Ravindra BagaleCourses & study guides मराठी Track your progress

19. Information Gathering and Scanning

By Last updated:

Chala mitrano, kontyahi hallyacha pahila tappa mhanje mahiti gola karne – recon. Chor ghar phodnyaadhi aadhi ghar pahato: darvaje kiti, khidkya kuthe, kutra aahe ka. Attacker pan tech karto: domain konacha, subdomains kiti, kontya machines chalu aahet, konte ports ughde aahet, tyavar konti service aani konta version aahe. Aaj aapan he sagla defender chya najrene shiku – karan jo recon samjto, toch to logs madhe olkhu shakto. Ek goshta punha sangto, lakshat theva: pratyek lab fakt tumchya host-only lab madhe (Kali 192.168.56.10, Metasploitable 2 192.168.56.20). Baherchya konatyahi domain kiwa IP var he tools chalvaycha nahi. Ghabru naka, ekdum simple aahe – chala suru karuya!

What you will learn in this chapter

  • Passive vs active reconnaissance (टेहळणी), and why the difference matters legally and for detection
  • whois and dig: registration data, DNS records and zone transfers, tested on the lab's own BIND server
  • theHarvester and Recon-ng (overview) and a Maltego introduction – used only on lab data
  • Netdiscover for finding live hosts on your lab network
  • Nmap in depth: host discovery, port states, scan types, service/OS detection, NSE, timing and output files
  • Masscan for very fast port scanning – and when it is (and is not) the right tool
  • How defenders detect and block scanning: IDS alerts, firewall rules, rate limiting and closing unused ports

Lab scope for this whole chapter

Every lab below targets only your host-only network 192.168.56.0/24 (Metasploitable 2 at 192.168.56.20) and a private lab domain lab.local that you create yourself on Metasploitable 2. Do not run these tools against real domains, your institute or office network, public IPs or cloud ranges – even "passive" OSINT on a real organisation needs written permission in a professional engagement.

One-time lab setup: a lab DNS zone on Metasploitable 2. Metasploitable 2 already runs BIND (a DNS server) on port 53. We give it a small fake domain lab.local so that the dig, theHarvester, Recon-ng and Maltego labs all have a safe target. Log in to Metasploitable 2 (msfadmin / msfadmin):

# on Metasploitable 2 (very old Ubuntu – it uses /etc/init.d scripts, not 'service')
sudo nano /etc/bind/named.conf.local
#   zone "lab.local" { type master; file "/etc/bind/db.lab.local"; allow-transfer { any; }; };
sudo nano /etc/bind/db.lab.local

$TTL 300
@       IN SOA  ns1.lab.local. admin.lab.local. ( 1 3600 600 86400 300 )
@       IN NS   ns1.lab.local.
@       IN MX   10 mail.lab.local.
@       IN TXT  "v=spf1 mx -all"
ns1     IN A    192.168.56.20
www     IN A    192.168.56.20
mail    IN A    192.168.56.20
dev     IN A    192.168.56.20
vpn     IN A    192.168.56.20

sudo named-checkzone lab.local /etc/bind/db.lab.local   # test the zone before restarting
sudo /etc/init.d/bind9 restart

The allow-transfer { any; } line is a deliberate misconfiguration so you can watch a zone transfer succeed in 19.2 – and then fix it.

Concepts in this chapter

  1. 19.1Passive vs Active Recon
  2. 19.2whois and dig
  3. 19.3theHarvester and Recon-ng (Overview)
  4. 19.4Maltego Introduction
  5. 19.5Netdiscover: Finding Lab Hosts
  6. 19.6Nmap Basics: Host Discovery, Port States and Scan Types
  7. 19.7Service Versions, OS Detection and NSE Scripts
  8. 19.8Timing, Output Formats and Scan Hygiene
  9. 19.9Masscan: Very Fast Port Scanning
  10. 19.10How Defenders Detect Scanning
  11. 19.11Red vs Blue, Project and Real Incidents

The chapter recap is at the end of the last concept page.

Chapter 19: Information gathering and scanning — practice tasks

Open chapter lessons · Full guided lab: inventory lab devices services close list (not repeated here)

19.1 Nmap your own VM

EasyIT

Why: Scanning shows what an attacker would see.

What: Scan the target VM's top ports.

How:

  1. nmap -sV -T4 192.168.56.101 (use your VM IP)
  2. Note open ports and versions.

Expected output: 22/ssh, 80/http etc. with versions.

Hint

Only scan IPs you own.

Answer / how to check
  1. Results match ss -tulpn on the VM.

19.2 Passive recon on a test domain

EasyRetail

Why: Passive recon touches nothing on the target.

What: Collect public info for example.com.

How:

  1. whois example.com
  2. dig NS example.com
  3. Open crt.sh and search example.com.

Expected output: Registrar, name servers, cert names.

Hint

Passive means no packets to the target web server.

Answer / how to check
  1. You never contacted the web server.

19.3 Compare SYN vs connect scan in a log

MediumHealthcare

Why: Defenders see scans differently.

What: Run both scans on your VM and watch with tcpdump.

How:

  1. On the VM: sudo tcpdump -n port 80 -c 20.
  2. From Kali: sudo nmap -sS -p80 VM then nmap -sT -p80 VM.

Expected output: -sT completes the handshake; -sS ends with RST.

Hint

Look for [R] after [S.].

Answer / how to check
  1. You can name which scan finished the handshake.