I've started a course about Penetration testing and CEH on cybrary. The course begins with an introduction that quickly describes each step of pentesting. The first step is essentially to gather information. So that's my question, what I can do if I can't get any (or only irrelevant) information about my target? What can I do next? I should just try some random attack?
closed as too broad by AviD♦ Feb 8 '15 at 16:00
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Before you embark on the "fist step" of information gathering. You may want to consider step 0: "What are you attacking, and what is your goal?". The point of gathering information is to determine your target's attack surface, and what attacks are applicable.
- Is this a web service or web application? You might want to gather information about what platform this web service is built on. What language was it written in, ect. Dirbuster and spidering help enumerate attack surfaces. BURP and ZAP will build a sitemap of your target(s) and have tools to expand the sitemap.
- Is this a mobile app? You might want to sniff traffic to find backend services. Or decompile the app to see if they are protecting the source.
- Is this a network assessment? You might want to use
nmap -sV, or google hacks, or use DNS to acquire targets.
- Is this a VoIP or Telephony assessment? You might want to start with determining the range of your target, and wardialing.
- Is this a wireless assessment? What wireless networks are running? Are they protected? How are they protected?
- Is this a hardware assessment? You might want to start by looking the controller board and its manufactures. Write down any ID numbers you see on integrated circuits, and google them. After components have been identified, try fining developer manuals.
There are many other types of security assessments that follow penetration testing methodologies, however the ones above are really the most common types I am familiar with.