The Preparation Stage of an Attack — Reconnaissance

頻出~14 min2 terms1 past questions

Goals of this unit

Explain the role of the reconnaissance an attacker carries out before a full-scale attack.
Give examples of the sources used in footprinting and what can be learned from them.
Describe how port scanning works and tell it apart from techniques used after a break-in.

Terms at a glance (2)

Term	In one line	Main clues	Traffic to the target
フットプリンティング	Researching the target organization by collecting publicly available information	Public information such as websites, registration records, and social media	Mostly not needed
ポートスキャン	Trying to connect to each port and using the responses to find which services are running	How each port reacts to a connection	Actually sent

フットプリンティングFootprinting

Open in glossary

Footprinting (フットプリンティング) is researching a target organization before an attack by gathering publicly available information about it.

Example source	Example information picked up
The organization's website	Department names, locations, business partners
Domain registration records	Registrant, servers in use
Social media posts and job ads	Employee names, products in use
Search engines	Documents published by mistake

For example, an attacker may pick up employee names, the format of email addresses, and hints about the products in use from the organization's website, social media posts, and job ads. The information can then be used to narrow down which people or devices to aim at, and to prepare for later technical probing or attacks that trick people.

AnalogyIt is like checking reviews, a map, and the notices posted outside a shop on a trip before going in, so you have a rough idea of its hours and how crowded it gets. You stay outside and size it up using only what can be seen from there.

How to rememberA footprint is a trace left behind: footprinting collects the traces a target has left out in the world.

Exam points

Mix-upFootprinting (フットプリンティング) is a research stage, and by itself it is not unauthorized intrusion (不正侵入) into the target's systems.

ポートスキャンPort scanning

Open in glossary

Port scanning (ポートスキャン) means trying to communicate with a target computer's ports (numbers that identify points of entry for communication) one after another to find out which ones accept connections.

Pick the port numbers to check in turn
Try connecting to each port
Record whether each connection worked
Infer which services are running

Use the numbers of the open ports to estimate which services are running.

4 / 4

Because each service is identified by a port number, knowing which ports are open gives a good idea of which services, such as web or email, are running. From there, an attacker gets clues for finding software with known vulnerabilities (security weaknesses). When administrators run it against their own organization's devices, it also serves as a check for ports left open without need.

AnalogyIt is like going down the hall of an apartment building pressing every intercom button in order and noting which units answer.

How to rememberTo scan is to read through from one end to the other, the same word as the scanner that reads paper documents.

Exam points

ExamPort scanning (ポートスキャン) is a survey of which ports are open, and it is different from a backdoor (バックドア), which is something left behind after a break-in so the attacker can get back in.

1 past questions on this term ポートスキャン

Footprinting vs. Port scanning

Aspect	Footprinting	Port scanning
Key differenceMain clues	Public information anyone can see	How each port reacts to a connection
Traffic to the target	Mostly not needed	Actually sends traffic to the target
Examples of what is learned	People in the organization and products in use	Open ports and running services

Key points

Before a full-scale attack, an attacker may carry out reconnaissance to study the target.
Footprinting is preliminary research that builds a picture of the target organization from public information.
Port scanning is a survey that works out which services are running from the results of connecting to each port.
Port scanning your own organization's devices also works as a check for ports left open without need.

Check questions

1 past question from this unit

Start the check questions

All past questions in this topic