Reconnaissance

You know, the US government has something called the Central Intelligence Agency, or the CIA, and most other developed countries have something similar to that. It is an organization within the US government that actually does intelligence, that collects intelligence. Because really, when it comes to warfare — and at this point in time I'm talking about warfare between countries — when it comes to warfare, intelligence is a huge part of success.

Well, the same thing is true when we're carrying out an attack against a target. Information is a key part to our success. Whether we're using it to figure out how to get our initial access into that organization, or we're using it to attack different things within that organization, intelligence is huge, and we collect that intelligence through reconnaissance.

What reconnaissance is

Simply put, reconnaissance is just collecting data about a target. I think there's more than one definition to reconnaissance, though. I like to think about reconnaissance from a few different angles.

First of all, I think of reconnaissance as a form of attack. Now, some of what we do with reconnaissance isn't much of an attack — it's just information gathering from open-source intelligence, and we're really not crossing any lines. But there is a point in time when reconnaissance becomes a line that you cross and it is officially an attack.

But I also like to think of reconnaissance as a phase. That is, one of the processes that we go through as we carry out an attack against a target. So here's what that looks like, and I'm going to use the cyber kill chain as an example. Here we've got the reconnaissance phase right here. We would go through researching during this phase, researching a target and figuring out all of the nuances, all the information, gathering all that information about the target during this phase of our attack.

When it comes to the MITRE ATT&CK, which is that database full of information about tactics and techniques, reconnaissance is a tactic as well. So we can think of reconnaissance as being a tactic. There are also the discovery tactics and the collection tactic. These two I consider as being a reconnaissance — you're exploring things. But like in the discovery phase, what you're doing is you're figuring out the network itself. This is after you've penetrated that network, and then you're discovering things on that network. It's a form of reconnaissance.

So really, this all just means the same thing. In all cases, we're collecting data about a target. But in some ways we can think of it as a type of attack, in some ways we can think of it as a tactic, and other ways we can think of it as a phase in our attack.

Enumeration and discovery

There are some other terms that we use that are very similar to reconnaissance, such as enumeration. Enumeration is collecting detailed information about a target. Sounds very similar, doesn't it? You'll hear both of these terms. And what is the difference? Well, reconnaissance is this broader scope, this bigger picture, where enumeration is a little more detailed of information.

So enumeration — think of enumeration like in numbers, we're counting. Maybe we're counting the number of directory users and groups. So this is an example. Versus reconnaissance, we're not necessarily counting how many users and groups. Maybe we're looking at, well, who's the CEO? And we're gathering that information from a website. So we go and take a look at the target's website and we see who the CEO is, and then we record that information. So reconnaissance is more of this broader scope of collecting information, versus enumeration, where we start getting into the details of actually counting things out and figuring out the real minute details.

Another term you may run across is something called discovery: the process to identify and understand an organization's assets, resources and vulnerabilities. So this term discovery essentially is very similar to reconnaissance. I like to think of reconnaissance as being more of the actions that we're doing to discover the information, and discovery happens when we find that information. Now, the lines between those two definitions are kind of blurred, so much of the time we can kind of use these terms interchangeably.

Levels of reconnaissance

I like to think of reconnaissance as having several different levels here, and let me give you a little bit of an analogy to understand.

I have a beach house that I go to occasionally, and when I'm at the beach house, one thing that they have is a set of binoculars that I can look out and see the whales. The whales come up and they blow the water out and it's a pretty cool sight. And so I can use binoculars to take a look at that. And binoculars are great because I can scan the whole horizon and look at the big picture of things.

But they also have a telescope. So if I want to look a little closer at that whale, I can then use the telescope instead to get a little more personal with that whale and really see up close. So it allows me to bridge that distance and see much closer. So that's pretty cool.

But let's say I'm a scientist and I really want to study whales. Well, that's probably not the best way for me to do it. If I'm up close to that whale, I could use some sort of magnifying glass and look at the more details of how the skin's laid out. Or what I can do is I can also take even a closer look with a microscope and see what the skin is actually made of, and see all the cells and get that closer perspective.

Well, I like to think of reconnaissance the same way. At some point in time we're going to start out with those binoculars and look at the whole big picture, and then work down to the telescope, and then work down to a magnifying glass, and then work down to the microscope.

Getting in, and what's inside

Initially, reconnaissance is just looking at the weakness — how are you going to break into something? I like to think of it as a castle. A castle has all of these defenses to it. They have this moat, they have these walls, they have these guards that are posted there, they have all these entry points into the castle. So we're doing this reconnaissance to try to figure out how to get into the castle. But once we're in, we need to know what's inside that castle too. What are we going to experience, and how can we leverage things within the castle? So any information about this castle will lead to our success in action on objectives.

Similar to that castle, we have a network, and the network has guards in place. And how are we going to leverage and get into this network, to be able to figure out how we can access things inside of this network?

External and internal assets

So we're exploring both internal and external assets. External assets are anything that we can get to from the outside and discover from the outside, versus those internal assets would be within the organization and within the network and within the infrastructure.

So from a high level we start looking at what the company domains are, and that gives us insight into other resources such as what are the websites, what are the external IP addresses. From those sources we can gather who are the employees, what are their jobs and roles, do they have some sort of code repository out there. We can start finding out more and more information by digging down deeper.

When it comes to those internal assets, we're looking at networks and devices, users, groups and directory information, file shares, and data sources, and unsanctioned assets and accounts that might be within the network. Now, a lot of these internal assets we're going to tackle in a different module. This module is really more for that higher level, those external assets.

Another thing that we could be leveraging, and we'd want to look into, is what partnerships does this company have? What third-party connections do they have? Are they hosted in the cloud, and are there some sort of hosted or cloud services that we can leverage? What supply chains do they use, and can we leverage those supply chains?

And we can find a ton of information about the target before we ever start to try to even attack this target. There's a lot of publicly disseminated information, information that we can find out there that's publicly available. And there are things that that company might not even be aware of, like password dumps, or there's information brokers that we can go and buy information from against a target.

Passive and active reconnaissance

If we were to alert our target that we are targeting them and we're going after them, they could put extra defenses up, or they could put things into place to be able to recognize what we're doing and guard against it. So we want to avoid detection. There are things that we can do to avoid detection during this phase. That's where we might want to carry out some sort of passive reconnaissance.

Passive reconnaissance just means that there's no way that the company can really be triggered that they're being targeted, that they won't know that they're being targeted. And that's because we're researching everything that's out on the internet that's free and open source. It's this OSINT information out there, intelligence that is on the company, but it's not from the company directly.

So that would be passive reconnaissance, versus active reconnaissance might mean that we are going and doing port scans on the firewall to try to figure out what ports are open. Or if we find a port that's open and it's going to the website, then we discover things on the website, the web server, and maybe we're doing vulnerability scans on that. That's all active.

And the problem is that this could be all triggering. This equipment can log that information and report that information to the company, and then they realize that they're a target, and they could then start raising their defenses in preparation to be a target of attack. And so we don't want to clue them in that they're a target. So we at least initially try to do more passive reconnaissance.

Manual and automated reconnaissance

A lot of this we can do just manually — we can go and research this, and maybe we're taking the information that we're learning about the company and we're copying and pasting it into some sort of document that's tracking what we found. There are tools out there that can automate this as well. There's automated reconnaissance, or something like automated enumeration, where it's going out and finding this information. And that just means that you've got programs out there that are helping you throughout this process. And there are a lot of them.