occurs when the hacker gains access to the target by exploiting the
vulnerabilities and weak points identified during the reconnaissance stages. In the post-exploitation
stage, the hacker maintains access to the target system and may crack hashes to obtain access to
additional services or hosts, kill antimalware software, disable firewalls, and compromise additional
hosts. Actions normally include bypassing access controls, performing privilege escalation, and
potentially, exfiltration of sensitive data (grabbing the loot!).
In this lab, the focus of the steps taken will be on passive reconnaissance. Common tools for this
reconnaissance will be introduced and will yield valuable information about the target organization
being investigated.
Lab Overview
SECTION 1 of this lab has two parts, which should be completed in the order specified.
1. In the first part of the lab, you will use a search engine to perform passive reconnaissance.
2. In the second part of the lab, you will examine WHOIS records.
Page 1 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
SECTION 2 of this lab allows you to apply what you learned in SECTION 1 with less guidance and
different deliverables, as well as some expanded tasks and alternative methods. You will use
theHarvester and Maltego to collect information about a target.
Finally, you will explore the virtual environment on your own in SECTION 3 of this lab to answer a set
of questions and complete challenges that allow you to use the skills you learned in the lab to conduct
independent, unguided work – similar to what you will encounter in a real-world situation.
Learning Objectives
Upon completing this lab, you will be able to:
1. Use customized Google searches to conduct open-source intelligence gathering.
2. Use Google's Advanced Search Operators to gather technical information about targets.
3. Query Internet registration authorities for domain information.
4. Use theHarvester to scrape information from public databases.
5. Use Maltego to identify publicly available email addresses and domain names.
Topology
This lab contains the following virtual machines. Please refer to the network topology diagram below.
AttackWindows01
Page 2 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Tools and Software
The following software and/or utilities are required to complete this lab. Students are encouraged to
explore the Internet to learn more about the products and tools used in this lab.
Google
Google Advanced Search
Maltego
theHarvester
WHOIS
nslookup
Deliverables
Upon completion of this lab, you are required to provide the following deliverables to your instructor:
Hands-On Demonstration
1. Lab Report file, including screen captures of the following:
Page 3 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
The site: search results
The inurl: search results
Results of the WHOIS search
Results of the nslookup MX query
Results of the nslookup NS query
2. Any additional information as directed by the lab:
The differences in the search operator results
Any search results that provided information that might be useful to the ethical hacker
The most recent date for an update to the domain record for the target domain
Applied Learning
1. Lab Report file, including screen captures of the following:
Search results from theHarvester using Bing
Search results from theHarvester using DuckDuckGo
Graph of the NS Records for the target domain
Graph of Have I Been Pwned results
Graph of the email addresses for the target domain
First page of the IP addresses and domain names for the target domain
Challenge and Analysis
1. Any additional information as directed by the lab:
The documented information for the chosen target domain
Page 4 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Page 5 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Section 1: Hands-On Demonstration
Part 1: Explore Google Hacking Techniques
Note: In this part of the lab, you will explore a form of passive reconnaissance called Google hacking.
Google hacking, also referred to as Google Dorking, is the act of using a search engine, such as
Google, to locate sensitive information or security vulnerabilities that are not discoverable through
normal search queries. Of course, the search results do not specify what any vulnerability found might
be. Nor are you guaranteed to find a vulnerability by relying on only search results.
As with any search, you first need an idea of what you want to find. Most people associate an Internet
search with the act of searching the text published on a web page. When searching for a vulnerability,
however, you want to use advanced search criteria to specify properties found in the web address,
underlying website code, documentation or configuration files that reveal the infrastructure or
organization, and even devices that shouldn’t be exposed to the public. Google has a set of advanced
search criteria that can expose vulnerabilities that would otherwise be buried deep in normal search
engine results.
In the next steps, you will practice using Google’s flexible search operators to find relevant results.
1. In the AttackWindows01 taskbar, click the Firefox icon to open a new browser window.
Firefox icon
2. In the browser's address box, type https://www.google.com and press Enter to open the
Google search page.
