Active information gathering can be used to provide very useful results during the reconnaissance phase of a penetration test. With this active approach, the penetration tester makes a direct connection to the actual target to gather specific details that Open Source Intelligence (OSINT) is unable to provide. Using active information gathering, the penetration tester is able to create a very detailed profile of the target, gathering information such as the type of operating system and running services. This information helps to research and identify vulnerabilities in relation to the target, thereby narrowing the scope in choosing specific exploits to unleash against it.
For this entire chapter, we will focus on directly engaging the target to gather specific details about it in order to help us profile any running services. Understanding how to perform...
