Kako hakeri pronalaze mete: Reconnaissance tehnike koje morate razumeti

← Blog

Faze napada: MITRE ATT&CK Reconnaissance

Svaki strukturovani napad počinje sa reconnaissance (izviđanjem) — prikupljanjem informacija o meti bez otkrivanja napadačevog prisustva. MITRE ATT&CK framework definiše ovu fazu kao prvu od 14 taktika. Razumevanje šta napadač može prikupiti o vašoj organizaciji bez ikontakta sa vašim sistemima je ključ za smanjenje napadne površine.

Pasivni OSINT (Open Source Intelligence)

Pasivno izviđanje ne generiše nikakav saobraćaj ka meti — napadač koristi javno dostupne izvore.

WHOIS i DNS informacije

WHOIS baza podataka otkriva: registrant informacije (ime, email, telefon ako nisu privatizovane), datum registracije domene, name servere. DNS zapisi otkrivaju IP adrese servera, mail servere (MX), SPF konfiguraciju, subdomene.

whois vasafirma.rs
dig vasafirma.rs ANY
nslookup -type=MX vasafirma.rs

Google Dorks

Google dorking je napredna pretraga koja pronalazi informacije koje nisu namenjene javnosti:

site:vasafirma.rs filetype:pdf "poverljivo"
site:vasafirma.rs inurl:admin
site:vasafirma.rs intitle:"index of"
"vasafirma.rs" filetype:env OR filetype:config

Shodan — "Google za internet uređaje"

Shodan je search engine koji indeksira internet-connected uređaje i servise. Napadač može pronaći sve servere vaše organizacije, otvorene portove, banner-e koji otkrivaju verzije softvera i poznate ranjivosti:

org:"Vaša Firma d.o.o."
ssl:"vasafirma.rs"
hostname:vasafirma.rs port:22,3389,8080

Certificate Transparency Logs

Svaki SSL sertifikat se loguje u javne CT logove. Napadač može pronaći sve subdomene za koje ste ikada izdali sertifikat — uključujući interni staging, dev, beta, test servere koje ste mislili da su "sakriveni":

• crt.sh — besplatna pretraga CT logova
• Subdomeni koji se vide: dev.vasafirma.rs, staging.vasafirma.rs, internal.vasafirma.rs

GitHub i public code repositories

Napadači pretraže GitHub (i GitLab, Bitbucket) za API ključeve, lozinke, connection stringe koje su developeri slučajno commitovali. Alati poput TruffleHog automatizuju ovu pretragu.

LinkedIn i socijalni inženjering

LinkedIn profili otkrivaju: organizacionu strukturu, email formate ([email protected]), technologije koje kompanija koristi (Python, AWS, SAP), zaposlene koji bi bili ciljevi za spear phishing.

Aktivno izviđanje

Aktivno izviđanje ostavlja tragove u logovima ali je i dalje pre "pravog" napada.

Subdomain enumeration

Kombinovanje dictionary attack-a na DNS i CT logova daje kompletnu mapu svih subdomena — uključujući zaboravljene i nezaštićene.

Port scanning i banner grabbing

Nmap skeniranje identifikuje otvorene portove i software verzije. Banner grabbing čita odgovore servera koji otkrivaju Apache/Nginx verziju, PHP verziju, CMS tip.

Web application fingerprinting

Alati poput WhatWeb, Wappalyzer i BuiltWith identifikuju CMS (WordPress, Drupal), framework (Laravel, Django), verzije biblioteka i analytics alate — samo analizom HTTP headera, HTML strukture i JavaScript fajlova.

Šta možete učiniti

• Pregledajte šta crt.sh i Shodan otkrivaju o vašoj organizaciji
• Privatizujte WHOIS podatke kod vašeg domain registrara
• Sakrijte ili generalizujte Server i X-Powered-By headere
• Uklonite verzijske informacije iz JavaScript fajlova i HTML komentara
• Auditujte GitHub za slučajno commitovane tajne (trufflehog, GitGuardian)
• Dekomisionišite neaktivne subdomene i servere

Shieldome Scout analizira vašu napadnu površinu iz perspektive napadača: otkriva izložene verzije, server headere, backup fajlove i putanje koje daju napadaču informacionu prednost pre nego što pošalje prvi exploit.

← Blog

Attack Phases: MITRE ATT&CK Reconnaissance

Every structured attack begins with reconnaissance — gathering information about the target without revealing the attacker's presence. The MITRE ATT&CK framework defines this phase as the first of 14 tactics. Understanding what an attacker can gather about your organization without any contact with your systems is the key to reducing your attack surface.

Passive OSINT (Open Source Intelligence)

Passive reconnaissance generates no traffic to the target — the attacker uses publicly available sources.

WHOIS and DNS Information

The WHOIS database reveals: registrant information (name, email, phone if not private), domain registration date, name servers. DNS records reveal server IP addresses, mail servers (MX), SPF configuration, subdomains.

Google Dorks

Google dorking is an advanced search that finds information not intended to be public:

site:yourcompany.com filetype:pdf "confidential"
site:yourcompany.com inurl:admin
site:yourcompany.com intitle:"index of"

Shodan — "Google for Internet Devices"

Shodan is a search engine that indexes internet-connected devices and services. An attacker can find all of your organization's servers, open ports, banners revealing software versions, and known vulnerabilities.

Certificate Transparency Logs

Every SSL certificate is logged in public CT logs. An attacker can find all subdomains for which you've ever issued a certificate — including internal staging, dev, beta, and test servers you thought were "hidden."

GitHub and Public Code Repositories

Attackers search GitHub (and GitLab, Bitbucket) for API keys, passwords, and connection strings that developers accidentally committed. Tools like TruffleHog automate this search.

What You Can Do

• Review what crt.sh and Shodan reveal about your organization
• Privatize WHOIS data at your domain registrar
• Hide or generalize Server and X-Powered-By headers
• Remove version information from JavaScript files and HTML comments
• Audit GitHub for accidentally committed secrets (trufflehog, GitGuardian)
• Decommission inactive subdomains and servers

Shieldome Scout analyzes your attack surface from an attacker's perspective: it reveals exposed versions, server headers, backup files, and paths that give an attacker an informational advantage before they send the first exploit.