Ethical Hacking Tutorial

Footprinting & Reconnaissance (Practical)

Basics

Check IP of the Domain = ping www.moviescope.com

Check the Packet Route = tracert microsoft.com

Check the Max Buffer Size = ping microsoft.com –f –l 1400

:: Increase the buffer length till error.

Use firebug add-on (Kali)

Use Netcraft add-on (both)

Use Discover (after installing recon-ng)

Use Maltego

Mirroring FULL WEBSITE = HTTrack web site copier

Dir-” Module 02 Footprinting and Reconnaissance\Website Mirroring Tools\HTTrack Web Site Copier”

Dir-“Module 02 Footprinting and Reconnaissance\Traceroute Tools\Path Analyzer Pro”

Open Path Analyzer Pro from the Start menu.
It will show the Path Analyzer Pro window, along with the pop-up for Registration Form. Click on Evaluate.
The main window of Path Analyzer Pro will show up.

Some options in the Standard Options and Advanced Probe Details are default.

Make sure to check the ICMP radio button under the Protocol field is selected.
In Advanced Probe Details, the Smart option under the Length of packet field must also be checked.

Some of the options in the Advanced Tracing Details section are set to default.

Under the Advanced Tracing Details, make sure to check Stop on control messages (ICMP) option is selected.

For running the trace, enter the host name in the Target. For example, you have entered http://www.moviescope.com. Now, check whether the Smart option under the Port is set to default (65535). Select the duration of time from the dropdown as Timed Trace, and click on the Trace button.
It will show the Type time of the trace dialog box. Enter the time trace in the given format (HH:MM:SS) and click on Accept.

In this lab, the time set for the trace is 3 minutes.

When the Path Analyzer Pro runs the trace, the Trace tab will automatically switch to Stop.

In case you see the postgresql selected, no connection error, it means that the database was not started.
If it shows the postgresql connected to msf message, you can jump directly to Step 9.

Write exit and press Enter. It will exit the Metasploit.
Now, you need to start the database. For this, write msfdb init and press Enter.
Write service postgresql restart and press Enter to restart the postgresql.
Now, you need to restart the Metasploit Framework. For this, write msfconsole and press Enter. It will start the tool and show the msf command line.
Write db_status and press Enter to confirm if the database is now connected.

This time, you will see postgresql connected to msf.

Write nmap -Pn -sS -A -oX Test 10.10.10.0/24 and press Enter. Mmap usually takes around 10 minutes to scan the subnet.
Once scanning is done, you will see the Nmap done message. It will also reveal the total no. of active hosts in the subnet.
Now, write db_import Test and press Enter for importing the test results.
Write hosts and press Enter. It will show the hosts along with their respective details gathered by nmap.

It will not yet show you the os_flavor details. To see these details, follow the next steps.

Write db_nmap -sS -A -sV 10.10.10.16. Press Enter.
Nmap will now perform the scanning of Windows Server 2016. It will show the information about the services running on the machine. It is the easiest way to know about the services running on a particular machine.
Write services and press Enter. It will show the service details about the active machines in the subnet.
For loading the SMB scanner module, write use scanner/smb/smb_version and press Enter. Next, write show options and press Enter. It will show the configuration options about the module.
Write set RHOSTS 10.10.10.8-16 and press Enter. Now, write set THREADS 100 and press Enter. Then, write run and press Enter. It will launch the module.
Write hosts and press Enter to check the os_flavor details.

Total Questions10

Duration00:04:00