> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/information-gathering.md).

# Information Gathering

### Introduction to Information Gathering

**What is information Gathering ?**

* **Information gathering** is the first step of any penetration test and involves gathering or collecting information about an individual company, website or system that you are targeting.
* The more information you have on your target, the more successful you will be during the later stages of a penetration test.
* Two Types:
  * **Passive Information gathering** - involves gathering as much information as possible without actively engaging with the target. Ex: Publicly available data, learning about the web technologies on that sites, IP address of the web-server.
  * **Active Information gathering** - involves gathering as much information as possible by actively engaging with the target system. (*You'll require authorisation in order to perform active information gathering*) Ex: Nmap, port scan on the web-server's IP address

*Note : Employee who works for the company, the most important piece of information in this context would be to identify their names & email address*

"The more you know about your target, the more successful you'll be during the penetration testing."

* In active Information gathering, we must need to take the authorisation of the company, that we're performing the penetration test in order to perform active info.
* Never perform port scan or test on the out-of-scope address

"If you target a system that you do not have the permission to target, you could potentially go to jail"

* Its a huge part of the code of ethics of a penetration tester.

***

**What Information are We Looking For ?**

[**Passive Information Gathering**](/ejptv2-notes/information-gathering/passive-information-gathering.md)

```
- Identifying IP addresses & DNS information.
- Identifying domain names and domain ownership information.
- Identifying email addresses and social media profiles.
- Identifying web technologies being used on target sites.
- Identifying subdomains.
```

[**Active Information Gathering**](/ejptv2-notes/information-gathering/active-information-gathering.md)

```
- Discovering open ports on target systems.
- Learning about the internal infrastructure of a target network/organization.
- Enumeration Information from target systems.
```