Preface
To say that the world we live in is that of a digital nature is nothing short of an understatement. Our economy, society and beyond, are growing into a collection of networked systems unified by a stockpile of Ethernet and T1 lines. Depending on who you ask, this may or may not be a good thing, but the philosophy of electronic globalization is not the focus of this paper, at least, not directly. The intention of this paper is to provide an introductory to intermediate level of exposure to starting points when auditing any open system. To clarify, the aim of this paper is to provide an overview of very applicable techniques, methodologies and technologies used when dealing with black box oriented penetration testing.
Why black box testing? I am glad I asked that question for you. While I do not refute the validity of various testing methods, I feel that black box testing provides not only the greatest challenge to the tester, but can often expose the most real (relatively speaking) threats that your network may or may not ever encounter. If white box testing affords the tester a great deal of prerequisite knowledge concerning the target, the auditor may find more vulnerabilities. However, the zero knowledge approach helps to ascertain the road that a real life cracker would take with regard to exploiting a system. I think we would all much rather find the buffer overflow in our home brewed FTP server before Skiddie McDoogle does.
Before continuing I would like to make a few things known about myself. First of all, I do not claim to be a security expert, merely a somewhat morbid enthusiast with a penchant for pro-active security practices. Secondly this paper is not authored under the pretense that following information is the only way to accomplish competent information gathering and target analysis. Please keep in mind that this is a hodge podge of personal opinion and personal philosophies based on experiences I have been lucky enough to accumulate through my time as an avid security researcher, albeit amateur. In addition to the above, I would like to make it clear that this is far from an authoritative guide to penetration testing and is intended to provide preliminary insight only. No active exploits will be exercised, it is purely centered on methods used for gathering information and how that information builds an effective audit. On a final note, the completion of this document would not have been possible without the assistance of those who have been patient enough through my learning process to grace me with their influence, technology or otherwise.
Audience
The intended audience of this work is pretty much anyone interested in learning about intelligence gathering with regard to preliminary auditing in a black box environment. At the time of writing this, the direction of this paper focuses around building a knowledge base of our target. This paper will make many assumptions about the reader and their existing knowledge. It is assumed that your intentions with the information contained within extend beyond that of malicious intent. It should also be known that this is not a "for dummies" style paper. While it is far from the most advanced paper you can find, it will not explain and outline every example and/or command. Some aspects may be elaborated upon but not to a particularly elementary extent. In the event that you, the reader, do not understand something, please take it upon yourself and embrace the hacker ethic in an attempt to understand the material to its fullest extent and beyond.
All tools used and examples given in this document will be performed in a Linux environment. This is not done in an attempt to alienate Windows users but rather that I do not have enough time to author one for each operating system.
On a final introductory note, please do not forget that better security comes through real life application which often involves hacking your own networks or those built to be hacked, just do so responsibly. This paper contains examples using many powerful and widely deployed tools. These are tools used for what some consider a black art and if you use them to pentest, that's the nature of the beast. There is an art to network security which extends beyond the programs others have given to the community. This knowledge and the tools associated with it should be treated with respect and used effectively.