Home > CAPEC List > CAPEC-169: Footprinting (Version 2.4)  

CAPEC-169: Footprinting

 
Footprinting
Definition in a New Window Definition in a New Window
Attack Pattern ID: 169
Abstraction: Meta
Status: Draft
Completeness: Complete
+ Description

Summary

An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.

Attack Execution Flow

Explore
  1. Request Footprinting:

    The attacker examines the website information and source code of the website and uses automated tools to get as much information as possible about the system and organization.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    Open Source Footprinting: Examine the website about the organization and skim through the webpage's HTML source to look for comments.

    env-Web
    2

    Network Enumeration: Perform various queries (Registrar Query, Organizational Query, Domain Query, Network Query, POC Query) on the many whois databases found on the internet to identify domain names and associated networks.

    env-Web
    3

    DNS Interrogation: Once basic information is gathered the attack could begin to query DNS.

    env-Web
    4

    Other Techniques: Use ping sweep, TCP scan, UDP scan, OS Identification various techniques to gain more information about the system and network.

    env-Web

    Indicators

    IDTypeIndicator DescriptionEnvironments
    1Positive

    The response contains sensitive information such as ports open, network block, server version etc.

    env-Web
    2Inconclusive

    The response does not contain sensitive information about the system and network.

    env-Local

    Outcomes

    IDTypeOutcome Description
    1Success
    A list of sensitive information about the system and network.
    2Failure
    There is no information available about the system and network.

    Security Controls

    IDTypeSecurity Control Description
    1Detective
    The server may detect a large amount of port scan request, illegal ICMP and TCP packets.
+ Attack Prerequisites
  • None. Any system or network that can be detected can be footprinted. However, some configuration choices may limit the useful information that can be collected during a footprinting attack.

+ Typical Severity

Very Low

+ Typical Likelihood of Exploit

Likelihood: High

+ Methods of Attack
  • Protocol Manipulation
  • Injection
  • Analysis
  • Social Engineering
+ Examples-Instances

Description

In this example let us look at the website http://www.example.com to get much information we can about Alice. From the website, we find that Alice also runs foobar.org. We type in www example.com into the prompt of the Name Lookup window in a tool, and our result is this IP address: 192.173.28.130 We type the domain into the Name Lookup prompt and we are given the same IP. We can safely say that example and foobar.org are hosted on the same box. But if we were to do a reverse name lookup on the IP, which domain will come up? www.example.com or foobar.org? Neither, the result is nijasvspirates.org. So nijasvspirates.org is the name of the box hosting 31337squirrel.org and foobar.org. So now that we have the IP, let's check to see if nijasvspirates is awake. We type the IP into the prompt in the Ping window. We'll set the interval between packets to 1 millisecond. We'll set the number of seconds to wait until a ping times out to 5. We'll set the ping size to 500 bytes and we'll send ten pings. Ten packets sent and ten packets received. nijasvspirates.org returned a message to my computer within an average of 0.35 seconds for every packet sent. nijasvspirates is alive. We open the Whois window and type nijasvspirates.org into the Query prompt, and whois.networksolutions.com into the Server prompt. This means we'll be asking Network Solutions to tell us everything they know about nijasvspirates.org. The result is this laundry list of info: Registrant: FooBar (nijasvspirates -DOM) p.o.box 11111 SLC, UT 84151 US Domain Name: nijasvspirates.ORG Administrative Contact, Billing Contact: Smith, John jsmith@anonymous.net FooBar p.o.box 11111 SLC, UT 84151 555-555-6103 Technical Contact: Johnson, Ken kj@fierymonkey.org fierymonkey p.o.box 11111 SLC, UT 84151 555-555-3849 Record last updated on 17-Aug-2001. Record expires on 11-Aug-2002. Record created on 11-Aug-2000. Database last updated on 12-Dec-2001 04:06:00 EST. Domain servers in listed order: NS1. fierymonkey.ORG 192.173.28.130 NS2. fierymonkey.ORG 64.192.168.80 A corner stone of footprinting is Port Scanning. Let's port scan nijasvspirates.org and see what kind of services are running on that box. We type in the nijasvspirates IP into the Host prompt of the Port Scan window. We'll start searching from port number 1, and we'll stop at the default Sub7 port, 27374. Our results are: 21 TCP ftp 22 TCP ssh SSH-1.99-OpenSSH_2.30 25 TCP smtp 53 TCP domain 80 TCP www 110 TCP pop3 111 TCP sunrpc 113 TCP ident Just by this we know that Alice is running a website and email, using POP3, SUNRPC (SUN Remote Procedure Call), and ident.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

Attacker knows how to send HTTP request, run the scan tool.

+ Resources Required

The attacker requires a variety of tools to collect information about the target. These include port and network scanners and tools to analyze responses from applications to determine version and configuration information. Footprinting a system adequately may also take a few days if the attacker wishes the footprinting attempt to go undetected.

+ Solutions and Mitigations

Configuration: Keep patches up to date by installing weekly or daily if possible.

Configuration: Shut down unnecessary services/ports.

Policy: Change default passwords by choosing strong passwords.

Implementation: Curtail unexpected input.

Design: Encrypt and password-protect sensitive data.

Policy: Place offline any information that has the potential to identify and compromise your organization's security such as access to business plans, formulas, and proprietary documents.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Confidentiality
"Varies by context"
Information Leakage
+ Purposes
  • Exploitation
+ CIA Impact
Confidentiality Impact: MediumIntegrity Impact: LowAvailability Impact: Low
+ Technical Context
Architectural Paradigms
Client-Server
n-Tier
SOA
Frameworks
All
Platforms
All
Languages
All
+ References
[R.169.1] Manic Velocity. "Footprinting And The Basics Of Hacking". Web Textfiles. <http://web.textfiles.com/hacking/footprinting.txt>.
[R.169.2] Eddie Sutton. "Footprint: What Is And How Do You Erase Them". <http://www.infosecwriters.com/text_resources/pdf/Footprinting.pdf>.
+ Content History
Modifications
ModifierOrganizationDateCommentsSource
Min XuCigital, Inc.Pre-review - 0.1
Romain GaucherCigital, Inc.Performed a review of content and added additional content
CAPEC Content TeamThe MITRE Corporation2013-12-18Updated Related_Attack_PatternsInternal
CAPEC Content TeamThe MITRE Corporation2014-04-10Updated Related_Attack_PatternsInternal

Page Last Updated: April 10, 2014