Network Security Assessment, 3rd Edition

Chapter 4. Internet Network Discovery

This chapter describes the first steps taken when assuming the role of an Internet-based attacker. A competent adversary will use open sources to map an organization’s networks and identify its users. Here are three of those sources:

• Web search engines and sites (e.g., Google, Netcraft, and LinkedIn)

• WHOIS registries

• Accessible DNS servers

The majority of this probing is indirect, sending traffic to websites including Google, and public WHOIS and DNS servers. Two tactics involve sending traffic to the target network, however, as follows:

• Probing the target’s own DNS servers

• Network probing via SMTP

Through initial reconnaissance, you can identify potential weaknesses. Peripheral systems are commonly insecure when compared to publicized web, application server, and mail endpoints.

The reconnaissance process is iterative, repeating enumeration tasks upon uncovering new information (such as a domain name, or office location). The agreed scope of an assessment exercise defines the boundaries, which sometimes might include third parties. Target Corporation suffered a severe compromise in 2013, in which the VPN credentials of a vendor were reportedly used to gain access to the internal network, resulting in the exposure of 70 million customer records.¹

Querying Search Engines and Websites

Search engines catalog useful information. Google and other sites provide advanced search functions that let attackers build a clear picture of ...