Gather Victim Network Information: recognize the technique
What you are learning
This technique is about learning how an organization's network is arranged and exposed. Examples include public IP ranges, DNS relationships, cloud or hosting providers, remote-access services, and network boundaries. An outside view is incomplete, so defenders should compare it with their own current network records.
- Explain Gather Victim Network Information in plain language.
- Identify evidence a defender could review.
- Choose a defensive action that fits the observed behavior.
Public network information can help someone build a rough map of an organization. Defenders can use the same information to find unexpected exposure, stale DNS records, or systems that should not be public. In practice, defenders compare public information with internal records, logs, inventories, and monitoring data to decide whether the information is current, expected, and useful to an attacker. The goal is not to remove all public information, but to reduce unnecessary exposure and review information that could create avoidable security risk.
Use a repeatable web-testing method
Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.
For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.
Open WSTG web security fundamentalsFrom Reachability to Network Evidence
A reachability check asks a basic question: can your authorized testing system communicate with the target over the network? A successful ping response is evidence that the target answered ICMP from your current network position.
That response does not prove that a web application is running, that a particular port is open, or that the host is vulnerable. Those questions require additional observations such as a bounded port or service check.
A target can appear unreachable even when it is running. Firewalls or other filtering devices may block ICMP echo traffic, and routing determines whether there is a valid network path between the testing system and the target. A failed ping therefore does not, by itself, prove that the target is offline.
Defenders may observe the same reachability probe in firewall logs, IDS/IPS or network-monitoring telemetry, network-flow records, and host or network ICMP logging where those sources are available. The exact telemetry depends on how the environment is configured.
- Reply received → evidence that the target responded to the reachability test.
- No reply → not automatically proof that the host is offline; filtering or network policy can also affect ICMP.
What you should take away: Interpret the evidence narrowly: say what the result supports, and avoid claiming more than the test established.
Practice Preparation
Use these lesson concepts for the ungraded practice activity below. You do not need outside research.
- Network-exposure sources can include DNS records, IP/address inventories, cloud or hosting records, firewall or remote-access inventories, and network monitoring data.
- A useful review question is whether the observed exposure is expected, current, and necessary.
- Risk can be reduced by removing stale public records, restricting unnecessary services, and keeping authoritative network inventories current.
This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three sources a defender could use to understand network exposure. Then give one question that checks whether an observation is expected and two controls that reduce unnecessary exposure. No external target interaction is required.
Check your understanding
Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.
Outside network information is only a partial view. Defenders should compare it with an accurate internal inventory.
Useful evidence includes network diagrams, IP and DNS inventories, cloud records, firewall rules, flow logs, routing data, and reverse-proxy logs. Check whether an address or domain really belongs to the organization, whether the exposure is expected, and whether anything changed. Reduce risk by removing stale records, limiting public services, and using network segmentation and firewall rules. Risk reduction includes reviewing what is exposed and using controls to limit information that is not needed.