Page 6 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Navigate to https://www.google.com
3. In the Google search box, type new york times and press Enter to see the search results.
Google new york times
Note: This is a simple Google search that returns its results in order of relevance to the search term
you entered. The top result, unsurprisingly, is the website for the New York Times newspaper. But
other results on the page may or may not originate from the newspaper’s own website. When “new
york times” is typed into the search bar without additional operators, the search returns all web pages
that have any one or more of the words “new,” “york,” and “times” in their content. To narrow down
the results, use a set of quotes around the words (e.g., “new york times”) to package the search
terms. Then, only websites that have all three words “new york times” in that order are returned.
Page 7 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
You can also use what are called “search engine math” operators (also called Boolean operators) to
narrow down the results returned. The plus operator, “+”, is used when the following word must be
included in the content of returned web pages. For example, in the Google search bar, you could type
“new york times” +arrest, and web pages that contain the words “new york times” together and the
word “arrest” in their content would be returned. The “+” operator adds the must contain requirement.
Similarly, the minus operator, “-”, adds a must not contain requirement. For example, if you typed
“new york times” -mayor, these search terms would return web pages that contain the words “new
york times” together but do not contain the word “mayor.” Later in this lab, you will use Google
Advanced Search to similarly refine the results returned.
4. In the Google search box, type site:nytimes.com (the actual URL for the newspaper’s
website) and press Enter to restrict the search results to only those from that domain.
Filter Google results by site
Note: This time, the search results are limited to pages within the nytimes.com domain. You will also
see results from subdomains of nytimes.com, such as cooking.nytimes.com and
download.nytimes.com.
Page 8 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
5. Make a screen capture showing the site:nytimes search results.
6. In the Google search box, type inurl:nytimes.com and press Enter to restrict the search
results to any URL that includes nytimes.com.
Filter Google results by URL
Note: One advantage of using the inurl operator instead of the site operator is that inurl finds
subdirectories, whereas site does not. Remember, a subdirectory (example.com/subdirectory/) is not
the same as a subdomain (subdomain.example.com).
7. Make a screen capture showing the inurl:nytimes search results.
8. Repeat step 6 using the following search operators:
link:
related:
Page 9 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
info:
Filter Google results by link
Filter Google results by related
Page 10 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Filter Google results by info
Note: The operator link: finds pages linking to a specific domain or URL. The operator related: finds
sites related to a given domain. The operator info: finds information about a specific page, such as the
most recent cache or similar pages. Google sought to eliminate the link: operator in 2017, but it may
still yield results. For a full list of useful operators and creative ways to use Google operators, check
out the website at https://ahrefs.com/blog/google-advanced-search-operators/.
9. Briefly describe the differences you noticed in the search results for each search operator
and identify one or two scenarios in which any of these particular findings could be useful to
the ethical hacker.
Note: Effective Internet reconnaissance takes practice. Search engines use punctuation, symbols,
and Boolean operators to refine search results. Often, the results of an initial search will lead the
researcher to experiment with a variety of refinement techniques to find the target of the search.
Google publishes a support page that describes its refinement options at
https://support.google.com/websearch/answer/2466433.
In the next steps, you will use Google’s Advanced Search page to experiment with search string
Page 11 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
syntax.
10. In the browser's address box, type https://www.google.com/advanced_search and
press Enter to open Google’s Advanced Search page.
Navigate to Google's advanced search
In general, when experimenting with search options, it is a good idea to change one piece of search
criteria at a time, noting how that change affects the outcome. Google’s Advanced Search page
enables you to tweak searches in just this way.
11. In the all these words box, type new york times and press Enter to initiate the search.
Page 12 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Search for all these words: new york times
12. Review the resulting URL to understand how Google translates the search query.
Note: The URL for this search was
https://www.google.com/search?as_q=new+york+times&as_epq=&as_oq=
&as_eq=&as_nlo=&as_nhi=&lr=&cr=&as_qdr=all&as_sitesearch=&as_occt=any&safe=images&
tbs=&as_filetype=&as_rights=
The first variable, as_q, represents the first search box, all these words. The following list describes
how each variable on the Advanced Search page can be used to refine a search.
as_q: Matches all the words in the search box. For example, for a search on “new york,” it will
find instances both of “new” and “york.”
as_epq: Matches a specific phrase. For example, it will find the phrase “new york.”
as_oq: Matches any of the words in the search box. For example, it will find “new” OR “york.”
as_eq: Excludes search terms.
as_nlo: Represents the low number in a range of numbers.
as_nhi: Represents the high number in a range of numbers.
lr: Specifies a language for the search.
cr: Specifies a country for the search.
as_qdr: Matches a timeframe reference. This variable uses abbreviations, so m is month, y is
year, etc.
