This is my first tutorial so please forgive me for any mistakes that I ahave made and if you don't mind please point them out! So much information can be found out by footprinting an organization and most of the time it can be prevented. I am new to all of this but I usually learn by doing and looking so here goes. This tutorial (probably not the first) is to show the methods and tools used to footprint an organization. Footprinting can pretty much be summarized as learning as much as you can about the targets ip adresses, registrars, affiliates, websites, OSs used, user names, etc... Some of this may not seem very important where other parts are but it all is linked together :)
One thing that many people overlook when footprinting is to look at EVERYTHING you can use Google to search for keywords and links to and from the targets website. Information can sometimes be found by looking at the source code of the website. For example: I looked at my schools website and saw in the source code the comment that is left by Frontpage when creating a webpage (Anyone want to take a guess at the OS?). If you didn't know you can usually save the source from webpages with your browser.
Network enumeration is the next major step in footprinting the target. For Windows I find that Samspade is one of the easiest tools to use and is pretty straight forward when performing a whois search or dns look up. For *nix whois is usually already installed and is not very complicated to use. When using "whois" it usually follws syntax like this:
whois "targetname"@whois.crsnic.net
This will give you some very important info about the site such as the admins name and contact number (Social engineering!), the DNS server addys, and the registrant.
Depending on what type of site you are footprinting you may want to use a different database. Some sites with info and databases are:
ripe.net <---Euro ip addy's
whois.nic.mil <---United States military
whois.arin.net <---General one
These are just three examples there are many more out there just do a google search and you will be sure to find some more.
DNS Interogation comes next. Zone transers can be very devastating because if you do not have it configured correctly and it gives out more information than you wanted it to such as the internal network structure. (Something that people on the outside don't even need to have a clue about) Here is how it works:
Do a basic nslookup then type in the IP address that you found for the site earlier then press enter.
After that type "set type=any" press enter
then "ls -d targetname.com. >> /tmp/transfer" press enter
You can then use grep to search through the transfer file in the /tmp directory for specific things in these records such as operating system names or even test systems and the like.
Traceroute is also a very handy tool to use when you are footprinting an organization. It's simple to use also. For example:
traceroute targetname.com
When you get the results most of the time the packet will probably be blocked by firewalls or router but it helps you identify them!
If you change the port number with the -p switch it may help you go a little bit deeper into the network.
After this basic information is gathered you can start using port scanners to find out which ports on the machines are open and by chance what operating sytem they are running. Nmap is a great tool for this purpose.
Well I hope that has helped a bit . If you have any feedback please send it to [email protected]
