An attacker engages in probing and exploration activity to identify
constituents and properties of the target. Footprinting is a general term to
describe a variety of information gathering techniques, often used by
attackers in preparation for some attack. It consists of using tools to
learn as much as possible about the composition, configuration, and security
mechanisms of the targeted application, system or network. Information that
might be collected during a footprinting effort could include open ports,
applications and their versions, network topology, and similar information.
While footprinting is not intended to be damaging (although certain
activities, such as network scans, can sometimes cause disruptions to
vulnerable applications inadvertently) it may often pave the way for more
damaging attacks.
Attack Execution Flow
Explore
Request Footprinting:
The attacker examines the website information and
source code of the website and uses automated tools
to get as much information as possible about the
system and organization.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
Open Source Footprinting: Examine the
website about the organization and skim through
the webpage's HTML source to look for comments.
env-Web
2
Network Enumeration: Perform various queries
(Registrar Query, Organizational Query, Domain
Query, Network Query, POC Query) on the many whois
databases found on the internet to identify domain
names and associated networks.
env-Web
3
DNS Interrogation: Once basic information is
gathered the attack could begin to query DNS.
env-Web
4
Other Techniques: Use ping sweep, TCP scan,
UDP scan, OS Identification various techniques to
gain more information about the system and
network.
env-Web
Indicators
ID
Type
Indicator Description
Environments
1
Positive
The response contains sensitive information
such as ports open, network block, server version
etc.
env-Web
2
Inconclusive
The response does not contain sensitive
information about the system and network.
env-Local
Outcomes
ID
Type
Outcome Description
1
Success
A list of sensitive information
about the system and
network.
2
Failure
There is no information
available about the system and
network.
Security Controls
ID
Type
Security Control Description
1
Detective
The server may detect
a large amount of port scan request, illegal ICMP
and TCP packets.
Attack Prerequisites
None. Any system or network that can be detected can be footprinted.
However, some configuration choices may limit the useful information that
can be collected during a footprinting attack.
Typical Likelihood of Exploit
Likelihood: High
Methods of Attack
Protocol Manipulation
Injection
Analysis
Social Engineering
Examples-Instances
Description
In this example let us look at the website http://www.example.com to
get much information we can about Alice. From the website, we find that
Alice also runs foobar.org. We type in www example.com into the prompt
of the Name Lookup window in a tool, and our result is this IP address:
192.173.28.130 We type the domain into the Name Lookup prompt and we are
given the same IP. We can safely say that example and foobar.org are
hosted on the same box. But if we were to do a reverse name lookup on
the IP, which domain will come up? www.example.com or foobar.org?
Neither, the result is nijasvspirates.org. So nijasvspirates.org is the
name of the box hosting 31337squirrel.org and foobar.org. So now that we
have the IP, let's check to see if nijasvspirates is awake. We type the
IP into the prompt in the Ping window. We'll set the interval between
packets to 1 millisecond. We'll set the number of seconds to wait until
a ping times out to 5. We'll set the ping size to 500 bytes and we'll
send ten pings. Ten packets sent and ten packets received.
nijasvspirates.org returned a message to my computer within an average
of 0.35 seconds for every packet sent. nijasvspirates is alive. We open
the Whois window and type nijasvspirates.org into the Query prompt, and
whois.networksolutions.com into the Server prompt. This means we'll be
asking Network Solutions to tell us everything they know about
nijasvspirates.org. The result is this laundry list of info: Registrant:
FooBar (nijasvspirates -DOM) p.o.box 11111 SLC, UT 84151 US Domain Name:
nijasvspirates.ORG Administrative Contact, Billing Contact: Smith, John
jsmith@anonymous.net FooBar p.o.box 11111 SLC, UT 84151 555-555-6103
Technical Contact: Johnson, Ken kj@fierymonkey.org fierymonkey p.o.box
11111 SLC, UT 84151 555-555-3849 Record last updated on 17-Aug-2001.
Record expires on 11-Aug-2002. Record created on 11-Aug-2000. Database
last updated on 12-Dec-2001 04:06:00 EST. Domain servers in listed
order: NS1. fierymonkey.ORG 192.173.28.130 NS2. fierymonkey.ORG
64.192.168.80 A corner stone of footprinting is Port Scanning. Let's
port scan nijasvspirates.org and see what kind of services are running
on that box. We type in the nijasvspirates IP into the Host prompt of
the Port Scan window. We'll start searching from port number 1, and
we'll stop at the default Sub7 port, 27374. Our results are: 21 TCP ftp
22 TCP ssh SSH-1.99-OpenSSH_2.30 25 TCP smtp 53 TCP domain 80 TCP www
110 TCP pop3 111 TCP sunrpc 113 TCP ident Just by this we know that
Alice is running a website and email, using POP3, SUNRPC (SUN Remote
Procedure Call), and ident.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
Attacker knows how to send HTTP request, run the scan tool.
Resources Required
The attacker requires a variety of tools to collect information about the
target. These include port and network scanners and tools to analyze responses
from applications to determine version and configuration information.
Footprinting a system adequately may also take a few days if the attacker wishes
the footprinting attempt to go undetected.
Solutions and Mitigations
Configuration: Keep patches up to date by installing weekly or daily if
possible.
Configuration: Shut down unnecessary services/ports.
Policy: Change default passwords by choosing strong passwords.
Implementation: Curtail unexpected input.
Design: Encrypt and password-protect sensitive data.
Policy: Place offline any information that has the potential to identify
and compromise your organization’s security such as access to business
plans, formulas, and proprietary documents.
Description