Page 13 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
as_sitesearch: Limits the search to a particular domain.
as_occt: Limits the search to a part of the webpage, like titles, images, hyperlinks, or URLs.
as_filetype: Specifies a type of file for the search, like .pdf, .xls, .doc, etc.
safe: Filters adult content, if activated.
tbs: Filters Creative Commons licenses for copyrighted material.
Each of these variables expects the associated parameter to be formatted a particular way. When you
understand the syntax used in the URL, you can enter your search query directly in the address box
and skip the search form altogether.
13. In the browser's address box, type
https://pentest-tools.com/information-gathering/google-hacking and
press Enter to open a site used for conducting Google hacking.
Navigate to pentest-tools.com's Google hacking site
Note: At this point in the lab, you will need to pick an organization's domain to use for your passive
reconnaissance research. You may select your own, or elect to use one of the following:
Amazon.com
Page 14 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Target.com
14. In the Target website/domain box, type your chosen target, select the Directory listing
vulnerabilities Google Dork option, and click Search Google to open a new Google search
window.
Select a target website and a Google Dork option
Note: Directory listing vulnerabilities can leak a complete index of all resources located in a directory.
These vulnerabilities can result in exposure of files that ought to remain hidden, such as applications
in development, data files, or backed-up source code.
15. Repeat Step 14 for the following Google Dork options:
Publicly exposed documents
Configuration files exposed
Database files exposed
Log files exposed
Backup and old files
Login pages
SQL errors
phpinfo()
Page 15 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Note: The “Configuration files exposed” search will reveal any configuration files accessible online in
unsecured file repositories, which can be data mined for information to be used in future attacks. The
“Database files exposed” search will reveal any database files accessible online in unsecured
databases, such as tables and queries. A “Log files exposed” search reveals log files not meant for
public access. Log files are good examples of how sensitive data can be exposed within any website.
Error, application, and access logs are often found, surprisingly enough, inside the public HTTP space
of a website, which can help attackers identify the PHP version being run and critical paths of the
framework. A “SQL error” search may reveal sensitive data when inadvertently used in a query. There
may be SQL dumps that are stored via improper backup procedures that can be identified by their .zip
extension. A “phpinfo()” search is a useful search because it returns any exposed Environment, GET,
POST, Cookie, and server data.
16. Describe any search results obtained in steps 14 and 15 that you think might provide a
malicious hacker with information that could be used to target users or systems of your chosen
organization.
Part 2: Explore the WHOIS Database
Note: If you have ever registered your own domain, you know how much contact information you must
provide to complete the registration. The registrant must provide name, address, telephone, and email
contact information. Likewise, information for both a technical contact and an administrative contact is
also expected. Those contacts can be the same as or different from the registrant. The requirements
are the same whether the registrant is a billion-dollar corporation or a private individual—there is no
preferential treatment. Each registration is made with a domain name registrar.
For the internet to work on a global scale, the registrations need to be managed so that there are no
conflicts. The organization responsibile for this is the Internet Corporation for Assigned Names and
Numbers (ICANN). Historically, this organization had been under the oversight of the U.S. Department
of Congress. That oversight ended in 2016. Now ICANN operates as a corporation with multiple global
stakeholders. ICANN manages the set of top level domain names. It also maintains contracts with
other organizations for managing each of those top level domains. These contracts provide the
avenue for conflict resolution for domain names.
All the information about the registrants for domain names is made publicly available in an online
database. Because this information is publicly available, it is a common target of passive
reconnaissance, both in social engineering and in launching a technical exploit.
In the next steps, you will query the WHOIS database.
1. In the browser's address box, type https://who.is and press Enter to open the WHOIS
Page 16 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
website.
Navigate to who.is
2. In the search field, type your target domain and press Enter to conduct a WHOIS query on
your chosen domain.
