Introduction๏
What?๏
Many of the active information gathering techniques involve initial scanning of target systems to find out things such as the operating system and services that are running on a system. Active reconnaissance begins with direct connections made to the target machine. Any such connection might leave information in the logs showing the client IP address, time of the connection, and duration of the connection, among other things.
๐ Avoid detection with the targetโs intrusion detection systems while performing active reconnaissance. Not all connections are suspicious. It is possible to let active reconnaissance appear as regular client activity. No one would suspect a browser connected to a target web server among hundreds of other legitimate users. You can use such techniques to your advantage when working as part of a red team.
Why?๏
The more useful information about a target, the more vulnerabilities in the target and more serious problems found for exploiting them (to demonstrate).
How?๏
Capture and analyse network traffic to discover sensitive information and API requests and responses and their contents.