Now let's say that we actually got that information of the actual owner
themselves and wanted to go do a more active recon.
Well, that's where we would potentially contact the owner of the building
itself and see if we can set up next door.
Yes, that's a thing.
Let's say we set up our recon inside a suite A so we can do wireless sweeps so
that way we're not sitting too far away.
The next thing after that is, is there anything inside the building itself like
an IDS or IPS?
And that would prevent us from being able to do more scans.
But the real quick and nitty gritty behind our actual passive recon is us being
able to identify where the target is.
Well, first get their permission, identify where it's at, see if there's
anything outside of the building that would allow us to be able to manipulate
to be able to access networks inside the building.
And then move forward to see if they have a forward facing web domain or access
from the.
Internet from where we are. I'm trying to choose my words carefully here.
And so that we can pivot potentially from here through the domain and into
their systems because that would allow us to be able to start mapping out how
the network actually looks in what systems they have within.
Now, because the website is third party and hosted by GoDaddy, we know that
there's going to be a lot of extra steps in the way and there may not actually
be that much equipment inside the building.
In hand, there's not.
But we use this as a site example to be able to get an idea of what passive
recon looks like in scope of an actual fintest.
Adity.
Now public information does show that there's an event going on this weekend as
we are recording at hybrid.
I'm not going to be posting that up because I'm not trying to do this as a
sponsor to have a video or anything like that.
But the reason that I do bring that up is because that's an opportunity for us
to blend in with the environment surrounding and get a more.
Passive recon of what's actually inside of the building itself. Everything that
we've done up to this point has been outside the building and based on public
information.
But if there's an event going on that's open to the public, we should be able
to go there as well too.
So long as we remember that is included inside the scope because that turns
into a form of social engineering that the owner slash C suite needs to be
aware of.
That's within the boundaries of the actual pintest overall overall the goal of
reconnaissance is to build an overall blueprint of not only the physical
structure, but anything that's going to be available.
But anything that could exist in terms of network and other system involved
that are falling within the scope of our pintest.
So whether we're doing reconnaissance outside the building or doing public
records search and scouring the web for information pertaining to websites,
networks, instruction manuals, documentation, or actually showing up to social
engineers and event to make it look like we totally belong there.
All this is to allow us to be able to build up a good level of information
passively without raising any alarms as to what it is that we're actually doing
.
Now, there are things to consider as well too, such as when do we cross from
passive to actively going through and doing reconnaissance.