On this posting, I’m going to guide how to gather DNS information using nslookup, host, dig & whois NSLOOKUP The following is a checklist of reconnaissance goals: Acknowledging the goals Defining the use of applications and services Acknowledging the type of system, confirming the available ports, confirming the running services, social engineering information, document discovery. Tools include tools for investigating networks, data centers, wireless networks, and host systems. Kali Linux provides a category labeled “Information Gathering”, which is a reconnaissance resource. The results of the reconnaissance process should include a list of all target assets, what applications are associated with the asset, services to be used, and possible asset owners. This data can be used to develop a plan to see what the best way to get the desired results. Once the target is identified, a survey is performed to gather information about the target, such as which ports are used for communication, where the target is hosted, what services it provides to the customer, and so on. When reconnaissance, the target environment must be defined according to the work area. Reconnaissance is the first step in penetration testing, whether the penetration tester is known to confirm the target system, or to find known intelligence. Scouting services may include Internet footprints for investigating targets, monitoring resources, monitoring personnel, processes, etc., scanning network information (such as IP addresses and system types), and social engineering public services such as help desks.

Black-box testing requires more reconnaissance than white-box testing because testers do not get too much data. The more targeted information the penetration tester finds, the better the chances of identifying the easiest and fastest way to succeed. Prior to an attack, the penetration tester should know as much as possible about the target environment and the characteristics of the system.

Online network tools nslookup