Ethical Hacking Methodology & Passive Reconnaissance

1. Reconnaissance (Recon)
   Gather information about the target without engaging it directly.
   Passive: OSINT, public sources
   Active: Nmap, banner grabbing (may alert target)

2. Scanning & Enumeration
   Identify live hosts, open ports, services, OS versions, vulnerabilities.
   Tools: Nmap, Nessus, Nikto, Gobuster

3. Exploitation
   Gain unauthorized access using discovered vulnerabilities.
   Tools: Metasploit, custom exploits, manual exploitation

4. Post-Exploitation
   Maintain access, escalate privileges, pivot, exfiltrate data.
   Tools: Mimikatz, linpeas, BloodHound, chisel

5. Reporting
   Document everything: findings, evidence, business impact, remediation.
   Deliverables: executive summary, technical report, remediation guide

Authorization is MANDATORY:
- Written permission from the system owner before testing
- Scope document: which IPs, domains, applications are in scope
- Rules of Engagement (RoE): what testing is allowed, time windows
- Emergency contacts: who to call if something breaks
- Statement of Work (SoW) / Penetration Testing Agreement

Without authorization → criminal offense:
- US: Computer Fraud and Abuse Act (CFAA)
- UK: Computer Misuse Act
- EU: National cybercrime laws

Bug Bounty programs (HackerOne, Bugcrowd) provide written authorization
CTF competitions are pre-authorized

Google operators for finding sensitive info:

site:target.com             — all indexed pages on target.com
site:target.com filetype:pdf — PDF files on target
site:target.com inurl:admin  — admin pages
site:target.com intitle:"index of" — directory listings
site:target.com ext:sql OR ext:bak  — backup/DB files
site:target.com "password" OR "passwd"

"target.com" inurl:login
"target.com" inurl:wp-admin
"target.com" filetype:xlsx OR filetype:csv

# Find exposed credentials:
site:github.com "target.com" password
site:pastebin.com "target.com"
"@target.com" password

# Shodan — search engine for internet-connected devices
# https://www.shodan.io

hostname:target.com           — all Shodan results for domain
org:"Target Company"          — by organization name
net:192.168.1.0/24            — IP range
port:22 org:"Target"          — SSH exposed on target
product:"Apache httpd"        — Apache servers
os:"Windows Server 2008"      — old Windows servers
vuln:CVE-2021-44228           — Log4Shell vulnerable hosts

# CLI:
pip install shodan
shodan init API_KEY
shodan search "hostname:target.com"
shodan host 1.2.3.4           — full info on specific IP

# Censys (similar):
https://search.censys.io/
certificates.parsed.names: target.com

# Passive subdomain enumeration (no direct contact with target):

# 1. Certificate Transparency Logs
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

# 2. amass (passive mode)
amass enum -passive -d target.com -o subs.txt

# 3. subfinder
subfinder -d target.com -silent

# 4. theHarvester
theHarvester -d target.com -b all -f output.html

# 5. DNSdumpster
# https://dnsdumpster.com — visual subdomain map

# 6. WHOIS
whois target.com
whois 1.2.3.4              # reverse lookup

# 7. Reverse DNS
dig -x 1.2.3.4             # PTR record

# Gather emails, subdomains, IPs, URLs from public sources
theHarvester -d target.com -b google,bing,linkedin,shodan -f results.html

# Output:
# Emails found: [email protected], [email protected], [email protected]
# Subdomains: mail.target.com, dev.target.com, vpn.target.com
# IPs: 203.0.113.1, 203.0.113.2

# Use found emails for:
# - Phishing campaigns
# - Password spraying
# - Credential stuffing against other services

Maltego is a graphical OSINT and link analysis tool:
- Visual entity relationship mapping
- Transforms: queries public sources (WHOIS, DNS, Shodan, LinkedIn)
- Maps: domains → IPs → emails → people → org → social media

Community Edition: free, limited transforms
Maltego CE: maltego.com

Usage:
1. Create new graph
2. Add entity: Domain (target.com)
3. Run transforms: "To DNS Names", "To IP Address", "To Email Address"
4. Follow the graph: find employees, infrastructure, related domains

LinkedIn (manual):
- Search target company → employees → roles
- Find: CTO name, email format (first.last@target.com)
- Identify tech stack from job postings: "seeking Django/PostgreSQL developer"
- Find contractors, third parties with access

Email format guessing:
- john.doe@target.com
- j.doe@target.com
- johnd@target.com
Verify with: hunter.io, emailhippo.com

Tools:
- LinkedIn2Username — generate username list from LinkedIn
- sherlock — find person's social media across platforms

# Office/PDF files contain metadata: author, software, OS, internal paths
exiftool document.pdf
# Output: Author: John Smith, Creator: Microsoft Word 2016,
#         Company: Target Corp, Last Modified By: admin

# Extract metadata from all files on target website
metagoofil -d target.com -t pdf,doc,xls -o /tmp/meta/
# Finds and downloads files, extracts metadata
# Reveals: internal usernames, software versions, file paths

# Clean metadata before publishing:
mat2 document.pdf     # remove metadata from file