Reconnaissance Techniques · Topic 4 of 8
Network Footprinting, Social Engineering, Tools and Countermeasures
Learn network range lookup and traceroute, human-based footprinting, common footprinting tools and the countermeasures that limit what attackers learn.
- 5 min
- Traceroute uses increasing TTL values and the ICMP time exceeded reply.
- Windows tracert uses ICMP echo, and Linux traceroute uses UDP by default.
- Human-based sources include dumpster diving, shoulder surfing, eavesdropping and impersonation.
What it is
Network footprinting finds the address ranges and the path to the target. Social engineering footprinting uses people instead of machines as the source. Footprinting tools bundle many of these steps, and countermeasures reduce what an outsider can learn.
These topics close the footprinting phase.
How it works
Network footprinting
The first question is which IP addresses belong to the organization. A Whois query on a known address returns the registered network block and the registry that issued it. The result gives the range that scanning will cover.
The second question is how traffic reaches the target. Traceroute shows each router on the path by sending packets with increasing time-to-live (TTL) values. Each router lowers the TTL by one, and the router that sets it to zero returns an ICMP "time exceeded" message that reveals its address.
| Tool | Probe type by default |
|---|---|
| Windows tracert | ICMP echo requests |
| Linux traceroute | UDP datagrams to high ports (ICMP and TCP options exist) |
| Path Analyzer Pro, VisualRoute | Graphical path and geography |
The path shows the number of hops, the network provider and the location of firewalls or load balancers. Where a firewall drops the probes, hops appear as asterisks. Using TCP or a different protocol sometimes gets answers when ICMP is blocked.
Footprinting through social engineering
Social engineering manipulates people to give up information. As a footprinting source it needs no technical weakness.
| Technique | Description |
|---|---|
| Eavesdropping | Listening to conversations or reading messages without permission |
| Shoulder surfing | Watching someone type a password or read a screen |
| Dumpster diving | Searching discarded paper and media for useful data |
| Impersonation | Pretending to be an employee, vendor or support agent |
| Pretexting | Using an invented story to justify requests |
| Phishing | Sending messages that trick users into sharing data or clicking |
| Vishing | Phishing by voice call |
| Tailgating | Following an authorized person through a door |
Social engineering is described further in its own chapter. Here it matters as an active, human source of names, phone lists, badge details and internal vocabulary.
Footprinting tools
| Tool | Use |
|---|---|
| Maltego | Graphs relationships among people, domains and infrastructure |
| Recon-ng | Modular open-source intelligence framework |
| theHarvester | Emails, host names and sub-domains from public sources |
| FOCA and Metagoofil | Extract metadata from documents on a site |
| SpiderFoot | Automated OSINT collection across many sources |
| OSRFramework | Looks up user names and domain data |
| Shodan and Censys | Device and banner search |
| nslookup, dig, DNSRecon | DNS queries and enumeration |
| Web Data Extractor | Pulls data from web pages |
Document metadata is a common leak. A file can carry the author name, software version, printer name or file path, which reveals internal user names and naming patterns.
Artificial intelligence assistants are also used to summarize large amounts of open-source data, draft convincing messages and find patterns. Defenders should assume that attackers use them to work faster, and should treat the output as a lead to check rather than as fact.
Footprinting countermeasures
- Restrict what is posted on the website, social media and job boards.
- Remove metadata from documents before publishing.
- Configure web servers to hide banner and version details and to use generic error pages.
- Use registrar privacy services and non-personal contact addresses.
- Restrict DNS zone transfers and split internal and external DNS.
- Disable directory listing and review the search engine cache of the site.
- Train employees on social engineering, on clean desks and on secure disposal of paper.
- Use a separate public address range, and search for the organization yourself regularly.
- Block unnecessary ICMP and use a firewall that hides internal path details.
A worked example
A tester finds the organization's IP range through a registry lookup, then runs a traceroute that stops at a hop shown as asterisks. The last visible hop belongs to the hosting provider, so the tester concludes that a firewall filters the probes. Document metadata downloaded from the website reveals user names in a pattern, and that pattern is used to build a list of likely email addresses.
How the exam asks about this
- "Which message tells traceroute that a router has been reached?" -> An ICMP time exceeded message returned when the TTL reaches zero.
- "A person searches the trash for printouts of internal documents. What is this?" -> Dumpster diving.
- "Which tool graphs relationships between people, domains and servers?" -> Maltego.
What to remember for the exam
- Traceroute uses increasing TTL values and the ICMP time exceeded reply.
- Windows tracert uses ICMP echo, and Linux traceroute uses UDP by default.
- Human-based sources include dumpster diving, shoulder surfing, eavesdropping and impersonation.
- Maltego, Recon-ng and theHarvester are the best known footprinting tools.
- The main defense is to limit what is published and to train staff.
Do not state that Linux traceroute uses ICMP by default. The exam expects UDP for Linux and ICMP for Windows.
Common mistakes
Believing asterisks mean the host is down. They mean no reply came back, often because a filter drops the probes.
Ignoring metadata. The document looks harmless but its properties can reveal names and paths.
Choosing a technical fix for a human problem. Dumpster diving and impersonation are stopped by shredding, badge checks and awareness training.
Check yourself
What value does traceroute change in each probe?
The time-to-live (TTL), which is increased by one for each probe.
Name two countermeasures for footprinting.
Removing metadata from published files and restricting DNS zone transfers.
What is the difference between phishing and vishing?
Phishing uses written messages, while vishing uses voice calls.
Topic 4 of 8 in Reconnaissance Techniques
Test yourself on Reconnaissance Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.