Chapter 04: Footprinting and Social Engineering
attempt to transfer all the records for which the DNS server is responsible. This process, called a zone transfer,
can be done with the Dig command. (For those familiar with the Nslookup command, Dig is now the
31. Explain the process of “footprinting,” and why it is important to a security professional?
Footprinting is a process of finding information on a company’s network. An important concept is that
footprinting is passive, or non-intrusive; in other words, you aren’t accessing information illegally or gathering
unauthorized information with false credentials. With passive reconnaissance, you are not even engaging with
the remote systems, but rather attempting to glean information about your target from other sources. Active
footprinting, on the other hand, means you are prodding the target network in ways that might seem suspicious
to network defenders. This includes things like port scans, DNS zone transfers, and interacting with a target’s
Web server.
32. List at least five tools available for footprinting.
The following tools can be used for footprinting: Google groups, Whois, Web Data Extractor, FOCA,
Necrosoft NS Scan, Google search engine, Namedroppers, White Pages, Metis, Dig, Netcat, Wget, Paros, and
Maltego.
33. What is “competitive intelligence”?
Information gathering, called competitive intelligence, is done on a high level through technology to discover
information about an organization. As a security professional, you should be able to explain to the company
that hired you all the methods competitors may use to gather information. To limit the amount of information a
company makes public, you should have a good understanding of what a competitor would do to discover
confidential information.
34. How can computer criminals use the Whois utility for their purposes?
The Whois utility is a commonly used tool for gathering IP address and domain information. With just a
company’s Web address, you can discover a tremendous amount of information. Unfortunately, attackers can
also make use of this information. Often companies don’t realize that they’re publishing information on the
Web that computer criminals can use. The Whois utility gives you information on a company’s IP addresses
and any other domains the company might be part of.
35. How can a computer criminal use HTTP methods before running an exploit on a server?
If you know HTTP methods, you can send a request to a Web server and, from the generated output,
determine what OS the Web server is using. You can also find other information that could be used in an
attack. After you determine which OS version a company is running, you can search for any exploits that
might be used against that network’s systems.
36. What is the purpose of a Web bug, and do they relate to or differ from spyware?
A Web bug is a 1-pixel x 1-pixel image file referenced in an tag, and it usually works with a cookie. Its
purpose is similar to that of spyware and adware: to get information about the person visiting the Website.
Web bugs are not from the same Web site as the Web page creator. They come from third-party companies
specializing in data collection. Security professionals need to be aware of cookies and Web bugs to keep these
information-gathering tools off company computers.
37. How can DNS be used for footprinting?
DNS uses name servers to resolve names. After you determine what name server a company is using, you can