Information Gathering ⇒ is the first and one of the most crucial phases of an engagement

• It’s a first step of a penetration testing process , on it we collect information as much as we can of our target .

Information gathering can be broken into two main logical steps.

1. Passive information gathering
   • IP addresses & Dns information
   • domain name & domain ownership information
   • email addresses & social media profiles
   • web technologies used
   • subdomains
2. Active information gathering
   • open ports on target
   • internal infrastructure of target network/organization
   • enumerating information

In passive information-gathering process we are collecting information about the targets using publicly available information(resources). Can be use Search engine results, who-is information. The goal is to find many information as possible about the target.

Active Information Gathering we can gather more information about these targets by actively interacting with them. However, unlike passive information gathering, doing this without authorization can be illegal. Can be use DNS Enumeration, Port Scanning, OS Fingerprinting. Similar to passive information gathering, goal of active information gathering is to gather information as much as possible.

Passive Information Gathering

Passive tools:

1. Google Dorking - Using Google's search engine to find specific or sensitive information.
2. VirusTotal - Website where files, domains, IPs, and URLs are uploaded to determine whether they are malicious or not.
3. Shodan - A specialized search engine for finding internet-connected devices and exposed services.
4. WHOIS Lookup: To gather information about domain ownership and registration.
5. DNS Dumpster: To find DNS records and subdomains associated with a domain.

• Google Search Operators
• Shodan Search Engine
• Censys Search Engine

References:- https://osintframework.com/