How to Use Footprinting to Plan an Ethical Hack

One way to begin planning an ethical hack on your business is through a process often called footprinting. Through footprinting, you see what others can see about your organization and systems. Here is the process for footprinting:

Gather public information

The amount of information you can gather about an organization’s business and information systems is staggering and widely available on the internet. Your job is to find what’s out there. This information allows malicious attackers and employees to target specific areas of the organization, including departments and key individuals.

The following techniques can be used to gather information about your organization.

Social media

Social media sites are the new means for businesses interacting online. Perusing the following sites can provide untold details on any given business and its people:

• Facebook

• LinkedIn

• Pinterest

• Twitter

• YouTube

Web search

Performing a web search or simply browsing your organization’s website can turn up the following information:

• Employee names and contact info

• Important company dates

• Incorporation filings

• SEC filings

• Press releases about physical moves, organizational changes, and new products

• Mergers and acquisitions

• Patents and trademarks

• Presentations, articles, webcasts, or webinars

With Google, you can search the internet in several ways:

• By typing keywords: This kind of search often reveals hundreds and sometimes millions of pages of information — such as files, phone numbers, and addresses — that you never guessed were available.

• By performing advanced web searches: Google’s advanced search options can find sites that link back to your company’s website. This type of search often reveals a lot of information about partners, vendors, clients, and other affiliations.

• By using switches to dig deeper into a website: For example, if you want to find a certain word or file on your website, simply enter a line like one of the following into Google:

site:www.your_domain.com keyword
site:www.your_domain.com filename

You can even do a generic filetype search across the entire internet to see what turns up, such as this:

filetype:swf company_name

Use the preceding search to find Flash .swf files, which can be downloaded and decompiled to reveal sensitive information that can be used against your business.

Use the following search to hunt for PDF documents that might contain sensitive information that can be used against your business:

filetype:pdf company_name confidential

Web crawling

Web-crawling utilities, such as HTTrack website Copier, can mirror your website by downloading every publicly accessible file from it. You can then inspect that copy of the website offline, digging into the following:

• The website layout and configuration

• Directories and files that might not otherwise be obvious or readily accessible

• The HTML and script source code of web pages

• Comment fields

Comment fields often contain useful information, such as names and e-mail addresses of the developers and internal IT personnel, server names, software versions, internal IP addressing schemes, and general comments about how the code works.

Websites

The following websites may provide specific information about an organization and its employees:

• Government and business websites:

  • www.hoovers.com and http://finance.yahoo.com give detailed information about public companies.

  • www.sec.gov/edgar.shtml shows SEC filings of public companies.

  • www.uspto.gov offers patent and trademark registrations.

  • The website for your state’s Secretary of State or similar organization can offer incorporation and corporate officer information.

• Background checks and other personal information:

  • LexisNexis.com

  • ZabaSearch

Map the network

When you map your network, you can search public databases and resources to see what other people know about your network.

WHOIS

The best starting point is to perform a WHOIS lookup by using any one of the WHOIS tools available on the internet. You may have used WHOIS to check whether a particular internet domain name is available.

For ethical hacking, WHOIS provides the following information that can give a hacker a leg up to start a social engineering attack or to scan a network:

• Internet domain name registration information, such as contact names, phone numbers, and mailing addresses

• DNS servers responsible for your domain

You can look up WHOIS information at one of the following places:

• WHOIS.net

• A domain registrar’s site, such as www.godaddy.com

• Your ISP’s tech support site

A great WHOIS tool is DNSstuff.com. Although this tool is no longer free and is used to sell many services, it’s still a good resource. Another good website is www.mxtoolbox.com.

You can run DNS queries directly from www.mxtoolbox.com to

• Display general domain-registration information

• Show which host handles e-mail (the Mail Exchanger or MX record) for a domain

• Map the location of specific hosts

• Determine whether the host is listed on certain spam blocklists

A free site you can use for more basic internet domain queries is DNS Tools.

The following list shows various lookup sites for other categories:

• Government

• Military

• AFRINIC (Regional Internet Registry for Africa)

• APNIC (Regional Internet Registry for the Asia Pacific Region)

• ARIN (Regional Internet Registry for North America, a portion of the Caribbean, and subequatorial Africa

• LACNIC (Latin American and Caribbean Internet Addresses Registry)

• RIPE Network Coordination Centre (Europe, Central Asia, African countries north of the equator, and the Middle East)

Google Groups

Google Groups can reveal surprising public network information. Search for such information as your fully qualified domain names (FQDNs), IP addresses, and usernames. You can search millions of Usenet posts that date back to 1981 for public and often very private information.

You might find some information that you didn’t realize was made public, such as the following:

• A tech-support or message board post that divulges too much information about your systems. Many people who post messages like these don’t realize that their messages are shared with the world or how long they are kept.

• Confidential company information posted by disgruntled employees or clients.

If you discover that confidential information about your company is posted online, you may be able to get it removed. Check out the Google Groups help page at for details.

Privacy policies

Check your website’s privacy policy. A good practice is to let your site’s users know what information is collected and how it’s being protected, but nothing more.