2.2

2.2 Given a scenario, perform active reconnaissance.

• 2.2 Given a scenario, perform active reconnaissance.
  • Enumeration
  • Website reconnaissance
  • Packet crafting
  • Defense detection
  • Tokens
  • Wardriving
  • Network traffic
  • Cloud asset discovery
  • Third-party hosted services
  • Detection avoidance

Enumeration

• Hosts

• Services

• Domains

• Users

• Uniform resource locators (URLs)

Website reconnaissance

• Crawling websites

• Scraping websites

• Manual inspection of web links

  • robots.txt: Text file with instructions for search engine crawlers. It defines which areas of a website crawlers are allowed to search. However, this file does not protect against unauthorized access.

Packet crafting

• Scapy

Defense detection

• Load balancer detection

• Web application firewall (WAF) detection

• Antivirus

• Firewall

Tokens

• Scoping

• Issuing

• Revocation

Wardriving

Wardriving is tatical process for surveying an area for access points while in a moving vehicle.

Network traffic

• Capture API requests and responses

  Intercept request and responses with a proxy like Burp or ZAP.

• Sniffing

  Record packets in network or specific interface with Wireshark, tcpdump or other sniffing tools.

Cloud asset discovery

Third-party hosted services

Detection avoidance