Query your target domain
Note: The results of the search will appear in the middle of the page. You may need to use the
scrollbar to view them. In addition to the WHOIS information, the site will also include information
about the domain website, registration history, Domain Name System (DNS) records, and more. You
Page 17 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
can click the relevant tab above the initial search results to see the remaining information.
The registrar section gives information about the organization that maintains the information about the
domain. The name servers section gives the hostnames for machines that are authoritative name
servers for the domain. The organization registering the domain name must provide this information to
the registrar if it runs its own name servers. Many registrars also offer DNS as a service and will
operate name servers for the domain. The registrar data section contains the actual information about
the domain owner. It should show the three contacts registrant, administrative, and technical.
3. Make a screen capture showing the results of the WHOIS search.
4. Document the date of the most recent update to the domain record.
5. In the browser window, click the DNS Records button to see the DNS results.
DNS Records button
Note: You should see a table of DNS results. The Domain Name System provides a means to look up
information by host name or by address. DNS information is obtained by submitting a query to a DNS
Page 18 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
server. The server can then respond by using information it knows or by sending the query to a server
that knows more about the requested domain.
In the table you should see five columns: Hostname, Type, TTL, Priority, and Content. The hostname
indicates the name that the record applies to. There are multiple types of DNS records. The most
common ones are:
SOA records – start of authority records, which establish fundamental information about the
domain
NS records – provide addresses for name servers for the domain
A records – provide IPv4 addresses for hosts in the domain
AAAA records – provide IPv6 addresses for hosts in the domain
MX records – provide names for mail servers for the domain
CNAME records – provide an alias for a name in the domain
The TTL column represents the time to live for a record in seconds. The record can be cached for that
amount of time before querying the authoritative server again. The priority field is used by MX records
to indicate the order in which mail servers should be used. The content field provides the relevant
information. For NS, MX, and CNAME records, it contains a host name. For A and AAAA records, it
contains the address. For SOA records, it contains several pieces of information about the domain and
various time limits.
6. Close the browser window.
Note: You can also use nslookup to examine Mail Exchange (MX) records.
7. On the AttackWindows01 taskbar, click the Command Prompt icon to open a new command
prompt.
Page 19 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Command Prompt icon on the Windows taskbar
8. At the command prompt, type nslookup and then press Enter to get a query prompt.
nslookup command
Note: The following displays:
Default Server: <FQDN of your server>
Address: <server IP address>
9. At the nslookup prompt, type set type=mx and then press Enter to set the query type to
MX.
Page 20 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
set type=mx
10. At the nslookup prompt, type the target domain to look up and then press Enter to execute a
query.
Query your target domain
11. Make a screen capture showing the results of the MX query.
Note: The MX records of that domain will appear. To look up the domain name servers the target is
Page 21 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
using, the NS search can be used.
12. At the nslookup prompt, type set q=ns and then press Enter to set the query type to NS.
set q=ns
13. At the nslookup prompt, type in the target domain and then press Enter to execute a query.
Page 22 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Query your target domain
14. Make a screen capture showing the results of the NS query.
15. At the nslookup prompt, type exit and press Enter to return to the command prompt.
16. At the command prompt, type exit and press Enter to close the Command Prompt window.
Note: This concludes Section 1 of the lab.
Page 23 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Section 2: Applied Learning
Part 1: Collect Information with TheHarvester
Note: In the next steps, you will be introduced to a command-line tool called theHarvester.
TheHarvester is a command line tool that provides multiple means for gathering information about a
target domain. In the previous parts, you have used individual tools to gather information. This
included direct queries with a search engine as well as queries generated using a tool. This new tool is
a bit different. Rather than requiring you to generate individual queries, it has a set of known data
sources. The tool can query each of those sources and gather relevant information from them.
TheHarvester can be used for strictly passive reconnaissance, as well as more active modes. Most of
the data sources are passive. These include search engines like Bing, DuckDuckGo, and Google. The
sources also include APIs that require a key to be used, like github, shodan, or zoomeye. The active
modes that are supported include DNS brute forcing (using --dns-brute) and taking screenshots of
resolved domains (using --screenshots). For this lab, you will use a few of the passive sources that do
not require API keys.
The passive sources work by querying the data source using one or more predefined queries based
on the target domain. The results are not generally in a format that is immediately useful.
