Reconnaissance and information gathering in Cybersecurity - Mini Project: Build & Apply

Reconnaissance and Information Gathering

📖 Scenario: You are a cybersecurity analyst tasked with gathering information about a company's online presence to understand potential security risks. This process is called reconnaissance and involves collecting data from public sources.

🎯 Goal: Build a simple step-by-step data collection plan that lists key information types to gather during reconnaissance and organizes them clearly.

📋 What You'll Learn

Create a dictionary called info_types with specific reconnaissance categories and example details

Add a variable called priority_level to set the importance of each category

Use a for loop with variables category and details to iterate over info_types.items()

Add a final summary string called summary that describes the reconnaissance plan

💡 Why This Matters

🌍 Real World

Reconnaissance is the first step in cybersecurity assessments to understand what information about a target is publicly available.

💼 Career

Cybersecurity professionals use reconnaissance to identify potential vulnerabilities and plan security measures.

1

Create the initial data structure

Create a dictionary called info_types with these exact entries: 'Domain Names': 'List of company domains', 'IP Addresses': 'Public IP ranges', 'Employee Info': 'Names and roles from LinkedIn'

Cybersecurity

# Create the info_types dictionary with specified entries
# Your code here

Hint

Use curly braces {} to create a dictionary with keys and values as strings.

2

Add a priority level configuration

Add a variable called priority_level and set it to the string 'High' to indicate the importance of the reconnaissance categories.

Cybersecurity

info_types = {
    'Domain Names': 'List of company domains',
    'IP Addresses': 'Public IP ranges',
    'Employee Info': 'Names and roles from LinkedIn'
}
# Add the priority_level variable below
# Your code here

Hint

Assign the string 'High' to the variable priority_level.

3

Iterate over the information types

Use a for loop with variables category and details to iterate over info_types.items(). Inside the loop, write a comment describing that you would collect data for each category.

Cybersecurity

info_types = {
    'Domain Names': 'List of company domains',
    'IP Addresses': 'Public IP ranges',
    'Employee Info': 'Names and roles from LinkedIn'
}
priority_level = 'High'

# Use a for loop to iterate over info_types.items()
# Your code here

Hint

Use for category, details in info_types.items(): to loop through the dictionary.

4

Add a final summary description

Add a string variable called summary that describes the reconnaissance plan as: 'This plan prioritizes High importance data collection for Domain Names, IP Addresses, and Employee Info.'

Cybersecurity

info_types = {
    'Domain Names': 'List of company domains',
    'IP Addresses': 'Public IP ranges',
    'Employee Info': 'Names and roles from LinkedIn'
}
priority_level = 'High'

for category, details in info_types.items():
    # Collect data for each category during reconnaissance
    pass

# Add the summary string below
# Your code here

Hint

Assign the exact string to the variable summary.

Practice

1. What is the main purpose of reconnaissance in cybersecurity?

easy

A. To gather information about a target system or network

B. To fix vulnerabilities in software

C. To encrypt data for security

D. To create user accounts on a system

Solution

1. Step 1: Understand the role of reconnaissance

   Reconnaissance is the initial phase where information about a target is collected to plan further actions.

2. Step 2: Identify the correct purpose

   Among the options, only gathering information fits the reconnaissance phase.

3. Final Answer:

   To gather information about a target system or network -> Option A

4. Quick Check:

   Reconnaissance = Information gathering [OK]

Hint: Reconnaissance means collecting info first [OK]

Common Mistakes:

• Confusing reconnaissance with fixing or attacking
• Thinking it involves encryption
• Assuming it creates accounts

2. Which of the following commands is commonly used for passive reconnaissance to find domain information?

easy

A. ping

B. nmap

C. whois

D. netstat

Solution

1. Step 1: Identify passive reconnaissance tools

   Passive reconnaissance collects data without interacting directly with the target system.

2. Step 2: Match command to passive info gathering

   The whois command queries public domain registration info without contacting the target directly.

3. Final Answer:

   whois -> Option C

4. Quick Check:

   Passive info tool = whois [OK]

Hint: whois shows domain info without touching target [OK]

Common Mistakes:

• Using ping which sends packets actively
• Confusing nmap as passive (it scans actively)
• Thinking netstat gathers external info

3. Consider this command output from nmap -sP 192.168.1.0/30:

Host 192.168.1.1 is up
Host 192.168.1.2 is up
Host 192.168.1.3 is down
Host 192.168.1.4 is up

What does this output tell you?

medium

A. All hosts are unreachable

B. Hosts 192.168.1.1, 1.2, and 1.4 are reachable; 1.3 is not

C. Only 192.168.1.3 is reachable

D. The scan failed due to syntax error

Solution

1. Step 1: Understand nmap ping scan output

   The -sP option checks which hosts respond to ping requests in the given IP range.

2. Step 2: Interpret the output lines

   Hosts marked "is up" respond and are reachable; "is down" means no response.

3. Final Answer:

   Hosts 192.168.1.1, 1.2, and 1.4 are reachable; 1.3 is not -> Option B

4. Quick Check:

   Ping scan shows reachable hosts = 1.1, 1.2, 1.4 [OK]

Hint: Look for 'is up' = reachable hosts [OK]

Common Mistakes:

• Assuming 'is down' means reachable
• Thinking all hosts are unreachable
• Confusing syntax error with normal output

4. A user runs the command nslookup example.com but gets an error saying "server can't find example.com". What is the most likely cause?

medium

A. The DNS server is unreachable or misconfigured

B. The domain example.com does not exist

C. The user typed the command incorrectly

D. The network cable is unplugged

Solution

1. Step 1: Understand nslookup error message

   The error "server can't find" usually means the DNS server queried cannot resolve the domain.

2. Step 2: Analyze possible causes

   If the domain exists, the likely cause is DNS server issues, not user typo or physical network problems.

3. Final Answer:

   The DNS server is unreachable or misconfigured -> Option A

4. Quick Check:

   DNS error = server unreachable or misconfigured [OK]

Hint: DNS errors often mean server issues, not typos [OK]

Common Mistakes:

• Assuming domain does not exist without checking
• Blaming user typo without evidence
• Thinking physical cable issues cause DNS errors

5. You want to gather email addresses from a company website without alerting their security systems. Which reconnaissance method should you use?

hard

A. Active scanning with port scanners

B. Brute force login attempts

C. Sending phishing emails

D. Passive reconnaissance by analyzing public web pages

Solution

1. Step 1: Understand active vs passive reconnaissance

   Active methods interact directly and can alert security; passive methods gather info without direct contact.

2. Step 2: Choose method to avoid detection

   Analyzing public web pages is passive and safe for collecting emails without triggering alarms.

3. Final Answer:

   Passive reconnaissance by analyzing public web pages -> Option D

4. Quick Check:

   Safe info gathering = passive reconnaissance [OK]

Hint: Use passive methods to avoid detection [OK]

Common Mistakes:

• Using active scans that trigger alerts
• Trying brute force which is illegal and noisy
• Confusing phishing with reconnaissance