I've started a course about Penetration testing and CEH on cybrary. The course begins with an introduction that quickly describes each step of pentesting. The first step is essentially to gather information. So that's my question, what I can do if I can't get any (or only irrelevant) information about my target? What can I do next? I should just try some random attack?


Before you embark on the "fist step" of information gathering. You may want to consider step 0: "What are you attacking, and what is your goal?". The point of gathering information is to determine your target's attack surface, and what attacks are applicable.

  • Is this a web service or web application? You might want to gather information about what platform this web service is built on. What language was it written in, ect. Dirbuster and spidering help enumerate attack surfaces. BURP and ZAP will build a sitemap of your target(s) and have tools to expand the sitemap.
  • Is this a mobile app? You might want to sniff traffic to find backend services. Or decompile the app to see if they are protecting the source.
  • Is this a network assessment? You might want to use nmap -sV, or google hacks, or use DNS to acquire targets.
  • Is this a VoIP or Telephony assessment? You might want to start with determining the range of your target, and wardialing.
  • Is this a wireless assessment? What wireless networks are running? Are they protected? How are they protected?
  • Is this a hardware assessment? You might want to start by looking the controller board and its manufactures. Write down any ID numbers you see on integrated circuits, and google them. After components have been identified, try fining developer manuals.

There are many other types of security assessments that follow penetration testing methodologies, however the ones above are really the most common types I am familiar with.

  • I hadn't considered all this aspects, I was only interested in web services and web applications, but now I see that I've a lot of things to learn! Anyway just for info, if a site is protected and don't let me see any kind of "important information" like open ports, what approach I should use to gather information? I should try again for other ways or I should go ahead and try some attack? – malloc Feb 8 '15 at 15:18
  • 1
    @malloc try attacking something, like damn vulnerable web app. Then come back with a more specific question. – rook Feb 8 '15 at 15:29
  • The training you are following wants you to collect information before trying some attacks. The reconnaissance phase is important and you should learn to do it well. There is always more information to gather. What framework runs the application? What is the version of that framework? What is the response when you try to login with a bad password? How does the "forgot password" feature work? What information can you gather from viewing source? Is there contact information on the website? What is the server's response when you type in a URL that does not exist? Who owns the domain name? – mcgyver5 Feb 9 '15 at 2:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.