TheHarvester makes the data more available by scraping the results that are returned for the
information that is most useful for the reconnaissance phase. This includes IP addresses, email
addresses, URLs, and DNS names for the target domain.
1. In the AttackWindows01 taskbar, click the Command Prompt icon to open a new Command
Prompt window.
2. At the command prompt, type cd C:\theHarvester and press Enter to change directories.
cd C:\theHarvester
Page 24 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
3. At the command prompt, type theHarvester.py -h and press Enter to view the help
guide for theHarvester.
theHarvester.py -h
Note: There are two flags that will be used for your command.
-d target specifies the target domain, in this case, the domain you chose.
-b bing instructs the tool to use Bing as the data source.
4. At the command prompt, type theHarvester.py -d target -b bing and press
Enter to search the target domain.
Page 25 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
theHarvester.py -d target -b bing
Note: Notice that just by using Google, theHarvester can return results that include several email
addresses and system names (hosts). A simple domain search in this tool yields far more results than
the WHOIS tool was able to provide.
5. Make a screen capture showing the search results from theHarvester using Bing.
6. Repeat step 4 using DuckDuckGo as a data source.
Page 26 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
7. Make a screen capture showing the search results from theHarvester using
DuckDuckGo.
Note: TheHarvester also includes integration with the Shodan database. Shodan is an online
database of the devices connected to the Internet. When paired with Shodan’s device search
capability and an exploit database, such as Metasploit or CVE, theHarvester effectively provides a
searchable database of vulnerable devices. For additional information on the Shodan database, see
the following informative articles: What Is Shodan? How to Use It & How to Stay Protected [2022] and
What is Shodan? The search engine for everything on the internet | CSO Online. For more information
on theHarvester, review how to download and use theHarvester at
https://github.com/laramies/theHarvester.
8. At the command prompt, type exit and press Enter to close the Command Prompt window.
Part 2: Collect Information with Maltego
Note: Similar to theHarvester, Maltego gathers and organizes information based on a domain name.
Maltego can collect not only email addresses, but also information about an organization, groups of
people, and the network itself. Maltego does this by presenting the objects and their relationship to
each other in a graphical manner.
In the next steps, you will use Maltego. First, however, you need to register for a community account.
The community account limits the number of relationships that Maltego can display, but it is more than
sufficient to complete this lab. You can review the documentation for Maltego here.
1. In the AttackWindows01 taskbar, click the Firefox icon to open a new browser window.
2. In the browser's address box, type https://www.maltego.com/ce-registration/ and
press Enter to open the Maltego registration page.
Page 27 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Navigate to Maltego Registration
3. On the Maltego registration page, complete the registration form and click Register to
create a new account using your actual email address.
Note: To confirm your registration, Maltego will send an email to the email account you provided. If
you don't receive it, look in your Spam folder for an email from maltego@paterva.com. You will need
to click the link provided in the email to activate your account.
Page 28 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
4. Close the browser window.
5. On the AttackWindows01 desktop, double-click the Maltego icon to open the Maltego
application.
Maltego icon
Note: The first time you run Maltego, you will need to configure the program and log in using the
credentials that you used during registration in steps 2-3. Once the application has loaded, the
Maltego dialog box will open automatically.
6. Under Activation Options, select Maltego ID and then click Next to proceed.
Page 29 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Maltego ID Activation
Note: You will then see a dialog titled “Configure Maltego” with eight steps listed on the left side.
Proceed through these steps to configure the program.
7. On the second Activation screen, select Online Activation (default) and then click Next to
proceed with Maltego configuration.
Page 30 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Maltego Online Activation
Note: You will then see a dialog titled “Configure Maltego” with five steps listed on the left side.
Proceed through these steps to configure the program.
8. On the License Agreement page, click the Accept box and then click Next to accept the
License Agreement and continue to the Login page.
Page 31 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Accept the License Agreement and continue the registration process
9. At the Login page, click the duplicate link button, then reopen the Firefox browser. Paste
the link and press Enter to navigate the login page for Maltego. Use the credentials you
created earlier in Step 2.
Note: The Configure Maltego page in the application will show "Busy...Please wait...". This is Maltego
waiting for a browser based login.
