Information can be gathered from Name, IP Addresses, accessible services, and many other sources.
The primary goals of web reconnaissance include:

• Identifying Assets: Uncovering all publicly accessible components of the target, such as web pages, Subdomains, IP Addresses, and technologies used. This step provides a comprehensive overview of the target's online presence.

• Discovering Hidden Information: Locating sensitive information that might be inadvertently exposed, including backup files, configuration files, or internal documentation. These findings can reveal valuable insights and potential entry points for attacks.

• Analysing the Attack Surface: Examining the target's attack surface to identify potential vulnerabilities and weaknesses. This involves assessing the technologies used, configurations, and possible entry points for exploitation.

• Gathering Intelligence: Collecting information that can be leveraged for further exploitation or social engineering attacks. This includes identifying key personnel, email addresses, or patterns of behavior that could be exploited.

• Active Reconnaissance - Enumeration

• Passive Reconnaissance - OSINT

IoT

IoT Information Gathering

• IoT Sniffing

The first and foremost step in IoT device hacking is to extract information such as the IP Address, protocols used (Zigbee, BLE, 5G, IPv6LoWPAN, etc.), open ports, device type, geo-location of a device, manufacturing number, and manufacturing company of a device.

In this step, an attacker also identifies:

• The hardware design
• Its infrastructure
• The main components embedded in a target device that is present online

Attackers make use of tools such as Shodan, Censys, and FOFA to perform information gathering or reconnaissance on a target device.

Devices that are unavailable in the network but within the communication area can also be detected by using sniffers such as Suphacap, CloudShark, and Wireshark.

Cloud

Information gathering is the first phase of hacking in which an attacker collects as much data as possible regarding the target cloud infrastructure. This may include details regarding the network topology, IP addresses, domain names, Subdomains, user accounts, or publicly available information. The purpose of this phase is to gather critical information about a target cloud environment, which aids in identifying potential vulnerabilities and crafting more effective attacks in the subsequent phases. Consequently, it can assist in laying the foundation for the entire cloud-hacking process. For this purpose, attackers can use various techniques to gather information such as network scanning, social engineering, DNS interrogation, and web scraping. In addition, they can employ tools such as nmap, Shodan, and recon-ng to automate and enhance the effectiveness of these activities. Once successful, they gain a comprehensive understanding of the target's cloud environment, which significantly increases their chances of finding exploitable weaknesses.