Category: Footprinting

Posted on by

Email analysis for beginners

Hello, aspiring Ethical Hackers. In our previous blogpost, you have learnt what is footprinting and various methods to perform footprinting. One such type of Footprinting is Email Footprinting or Email analysis.

What is Email Footprinting?

Email analysis is gathering information from emails. This can be done in two ways. Email Tracing and Email Tracking.

Email Tracking: Email tracking is done when we send an email to a target and then track them.
Email Tracing: Email racing is performed on an email that we receive from our target.

This article deals with Email tracing.

What information does Email Footprinting reveal?

Email Footprinting can reveal information like

  1. Email address of the sender.
  2. Name of the sender.
  3. IP address of the sender
  4. Posts active sender
  5. Geo location
  6. Mail server
  7. Mail server authentication system being used etc. and much more information that can be useful in a pen test.

How to perform Email Footprintig?

Email Footprinting can be performed either manually or using tools or other online sources. For this blogpost, let’s focus on manual analysis as automated tools can be used by script kiddies too. To perform email footprinting, we need to view the header of the received email. How to view the header of any email? Let’s see an example of a mail received on Gmail. Go to your Inbox and open a mail.

Go to the vertical dots (move button) at the top right of the email and click on it.

Email Footprinting 1 1

Click on “show original”.

Email Footprinting 2

This should show you the entire Email headers of the mail.

Email Footprinting 3

Let’s learn about each header.

Email Footprinting 4

Delivered To: Email address to whom the mail has been delivered.

Received: This header indicates all the SMTP servers through which this email has passed through before reaching to your Inbox. This contains server’s IP address, SMTPID etc.

X-Google-SMTP-source: shows the transferring email using a Gmail SMTP server. If this header is present then it means this was transferred by GMAIL SMTP server.

X-Received-BY: This header indicates the last visited SMTP server before reaching your Inbox. It contains Server IP address, SMTP ID of the visited server and Date & time when the email was received by the SMTP server.

Email Footprinting 5

ARC-Seal, ARC-Message-Signature, ARC-Authentication-Results: ARC stands for Authenticated Receiver Chain (ARC). This is used to preserve email authentication results and to verify the identity of email intermediaries that forward a manage to its final destination (i.e. your Inbox).

Email Footprinting 6

Smtp-mailfrom: You can see the IP address of the sender of the email.

Return-Path: This is the path specified to go when email is bounced or not sent.

Received SPF: SPF stands for Sender Policy Framework. This is used to prevent sender address forgery. It SPF is set to PASS, the Email source is valid, if it is softfail, it is likely the email source is fake and if it is having value Fail, source is invalid.

This is how Email analysis is performed.

Posted on by

DNS footprinting for beginners

Hello, aspiring Ethical Hackers. In our previous blogpost of Footprinting guide, you learnt about various techniques of Footprinting. In this blogpost, you will learn about DNS Footprinting which is one of the techniques of Footprinting. But first, what is DNS? DNS stands for Domain Name Service. In simple terms, DNS is like translation service between humans & browsers. Why do I say so?

Let me explain you. You open a browser and type a domain name (ex:hackercool.com) to visit a website. Web browsers have no idea about this domain name or for that matter any domain name because web browsers communicate with servers through Internet Protocol addresses. Then how web browsers take you to the website you want. Thanks to DNS (Domain Name Service) translates domain names to IP addresses. Lean more about how DNS works here.

What is DNS Footprinting?

DNS Footprinting is a technique in which attackers gather DNS information about the target system. A DNS server stores information such as DNS domain names, computer names, IP addresses and other network related information. It also has some records that are important. Here are the types of records a DNS server can have.

DNS Footprinting 1

How does it help in Pentesting?

DNS Footprinting can reveal other information about server related to the network and in some cases expose entire Zone data. DNS Footprinting is very simple. Let’s show you two tools popular for DNS footprinting. The first tool is nslookup. Here’s how to use nslookup to query about a domain.

DNS Footprinting 2

We can even query for a specific type of record using nslookup. Let’s query specifically for “NS” and “MX” records.

DNS Footprinting 34
DNS Footprinting 56

There is another tool named DIG that can be used for DNS lookup.

DNS Footprinting 78

This tool can also be used to query for a specific type of records as shown below.

DNS Footprinting 9
DNS Footprinting 1011
DNS Footprinting 1213

Posted on by

Google Hacking for beginners – Part 1

Hello, aspiring Ethical Hackers. In our previous blogpost on Footprinting, you learnt that hackers gather information about their targets using search engines. In this blogpost you will learn about Google Hacking or Google Dorking. Who doesn’t know what Google is. Just for this article’s sake, let me define what it is. Google is the most popular Search Engine that provides answers for anything we want, almost anything. Just a click away.

Google Hacking 1

Google is already an awesome search engine but to make the search engine more precise it has some advanced operators. In other words, searching with some special operators allows Google to provide exact information we want. These are known as Google Dorks. The basic syntax of a Google Dork is,

Operator : term to search or URL

Ex: intitle:hackercool

Some of the important Google operators are.

  • intitle
  • allintitle
  • inurl
  • related
  • allintext
  • cache
  • define
  • allinurl
  • intext
  • site

Let’s learn about each of them in detail.

1. intitle

This query will return all the webpages which have term “hackercool” in the title of the webpage.

Google Hacking 2

2. allintitle

Same as “intitle” but will show pages containing all the multiple keywords specified.

Google Hacking 4

3. inurl

The “inurl” query returns all the webpages containing the specified keywords in their URL.

