Footprinting

Footprinting, in cybersecurity, is the initial reconnaissance phase of gathering information about a target system, network, or application to map its structure, identify potential vulnerabilities, and understand its security posture, using either passive (non-intrusive) or active (direct probing) methods. It's crucial for both attackers (to plan breaches) and ethical hackers (to find weaknesses for defense) and involves collecting details like IP ranges, open ports, OS versions, and network topology. 

Types of Footprinting

• Passive Footprinting: Gathering information discreetly from public sources without directly interacting with the target's systems, avoiding detection.
  • Examples: Searching Google, browsing company websites, checking social media, using WHOIS lookups.
• Active Footprinting: Directly probing the target to gather more technical details, which can be detected by intrusion detection systems (IDS).
  • Examples: Running network scans (ping sweeps), using traceroute, probing for open ports and services, identifying operating systems. 

What Information is Collected?

• Network topology and IP addresses
• Active machines and running services
• Operating system (OS) versions
• Open ports and applications
• User accounts and employee details
• Application-specific data like URL paths and parameters (OWASP perspective). 

Purpose

• For Attackers: To find entry points, develop exploits, and plan a successful breach.
• For Security Professionals: To simulate attacks, identify weaknesses (vulnerabilities), and strengthen defenses (security posture).