Penetration Testing

Chapter 5. Information Gathering

In this chapter we begin the information-gathering phase of penetration testing. The goal of this phase is to learn as much about our clients as we can. Does the CEO reveal way too much on Twitter? Is the system administrator writing to archived listservs, asking about how to secure a Drupal install? What software are their web servers running? Are the Internet-facing systems listening on more ports than they should? Or, if this is an internal penetration test, what is the IP address of the domain controller?

We’ll also start to interact with our target systems, learning as much as we can about them without actively attacking them. We’ll use the knowledge gained in this phase to move on to the threat-modeling ...