Google Hacking 5
Google Hacking 6

4. allinurl

Same as “inurl” but can be used to search for multiple keywords in the URL.

Google Hacking 7

5. define

The “define” query can be used to search for a definition of any keyword you specify. For example, let’s search for the definition of hackercoolmagazine.

Google Hacking 8

6. related

The “related” dork of Google is used to search for a website similar to the site you specify.

Google Hacking 9

For example, in the above image, we search for sites related to Facebook and Google has returned similar networking sites like Twitter, Pinterest, LinkedIN. Note that this google dorks only takes websites as keywords.

7. cache

The cache query returns the latest cached version of the website Google has stored. This dork too needs website as keyword.

Google Hacking 10 1024x576

8. intext

The “intext” query returns all the webpages having like specified “text” in their content.

Google Hacking 11

9. allintext

The “allintext” query is same as “intext” but can be used to search webpages having multiple keywords in their content.

Google Hacking 12

10. site

The “site” query is useful in limiting your search to a particular website.

Google Hacking 13

Read Part 2 of Google Hacking.

Posted on by

Whois Footprinting for beginners

Hello aspiring Ethical Hackers. In this blogpost you will learn about Whois Footprinting. In our previous blogpost, you were given an introduction to Footprinting and types of Footprinting. Whois Footprinting is one type of footprinting. In my opinion, Whois footprinting is the first method of footprinting that should be used while starting information gathering.

What is Whois?

Whois is actually a protocol running on port 43. When you or any organization register a domain (eg: hackercoolmagazine.com), a record is created. This record is known as Whois record and is created by an organization called Internet Corporation for Assigned Names and Numbers (ICANN) which regulates domain name registration and ownership. Whois records are maintained by Regional Internet Registries (RIR’s). At present, there are five RTR’s allocated to particular regions.

  1. American Registry for Internet Numbers (ARIN)
  2. African Network Information Center (AFRINIC)
  3. Asia Pacific Network Information Center (APNIC)
  4. Reseaux IP Europeens Network Coordination Centre (RIPE)
  5. Latin American and Caribbean Network Information Center (LACNIC)

What information does Whois reveal?

Whois Lookup reveals information like the owner of the domain, contact details of domain owners, IP address network range used by the organization, domain name server and when a domain has been created and the date of its expiry.

Whois Lookup 1

How does it help in Pentesting?

Any business or organization has a website nowadays for which they have to register a domain (person or entity who registers a domain is known as a registrant, while a company registering the domain is known as registrar). So performing Whois Lookup can give anyone information about the domain which can be further used in footprinting.

Types of Whois Lookup

Types Of Whois Lookup

There are two types of Whois Lookup: Thin Whois and Thick Whois.

  1. Thin Whois: Thin Whois Lookup gives only the name of the whois server of the registrar of the domain.
  2. Thick Whois: Thick Whois Lookup reveals complete information from all the registries for a particular domain.

Kali Linux has a default tool for whois lookup named “whois”. This is how to use it.

Whois Lookup Kali 657x1024

Given below are some other Whois Lookup tools.

  1. Whois Lookup (https://www.whois.com)
  2. ICANN Whois (https://whois.icann.org)
  3. MxToolBox (https://www.whois.com/whois/)
  4. Domain Tools (https://whois.domaintools.com)
  5. Who.is (https://who.is/)
Posted on by

Footprinting guide for beginners

Hello aspiring Ethical Hackers. In this blogpost you will learn about Footprinting or Reconnaissance. It is the first step of Ethical hacking. Although boring a bit, it is one of the most important stages of Ethical Hacking. This is because this stage lays the road to success or failure of the hack as it gives much needed information about the target system or organization.

Objectives Of Footprinting

In Reconnaissance, you gather as much information about the target organization that is useful in gaining access or to learn about the security posture of your organization depending on which color HAT you want to wear. Reconnaissance allows pen testers to reduce the area they need to focus, identify vulnerabilities and finally know about the security posture of the company.

What information does Reconnaissance reveal?

The following information can be collected from the Reconnaissance stage.

  1. Target organization’s network information including domains and sub-domains used by the organization.
  2. Blocks of IP addresses used by the organization that are accessible from outside. etc.
  3. Information about operating systems used by the web server OS, location of the Web server and in some cases user credentials.
  4. Information about the organization like the details of their employees, which include their names, addresses, Phone number, Personal email addresses etc

Types Of Footprinting

types of footprinting

There are two types of footprinting: Passive and Active.

1. Passive Footprinting:

In passive reconnaissance, information about the target organization is collected without actively without engaging with or any interaction with the target organization. This type of foot printing is very difficult as all the information needs to be collected from publicly available resources with search engines, job sites, social media, documents available in public domain etc. On the plus side, this type of foot printing allows pen testers to stay a bit confidential as it raises less suspicions on the target side.

2. Active Footprinting:

In Active reconnaissance, the attackers engage or interact with the target organization. This is simpler than passive reconnaissance as pen testers gets information directly from the target. On the flip side, the security guys at the target organization may already know your intent as it raises suspicions. Information will be collected about the target organization by scanning and enumerating target directly.

Techniques of Footprinting

Footprinting 2

The various techniques of Reconnaissance include,

Reconnaissance through Search Engines
Reconnaissance through Web Services
Website Footprinting
Email Footprinting
WhoIs Footprinting
DNS Footprinting
Network Reconnaissance
Metadata
Competitive Intelligence
Social Engineering Reconnaissance