CSA 33203: Penetration Testing

MUHAMMMAD SYAZWAN BIN ZURI

067636

LAB 1: Information Gathering and Footprinting

Learning Objective
● Identify common information gathering tools and techniques.

Key Concepts
● Information gathering––reasons, tools, and techniques
● Footprinting as a data-gathering technique
● Information gathering and footprinting––countermeasures

Reading
● Information Gathering, Footprinting Tools and Techniques - books, articles and journals.

Keywords
Use the following keywords to search for additional materials to support your work:
● Information Gathering
● Footprinting
● Data Gathering Techniques
● Network Mapper (nmap)
● Vulnerability Scanning

Assignment 1. Information Gathering Plan

Learning Objectives and Outcomes

● You will be able to devise a plan to gather information about an organization’s systems and
networks.

Assignment Requirements
Using the network diagram of Altoro Mutual company’s systems and security infrastructure
Information Gathering Plan,” create a page or two-page plan to gather information of the
company’s systems.

Page 1 of 4
CSA 33203: Penetration Testing
Consider the following questions:
● How would you determine the company’s Internet Protocol (IP) address range?
=65.61.137.64 - 65.61.137.127

● What information can you retrieve from the Domain Name System (DNS)?
● How would you fingerprint the network?
● What information would you want to gather from systems, and how would you gather it?
● What role would social engineering play in your information gathering process?
● What information would be publicly published, and what would be worth gathering?
● What challenges you might encounter in your scans?

Required Resources
● Altoro Mutual Company weblink: http://demo.testfire.net

Assignment 2. Data Gathering and Footprinting Protection Plan

Learning Objectives and Outcomes

● You will be able to devise a plan to protect an organization from data gathering and
network and system fingerprinting.

Assignment Requirements
For this assignment, your reporting manager has asked you to write a plan for the organization
that will protect it from data gathering and footprinting. Using the network diagram given in

Page 2 of 4
CSA 33203: Penetration Testing
Assignment 1: Information Gathering Plan as a guide to what an attacker might do, prepare one
page or two-page plan to defend the campus network against attempts to gather data about
systems and networks. Explain how the data gathering techniques can be prevented by your
protection plan. In addition, explain when and how the use of data gathering tools is appropriate
or useful for the organization’s security.

Consider the following questions:

1. What information about Altoro Mutual systems is sensitive?

2. What data would be useful to aggressors?
3. Of that data, what data can be protected?
4. How can you prevent social engineering?

= As has many organizations learned how to respond to security incidents only after suffering
attacks. By this time, incidents often become much more costly than needed. Proper incident
response should be an integral part of any overall security policy and risk mitigation strategy.
There are clearly direct benefits in responding to security incidents. The value of forming a
security incident response team with explicit team member roles is a must do, as well as how to
define a security incident response plan. To successfully respond to incidents, you need to :
Minimize the number and severity of security incidents . Assemble the core Computer Security
Incident Response Team ( CSIRT ).

Sample Information Gathering Plan for Assignment 1 and Assignment 2 (if relevant)
Phases and Activities
1. Gather information
a. Review website
= http://demo.testfire.net
b. Review company information
= company located (Greenwich CT)
c. Identify technology and software used by the organization
= banking J2EE web application
d. Search for employee forum, blog, or other postings
=
e. Use Google searches to identify exposed information
= Chief Executive Officer of Altoro Mutual (Karl Fitzgerad)

2. Determining the network range

a. DNS lookup / WHOIS
= DNS server (65.61.137.117)
b. ARIN lookup

Page 3 of 4
CSA 33203: Penetration Testing
= 65.61.128.0
c. Identifying active machines
=Metasploitable machine
d. Ping or port scan 65
=80 tcp auto Apache Tomcat/Coyote JSP Engine 8080 tcp http Apache
Tomcat/CoyoteJSP Engine.
e. Detecting operating systems
=

3. Mapping the network

a. Trace route and map systems
= nmap -sV 192.168.111.183
b. Look for network design documents or published information
=

Page 4 of 4