Ethical Hacker Community Forums

 Revisiting Reconnaissance
 Defining of Footprinting
 Information Gathering Methodology
 Unearthing Initial Information
 Finding a Company’s URL
 Internal URL
 Extracting Archive 0f a Website
 Google Search for Company’s Info.
 People Search
 Footprinting Through Job Sites
 Passive Information Gathering
 Competitive Intelligence Gathering
 Why Do You Need Competitive Intelligence?
 Companies Providing Competitive Intelligence Services
 Competitive Intelligence
    o When Did This Company Begin?
    o How Did It Develop?
    o What Are This Company's Plans?
    o What Does Expert Opinion Say About The Company?
    o Who Are The Leading Competitors?
 Public and Private Websites
 Tools
    o DNS Enumerator
    o SpiderFoot
    o Sensepost Footprint Tools
        • BiLE.pl
        • BiLE-weigh.pl
        • tld-expand.pl
        • vet-IPrange.pl
        • qtrace.pl
        • vet-mx.pl
        • jarf-rev
        • jarf-dnsbrute
    o Wikito Footprinting Tool
    o Web Data Extractor Tool
    o Whois
    o Nslookup
    o Necrosoft
    o ARIN
    o Traceroute
    o Neo Trace
    o GEOSpider
    o Geowhere
    o GoogleEarth
    o VisualRoute Trace
    o Kartoo Search Engine
    o Touchgraph Visual Browser
    o SmartWhois
    o VisualRoute Mail Tracker
    o eMailTrackerPro
    o Read Notify
    o HTTrack Web Site Copier
    o Web Ripper
    o robots.txt
    o Website watcher
    o E-mail Spider
    o Power E-mail Collector Tool
 Steps to Perform Footprinting

Source:
http://www.eccouncil.org/EC-Council%20Education/ceh-course-outline.htm

Don

using those sensepost enumeration tools should be cool...

What is Footprinting : Footprinting is the Reconnaissance phase of the 5 step attack wheel
The first of the three pre-attack phases Information gathering

Methodology

1 - Unearth Initial Information Footprinting
2 - Locate the network range Footprinting
3 - Ascertain active machines
4 - Discover open ports / access points
5 - Detect operating systems
6 - Uncover services on ports
7 - Map the network

Unearth Initial Information
Commonly Includes
Domain Name Lookups
Locations
Contacts
Telephone
E-mail
Mail

Information Sources
Search Engines and Websites Open Source
Whois
Domain and IP information
Information about Registered Domains
SmartWhois Tools
Provides DNS information Nslookup
Hacking Tools
Sam Spade
Provides Whois and DNS Dig functionality


Locate the Network Range

After gathering information, next step is to find the network range of the target
Information can be obtained from
IANA Providers
ARIN
APNIC
RIPE

Trace the route between your network and the target
Traceroute
Exploits the IP TTL
Reveals path IP packets take
Sends out consecutive UDP packets
with ever increasing TTLs
Device sends back an ICMP TTL
Exceeded message
Some devices will also reply with DNS information

It is quite scary the information available on the net that you or your target may not even be aware of. I have found the techniques learned here through the course to be useful for more than just recon of a target but to also help with job hunting.