just the hard, technical, “can you break into a system from open ports” style of attack.
It may include operational responses, human interfaces, social engineering, and much
more. Ultimately, the security posture of a business is impacted by far more than just
which services are exposed to the outside world. As a result, there is far more to per‐
forming reconnaissance in preparation for security testing than just performing a
port scan.
One of the great things about the internet is that there is just so much information.
The longer you are connected and interact with the internet, the more breadcrumbs
there are about you. This is true of people and businesses. Think about social net‐
working sites just as a starting point. What sort of presence do you have? How much
information have you scattered around about you? What about as an employee for
the company you are working for? In addition to all of this, the internet stores infor‐
mation just to keep itself running and allow us to get around. This is information
about domain names, contact information, company details, addressing, and other
useful data for you as you are working through a security test.
Over time, the importance of locating this information has generated many tools to
make that information easier to extract from the places it’s stored. This includes
command-line tools that have been around for a while, but also websites, browser
plug-ins, and other programs. There are so many places to mine for information,
especially as more and more people are online and there are more places gathering
information. We won’t go over all the ways to gather information through different
websites, though there are a lot of sites you can use. We will focus on tools that are
available in Kali, with a little discussion over extensions you can add into Firefox,
which is the browser used as the default in Kali.