Page 32 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Copy the Maltego login link
Note: Once you have logged in from Firefox, close the browser, and Maltego will show "Browser
Login was Successful". Click Next multiple times to finish the Maltego activation and then click
Finish to close to dialog window.
10. The home page of Maltego should look like the following.
Page 33 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Maltego Home Page
11. Click the Entities tab from the menu at the top of the screen and then select Manage
Entities.
Navigate to Entity Manager
12. Type Domain in the search field and then click the meatball menu botton to configure the
Page 34 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
domain details.
Edit Domain Entity
13. On the Edit Entity - Domain window, keep the defaults and click Ok. The Entity Manager
window can then be closed.
Page 35 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Edit Domain Entity
14. From the top left of the home screen navigate back to the Investigate tab and Click New to
begin a new investigation.
Page 36 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Create new investigation
15. Type Domain into the Search box under Entity Palette. Then, in the Infrastructure section of
the Entity palette, click-and-drag the Domain entity to the blank graph.
Domain entity in the Infrastructure section
Note: This should create a new Domain node in the graph. The default domain name will be
maltego.com. If you hover the mouse over nodes in the graph, the Detail View section in the right
sidebar will be updated with information about the node. You can rename the target domain as well.
Page 37 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
16. In the graph window, double-click the domain name, then type your target
domain (example: google.com or microsoft.com), and then press Enter to change the target.
Update the domain name with your target domain
17. In the graph window, right-click the domain node to open the Run Transforms dialog.
Page 38 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Run Transforms dialog
Note: You should see a list of transform sets. Each set may have a configuration icon and a run all
icon. You can also click the plus symbol to the left of the set to see a list of the transforms in the set.
18. In the Run Transforms dialog search filter, type dns to view the list of DNS transforms.
filter transforms by DNS
Note: Several of the transforms begin with To DNS Name. These transforms can be used to look up a
particular type of DNS record for the domain. A transform can be run by using the run icon.
Page 39 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
19. In the To DNS Name - NS (name server) row, click the run icon to run the transform.
Note: There is a typo in the Maltego application noting this is a mail server, but To DNS Name - NS is
the correct selection.
Run the To DNS Name - NS transform
Note: You should see a few lines appear in the Output - Transform Output pane of the Maltego
window. These lines indicate the actions that are taken by the program. In this case, there should be a
line indicating that the transform was started, a line indicating the number of results received, and a
line indicating that the transform completed. You should then see one or more NS Record nodes
appear in the graph. You may need to click one of the graph view icons to see all the nodes in the
result.
Page 40 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
20. Make a screen capture showing the graph of the NS Records for the target domain.
Note: In this part of the lab, you will create a baseline ER diagram from the given scenario. The
process of capturing user requirements in a diagram from their text description is iterative. This means
that you will start by creating an initial draft design that will be gradually refined to a complete design
by going through the requirements repeatedly and making changes as your understanding of the
application scenario increases.
21. On the Maltego toolbar, click the Machines tab and then click Run Machine to open the
Start a Machine dialog box.
Run Machine
Note: Machines are preconfigured tools that collect information. The information that is collected will
be added as a new graph. The Company Stalker machine can be used to try to collect email
addresses associated with a domain. Use the same target domain that you chose for Part 2 of the lab.
22. On the Choose machine page, select the Company Stalker radio button and then click
Next to continue to the Specify target page.
Page 41 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Select the Company Stalker machine
23. On the Specify target page, type your target domain in the Domain Name box and then
click Finish to run the Company Stalker machine on the specified target.
Page 42 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Specify your target domain for the Company Stalker machine
24. When prompted, click OK to dismiss the Results Limited dialog box.
Acknowledge that the results will be limited to 12 entities
Page 43 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Note: A section titled Company Stalker will be added to the Machines tab in the right side panel. As
the machine is running you will see updates in this section. At one stage in the process, an email filter
will run. This step will look like userFilter(Filter email addresses). During this step, a dialog that offers
you the opportunity to filter out addresses that do not seem important will appear.
25. On the Required Inputs page, select Run.
Acknowledge that the results will be limited to 12 entities
26. In the Filter email addresses dialog, click Proceed with selected to continue with all the
addresses that were found.
