How to Use Footprinting to Plan an Ethical Hack
One way to begin planning an ethical hack on your business is through a process often called footprinting. Through footprinting, you see what others can see about your organization and systems. Here is the process for footprinting:
Gather public information
The amount of information you can gather about an organization’s business and information systems is staggering and widely available on the Internet. Your job is to find out what’s out there. This information allows malicious attackers and employees to target specific areas of the organization, including departments and key individuals.
The following techniques can be used to gather information about your organization.
Social media sites are the new means for businesses interacting online. Perusing the following sites can provide untold details on any given business and its people:
Performing a web search or simply browsing your organization’s website can turn up the following information:
Employee names and contact info
Important company dates
Press releases about physical moves, organizational changes, and new products
Mergers and acquisitions
Patents and trademarks
Presentations, articles, webcasts, or webinars
With Google, you can search the Internet in several ways:
By typing keywords: This kind of search often reveals hundreds and sometimes millions of pages of information — such as files, phone numbers, and addresses — that you never guessed were available.
By performing advanced web searches: Google’s advanced search options can find sites that link back to your company’s website. This type of search often reveals a lot of information about partners, vendors, clients, and other affiliations.
By using switches to dig deeper into a website: For example, if you want to find a certain word or file on your website, simply enter a line like one of the following into Google:
site:www.your_domain.com keyword site:www.your_domain.com filename
You can even do a generic filetype search across the entire Internet to see what turns up, such as this:
Use the preceding search to find Flash .swf files, which can be downloaded and decompiled to reveal sensitive information that can be used against your business.
Use the following search to hunt for PDF documents that might contain sensitive information that can be used against your business:
filetype:pdf company_name confidential
Web-crawling utilities, such as HTTrack website Copier, can mirror your website by downloading every publicly accessible file from it. You can then inspect that copy of the website offline, digging into the following:
The website layout and configuration
Directories and files that might not otherwise be obvious or readily accessible
The HTML and script source code of web pages
Comment fields often contain useful information such as names and e-mail addresses of the developers and internal IT personnel, server names, software versions, internal IP addressing schemes, and general comments about how the code works.
The following websites may provide specific information about an organization and its employees:
Government and business websites:
www.sec.gov/edgar.shtml shows SEC filings of public companies.
www.uspto.gov offers patent and trademark registrations.
The website for your state’s Secretary of State or similar organization can offer incorporation and corporate officer information.
Background checks and other personal information:
Map the network
When you map your network, you can search public databases and resources to see what other people know about your network.
The best starting point is to perform a Whois lookup by using any one of the Whois tools available on the Internet. You may have used Whois to check whether a particular Internet domain name is available.
For ethical hacking, Whois provides the following information that can give a hacker a leg up to start a social engineering attack or to scan a network:
Internet domain name registration information, such as contact names, phone numbers, and mailing addresses
DNS servers responsible for your domain
You can look up Whois information at one of the following places:
You can run DNS queries directly from www.mxtoolbox.com to
Display general domain-registration information
Show which host handles e-mail (the Mail Exchanger or MX record) for a domain
Map the location of specific hosts
Determine whether the host is listed on certain spam blacklists
A free site you can use for more basic Internet domain queries is http://dnstools.com.
The following list shows various lookup sites for other categories:
Google Groups can reveal surprising public network information. Search for such information as your fully qualified domain names (FQDNs), IP addresses, and usernames. You can search millions of Usenet posts that date back to 1981 for public and often very private information.
You might find some information that you didn’t realize was made public, such as the following:
A tech-support or message board post that divulges too much information about your systems. Many people who post messages like these don’t realize that their messages are shared with the world or how long they are kept.
Confidential company information posted by disgruntled employees or clients.
If you discover that confidential information about your company is posted online, you may be able to get it removed. Check out the Google Groups help page at for details.