knowledge

Overview

Footprinting is the systematic process of gathering information about a target system’s infrastructure, services, and configurations before attempting exploitation. It combines passive gathering (OSINT, third-party sources) with active enumeration (direct service interaction) across six structured layers — from internet presence down to OS-level details. The goal is not to exploit systems but to map every possible way in.

Terminology

TermDefinition
FootprintingSystematic reconnaissance to discover a target’s attack surface
EnumerationActive querying of live systems to extract service, user, and configuration data
OSINTOpen Source Intelligence — passive information gathering using only public sources
Attack SurfaceAll exposed interfaces and services an attacker could potentially target
Infrastructure-Based EnumerationIdentifying internet presence, gateways, and accessible services
Host-Based EnumerationEnumerating services and processes running on a specific host
OS-Based EnumerationIdentifying OS type, patch level, internal configuration, and sensitive files
Passive ReconnaissanceGathering information without directly contacting the target
Active ReconnaissanceGathering information through direct interaction with the target

Core Concepts

Enumeration Principles

Footprinting is about understanding what you can see, why you can see it, and what it tells you — as much as what you cannot see and why.

Key questions to ask at every stage:

  • What can we see? What reasons might explain why it is visible?
  • What image does what we see create for us?
  • What do we gain from it, and how can we use it?
  • What can we not see, and why?

Three core principles:

  1. There is always more than meets the eye — consider every angle.
  2. Distinguish between what is visible and what is obscured.
  3. There are always ways to gain more information — keep probing.

Penetration tests are time-limited, so complete enumeration is never guaranteed. The primary goal is not exploiting machines — it is discovering how they can be exploited.

Enumeration Methodology

A structured, experience-based framework that organizes enumeration into three levels and six layers. Internal infrastructure testing (intranet, Active Directory) applies the same model differently — the first two layers (Internet Presence, Gateway) do not fully apply to internal infrastructure.

LevelLayers
Infrastructure-Based EnumerationInternet Presence, Gateway
Host-Based EnumerationAccessible Services, Processes
OS-Based EnumerationPrivileges, OS Setup

Think of each layer as a wall to pass through. Only attempt brute force as a last resort.

Layer 1 — Internet Presence

Objective: Identify all externally accessible infrastructure and interfaces. Find every possible target.

CategoryExamples
DomainsRegistered domain names, historical records
SubdomainsSubdomain enumeration via crt.sh, DNS brute forcing
vHostsVirtual hosts on a single IP
ASNAutonomous System Numbers — identify IP ranges the organization controls
NetblocksIP address ranges belonging to the target
Cloud InstancesAWS S3 buckets, Azure blobs, GCP storage
Security MeasuresWAF, CDN (Cloudflare), rate limiting

OSINT is conducted at this layer and is entirely passive — no direct contact with target systems.

Layer 2 — Gateway

Objective: Identify security measures protecting the external and internal infrastructure. Understand what you are dealing with before engaging.

CategoryExamples
FirewallsPacket filtering, stateful inspection
DMZDemilitarized zone separating public-facing services from internal networks
IPS/IDSIntrusion prevention/detection systems
EDREndpoint Detection and Response
ProxiesReverse proxies, load balancers
NACNetwork Access Control
Network SegmentationVLANs, internal zone separation
VPNVirtual Private Network endpoints
CDNContent delivery networks (Cloudflare, Akamai)

Layer 3 — Accessible Services

Objective: Identify and understand every accessible interface and service hosted externally or internally. This is the primary focus of active service enumeration.

CategoryWhat to Determine
Service TypeProtocol — FTP, SMB, SSH, HTTP, etc.
FunctionalityWhat the service does and why it is running
ConfigurationDefault vs. hardened settings
PortStandard or non-standard port
VersionSoftware version — correlate with known CVEs
InterfaceWeb UI, CLI, API, or direct socket

Layer 4 — Processes

Objective: Identify internal processes, their data sources, and their destinations.

CategoryWhat to Determine
PIDProcess ID — ties to running software
Processed DataWhat data is being handled
TasksWhat the process is doing
SourceWhere data originates
DestinationWhere data is sent

Understanding process dependencies helps identify cascading vulnerabilities — compromising one process may expose another.

Layer 5 — Privileges

Objective: Identify permissions and privileges granted to accessible services and accounts.

CategoryWhat to Determine
GroupsGroup memberships and their access rights
UsersUsernames, roles, and active sessions
PermissionsRead, write, execute on files and services
RestrictionsWhat is explicitly denied or filtered
EnvironmentEnvironment variables, PATH, shell type

Not every vulnerability grants full access. But believing there is always a path forward — even if the first foothold is limited — is the right mindset.

Layer 6 — OS Setup

Objective: Identify internal OS components and configuration.

CategoryWhat to Determine
OS TypeLinux distro, Windows version, Solaris
Patch LevelMissing patches and known vulnerabilities
Network ConfigInterfaces, routing, DNS settings
OS EnvironmentEnvironment variables, shell, scheduled tasks
Configuration FilesService configs, application configs
Sensitive Private FilesSSH keys, credentials, API tokens

References / Images