Chapter 3. Gathering Additional Host Information

Note

This chapter shows you how to do some things that in many situations might be illegal, unethical, a violation of the terms of service, or just not a good idea. It is provided here to give you information that may be of use to protect yourself against threats and make your own system more secure. Before following these instructions, be sure you are on the right side of the legal and ethical line... use your powers for good!

In this chapter, we will cover:

• Geolocating an IP address

• Getting information from WHOIS records

• Checking if a host is known for malicious activities

• Collecting valid e-mail accounts

• Discovering hostnames pointing to the same IP address

• Brute forcing DNS records

• Fingerprinting the operating system of a host

• Discovering UDP services

• Listing protocols supported by a remote host

• Discovering stateful firewalls by using a TCP ACK scan

• Matching services with known security vulnerabilities

• Spoofing the origin IP of a port scan