Introduction to Footprinting

Footprinting (or reconnaissance) is the first phase of ethical hacking, where attackers gather information about a target before launching an attack. Ethical hackers use the same techniques to identify security weaknesses.

Objectives

• Collect publicly available data about the target.
• Identify network ranges, domains, IPs, employees, technologies.
• Build a blueprint of the target's security posture.

---

Types of Footprinting

A. Passive Footprinting

• No direct interaction with the target.
• Uses publicly available sources.
• Examples:
  • Google searches (Google Dorking)
  • WHOIS lookup
  • Social media (LinkedIn, Twitter)
  • Job postings (revealing tech stacks)

B. Active Footprinting

• Direct interaction with the target.
• More detectable but provides accurate data.
• Examples:
  • DNS interrogation (nslookup, dig)
  • Network scanning (Nmap, Ping)
  • Social engineering (calls, phishing)

---

Footprinting Techniques & Tools

A. Google Dorking (Advanced Search Queries)

• Finds exposed files, directories, and sensitive data.
• Examples:
  • site:example.com filetype:pdf — Finds PDFs on a site
  • intitle:"index of" password — Finds exposed password files
  • inurl:/admin/login.php — Finds admin login pages

B. WHOIS Lookup

• Retrieves domain registration details:
  • Owner name, email, phone number
  • Registrar, DNS servers, creation/expiry dates
• Tools:
  • whois command (Linux)
  • whois.domaintools.com
  • WHOIS Kali Linux tools

C. DNS Enumeration

• Extracts DNS records (A, MX, TXT, NS).
• Tools:
  • nslookup
  • dig (Domain Information Groper)
  • dnsenum (Kali Linux)
  • DNSDumpster

D. Social Media & OSINT (Open-Source Intelligence)

• Gathers employee names, emails, tech stack.
• Tools:
  • Maltego — Visual link analysis
  • theHarvester — Email, domain scraping
  • Sherlock — Username search across platforms
  • LinkedIn, GitHub, Twitter (Manual recon)

E. Network Scanning (Preliminary)

• Identifies live hosts, open ports, services.
• Tools:
  • ping — Checks host availability
  • Nmap — Advanced network scanning
  • Masscan — Fast large-scale scans

---

Advanced Reconnaissance Techniques

A. Email Harvesting

• Collects employee emails for phishing tests.
• Tools:
  • Hunter.io
  • theHarvester — theHarvester -d example.com -b google

B. Subdomain Enumeration

• Finds subdomains (e.g., admin.example.com).
• Tools:
  • Sublist3r
  • Amass — Passive/active subdomain discovery
  • OWASP Amass

C. Metadata Extraction

• Extracts hidden data from PDFs, Word, Excel files.
• Tools:
  • exiftool
  • Metagoofil — Automates extraction from Google results

D. Website Mirroring (Offline Analysis)

• Downloads a full copy of a website for inspection.
• Tools:
  • wget --mirror
  • HTTrack

---

Countermeasures Against Footprinting

---

Hands-On Lab Exercise

Task: Perform Passive & Active Recon on a Target

1. Google Dorking — Find exposed files (site:example.com filetype:pdf)
2. WHOIS Lookup — Identify domain owner (whois example.com)
3. DNS Enumeration — List all DNS records (dig example.com ANY)
4. Subdomain Discovery — Use Sublist3r (sublist3r -d example.com)
5. Email Harvesting — Use theHarvester (theHarvester -d example.com -b google)

---

Tools Checklist

Tool	Purpose
Maltego	Visual link analysis & OSINT
theHarvester	Email, domain, and subdomain search
Nmap	Network scanning & service detection
Sublist3r	Subdomain enumeration
Metagoofil	Metadata extraction from documents

---

Next Steps

• Move to Module 3: Scanning & Enumeration (Nmap, Nessus, NetBIOS)
• Practice CTF challenges on TryHackMe or Hack The Box

---