⚔️
Carpa Security Book
  • 😎Introduction
  • 🔴Offensive Security
    • Reconnaissance & Information Gathering
      • Passive Reconnaissance
        • Reconnaissance Frameworks
        • Metadata Analysis
        • Domain & IP Enumeration
        • Social Media
        • Email Addresses
        • Search Engines
      • Active Recon
        • System & Network
          • Network & Port Scanning
          • Vulnerability Scanners
          • OS Fingerprinting & Service Identification
          • Network Mapping and Visualization
          • Service Enumeration
        • Web Application
          • Public Resource
          • Technology Mapping
          • Analyzing Client Side Code
          • Testing User Inputs and Controls:
          • Analyzing Server Responses and Error Messages:
          • API and Endpoint Analysis:
          • Session Management Analysis
          • Automated Vulnerability Scanning
          • Web Enumeration
        • Wireless Network Reconnaissance
    • Exploitation & Target Compromise
    • Privilege Escalation
    • Post Exploitation
      • Lateral Movement
    • Attacktive Directory
    • Credential Attacks
    • Wireless
    • Social Engineering
    • Web App PenTesting
    • Physical Security
  • 🔵Defensive Security
  • 🖥️Linux Commands
  • 🔠Certificates Prep
  • 🔗Training and Resources
Powered by GitBook
On this page
  • System and Network Reconnaissance
  • Web Application Reconnaissance
  • Wireless Network Reconnaissance
  • Physical Security Reconnaissance
  • Social Engineering Reconnaissance
  1. Offensive Security
  2. Reconnaissance & Information Gathering

Active Recon

Active reconnaissance tools are used to interact directly with the target system or network to gather information. This approach is more intrusive compared to passive reconnaissance and can potentially alert the target about the reconnaissance activity.

System and Network Reconnaissance

  • Objective: To assess the security of networked systems, including servers, workstations, and network devices.

  • What It Does: Involves scanning for open ports, detecting running services, identifying operating systems, and discovering devices on a network. The goal is to map the network, understand the services running, and identify potential vulnerabilities that could be exploited. Tools like Nmap and Wireshark are typically used for these tasks.

Web Application Reconnaissance

  • Objective: To find vulnerabilities in web applications that could lead to unauthorized access or data breaches.

  • What It Does: Focuses on the security of web-based applications. It involves testing for common web vulnerabilities like SQL injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and others. Tools like Burp Suite and OWASP ZAP automate the process of sending crafted requests to web applications and analyzing the responses for indications of vulnerabilities.

Wireless Network Reconnaissance

  • Objective: To evaluate the security of wireless networks.

  • What It Does: Targets WiFi networks, aiming to uncover security weaknesses like poor encryption, weak passwords, or vulnerabilities within the wireless protocols. This can include attempting to break WPA/WPA2 encryption, identifying and exploiting misconfigured networks, and assessing the strength of the wireless network against unauthorized access.

Physical Security Reconnaissance

  • Objective: To assess the effectiveness of physical security measures.

  • What It Does: Tests an organization's physical barriers to unauthorized entry. This can include assessing locks, doors, security badges, biometric systems, surveillance cameras, and other physical security controls. It often involves attempts to bypass these controls through lock picking, tailgating, or using social engineering techniques.

Social Engineering Reconnaissance

  • Objective: To test the human element of security.

  • What It Does: Involves manipulating individuals into breaking standard security procedures. This can include phishing attacks (sending deceptive emails to trick individuals into revealing sensitive information), pretexting (creating a fabricated scenario to obtain information), and baiting (leaving infected USB drives for individuals to find and use). The goal is to assess how well individuals adhere to security policies and to raise awareness about social engineering threats.

Each of these penetration testing types plays a crucial role in a comprehensive security assessment. They help identify and mitigate vulnerabilities across various layers of an organization, from digital infrastructure to human factors. Conducting these tests requires specialized skills and tools, and they should always be performed in a controlled and authorized manner to avoid unintended consequences.

PreviousSearch EnginesNextSystem & Network

Last updated 1 year ago

🔴