Page 44 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Proceed with selected emaill addresses in your target domain
Note: The machine will go through a few more steps. Once it is complete, the right sidebar should
show "Machine completed" under the Company Stalker header. There should now be a new graph tab
that shows the email addresses that were found. For this graph, there should be one domain name
(for the domain you selected and several email address nodes.
27. In the layout toolbar, click the block layout icon to make all the results visible.
Block Layout
Page 45 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
28. Make a screen capture showing the graph of the email addresses for the target domain.
Note: Being able to quickly map an organization’s attack surface is a critical skill for those defending
a network. A detailed footprint of an organization’s internet-facing systems can be a great resource
and can aid in quickly identifying weak areas in the attack surface. Assets found in the footprint, such
as customized web applications, old servers, or forgotten services can be the first signs that lead to a
path to compromise. In the next steps, you will use the Footprint L1 machine to footprint the target
domain you chose.
29. On the Maltego toolbar, click the Machines tab and then click Run Machine to open the
Start a Machine dialog box.
30. On the Choose machine page, select the Footprint L1 radio button and then click Next to
continue to the Specify target page.
Page 46 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Select Footprint L1 machine
31. On the Specify target page, type your target domain in the Domain Name box and then
click Finish to run the Footprint L1 machine.
32. When prompted with a required inputs dialog box, click Run! to proceed with the default
options. If a pop-up covers the screen after pressing ok it is safe to ignore this and click out of
it.
Click Run! to proceed
Note: The process proceeds in three phases, which you can see happening in the right side panel.
The first phase is DNS enumeration. Here, the machine attempts to determine the DNS names
associated with the domain. The next phase is DNS resolution. During this phase, the machine
attempts to find IP addresses associated with each DNS name that was found. The final phase
attempts to resolve net blocks and Autonomous System Numbers (ANSs). IP addresses are assigned
in blocks to Internet Service Providers (ISPs). The final phase will identify the block that contains each
IP address and the ASN for the ISP that has been allocated to that block.
During this process, you may see a dialog pop up for a tutorial about collections. You can close this
dialog.
33. On the Layout toolbar, click the block layout icon to change the view and see the whole
graph.
Page 47 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Note: You should see several layers of nodes. If the target you chose has many results, the graph
may contain quite a few nodes. There should also be a legend that shows the colors used for each
type of node. At the top of the graph is a domain node for the target. This node should connect to
individual DNS Name nodes. Recall that you can see these details by hovering over the nodes. Some
of the DNS Name nodes will be connected to an IPv4 Address node. The address node indicates the
IPv4 address for the DNS name. Each address node will be connected to a Net block node that gives
a range of addresses. The net block nodes will then be connected to an AS node, which gives the
ASN for the ISP that the block is assigned to. Finally, the AS nodes are connected to Company nodes,
which give information about the ISP for the ASN.
34. On the Graph toolbar, click the List View button to display the results as a list.
List View
35. Make a screen capture showing the first page of the IP addresses and domain names for
the target domain.
36. Close the Maltego window and click Discard All when prompted.
Page 48 of 50
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Discard All
Note: This concludes Section 2 of the lab.
Page 49 of 50
Powered by TCPDF (www.tcpdf.org)
Performing Passive Reconnaissance (4e)
Ethical Hacking, Fourth Edition - Lab 01
Section 3: Challenge and Analysis
Note: This challenge involves using the skills from this chapter to perform passive reconnaissance of
a particular organization.
Part 1: Perform Reconnaissance on a Chosen Target
Select the organization from any previous listed ones in the lab or choose your own. Investigate the
following details from the organization as thoroughly as possible. If any of these elements cannot be
found, note that in your report. If the reconnaissance yields few results, select a different organization.
Name of the target organization
Domain name and extension (domain.ext) for the target organization (for example,
amazon.com)
URLs for the e-commerce website and any social networking sites
Physical address of the main headquarters location used by the target company; use Google
Maps to locate the building
Names of officers (for example, CEO, president, and CIO) at the organization
Number of employees at each major physical location
Business partners or clients of the organization
Document the above details you discovered for your selected organization.
Part 2: Analyze Reconnaissance Results
Using the results from Part 1:
Describe one or two possible scenarios in which these findings could be used in
further ethical hacking endeavors.
Note: This concludes Section 3 of the lab.
Page 50 of 50