Home > CAPEC List > CAPEC-169: Footprinting (Version 2.11)  

CAPEC-169: Footprinting

Definition in a New Window Definition in a New Window
Attack Pattern ID: 169
Abstraction: Meta
Status: Stable
Completeness: Complete
Presentation Filter:
+ Summary

An adversary engages in probing and exploration activities to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.

+ Attack Steps
  1. Request Footprinting: The attacker examines the website information and source code of the website and uses automated tools to get as much information as possible about the system and organization.

    Open Source Footprinting: Examine the website about the organization and skim through the webpage's HTML source to look for comments.

    Network Enumeration: Perform various queries (Registrar Query, Organizational Query, Domain Query, Network Query, POC Query) on the many whois databases found on the internet to identify domain names and associated networks.

    DNS Interrogation: Once basic information is gathered the attack could begin to query DNS.

    Other Techniques: Use ping sweep, TCP scan, UDP scan, OS Identification various techniques to gain more information about the system and network.

+ Attack Prerequisites
  • An application must publicize identifiable information about the system or application through voluntary or involuntary means. Certain identification details of information systems are visible on communication networks (e.g., if an adversary uses a sniffer to inspect the traffic) due to their inherent structure and protocol standards. Any system or network that can be detected can be footprinted. However, some configuration choices may limit the useful information that can be collected during a footprinting attack.

+ Typical Severity

Very Low

+ Typical Likelihood of Exploit

Likelihood: High

+ Methods of Attack
  • Protocol Manipulation
  • Injection
  • Analysis
  • Social Engineering
+ Examples-Instances


In this example let us look at the website http://www.example.com to get much information we can about Alice. From the website, we find that Alice also runs foobar.org. We type in www example.com into the prompt of the Name Lookup window in a tool, and our result is this IP address: We type the domain into the Name Lookup prompt and we are given the same IP. We can safely say that example and foobar.org are hosted on the same box. But if we were to do a reverse name lookup on the IP, which domain will come up? www.example.com or foobar.org? Neither, the result is nijasvspirates.org. So nijasvspirates.org is the name of the box hosting 31337squirrel.org and foobar.org. So now that we have the IP, let's check to see if nijasvspirates is awake. We type the IP into the prompt in the Ping window. We'll set the interval between packets to 1 millisecond. We'll set the number of seconds to wait until a ping times out to 5. We'll set the ping size to 500 bytes and we'll send ten pings. Ten packets sent and ten packets received. nijasvspirates.org returned a message to my computer within an average of 0.35 seconds for every packet sent. nijasvspirates is alive. We open the Whois window and type nijasvspirates.org into the Query prompt, and whois.networksolutions.com into the Server prompt. This means we'll be asking Network Solutions to tell us everything they know about nijasvspirates.org. The result is this laundry list of info: Registrant: FooBar (nijasvspirates -DOM) p.o.box 11111 SLC, UT 84151 US Domain Name: nijasvspirates.ORG Administrative Contact, Billing Contact: Smith, John jsmith@anonymous.net FooBar p.o.box 11111 SLC, UT 84151 555-555-6103 Technical Contact: Johnson, Ken kj@fierymonkey.org fierymonkey p.o.box 11111 SLC, UT 84151 555-555-3849 Record last updated on 17-Aug-2001. Record expires on 11-Aug-2002. Record created on 11-Aug-2000. Database last updated on 12-Dec-2001 04:06:00 EST. Domain servers in listed order: NS1. fierymonkey.ORG NS2. fierymonkey.ORG A corner stone of footprinting is Port Scanning. Let's port scan nijasvspirates.org and see what kind of services are running on that box. We type in the nijasvspirates IP into the Host prompt of the Port Scan window. We'll start searching from port number 1, and we'll stop at the default Sub7 port, 27374. Our results are: 21 TCP ftp 22 TCP ssh SSH-1.99-OpenSSH_2.30 25 TCP smtp 53 TCP domain 80 TCP www 110 TCP pop3 111 TCP sunrpc 113 TCP ident Just by this we know that Alice is running a website and email, using POP3, SUNRPC (SUN Remote Procedure Call), and ident.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

The adversary knows how to send HTTP request, run the scan tool.

+ Resources Required

The adversary requires a variety of tools to collect information about the target. These include port/network scanners and tools to analyze responses from applications to determine version and configuration information. Footprinting a system adequately may also take a few days if the attacker wishes the footprinting attempt to go undetected.

+ Solutions and Mitigations

Keep patches up to date by installing weekly or daily if possible.

Shut down unnecessary services/ports.

Change default passwords by choosing strong passwords.

Curtail unexpected input.

Encrypt and password-protect sensitive data.

Avoid including information that has the potential to identify and compromise your organization's security such as access to business plans, formulas, and proprietary documents.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Read application data
+ Purposes
  • Exploitation
+ CIA Impact
Confidentiality Impact: MediumIntegrity Impact: LowAvailability Impact: Low
+ Technical Context
Architectural Paradigms
+ References
[R.169.1] Manic Velocity. "Footprinting And The Basics Of Hacking". Web Textfiles. <http://web.textfiles.com/hacking/footprinting.txt>.
[R.169.2] Eddie Sutton. "Footprint: What Is And How Do You Erase Them". <http://www.infosecwriters.com/text_resources/pdf/Footprinting.pdf>.
[R.169.3] [REF-20] Stuart McClure, Joel Scambray and George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". Chapter 2: Scanning, pp. 38-39. 6th Edition. McGraw Hill. 2009.
[R.169.4] [REF-22] Gordon "Fyodor" Lyon. "Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning". Section 3.1 Introduction, pg. 47. 3rd "Zero Day" Edition,. Insecure.com LLC, ISBN: 978-0-9799587-1-7. 2008.
+ Content History
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
CAPEC Content TeamThe MITRE Corporation2017-05-01Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_ExploitInternal

More information is available — Please select a different filter.
Page Last Updated or Reviewed: August 04, 2017