- Other methodologies
- Web Recon Engagements:
- GENERAL ENGAGEMENT
- General Setup
- Subdomain enumeration
- DNS Pentesting
- Email Tools
- HOSTS - Enumeration & Port Scanning
- Nmap
- Threader3000
- Shodan (Document this more)
- RustScan
- Netcat
- Masscan
- HTTP/S webscreenshot:
- URL Scanners
- Web Scanners
- Quick Recons + OSINT
- WAF Bypassing & Info
- General Recon & Commands
- Subdomain-takeover
- Intrigue Core + Amazon Elastic Search & Kibana (Old; intrigue is now unmaintained ~2021)
Other methodologies
Web Recon Engagements:
To-Do:
- Domain enumeration
- Fuzzing methodology
Add:
- Custom Scripts
Add quick tool usage:
- amass
- assetfinder
- internetdb
- curl API → https://sonar.omnisint.io/subdomains/$DOMAIN
GENERAL ENGAGEMENT
- Rules: Understand the scope
- Use a cloud env -> Bandwidth: AWS/Digital Ocean
General Setup
- INFRA:
- Cloud env -> Bandwidth / ISP problems: AWS/DO
- DO ~0.35 USD / hr (~$60 mxn / 8hr && ~250USD/Mo) 32GB/8vCPUs/6TB-bandwidth/100GB-SSD
- Tools: Dump lists of tools to automate a bash script & Install stuff (apt install & git clone)
Subdomain enumeration
crt.sh -> curl https://crt.sh/?q=target.domain&output=json ó:
curl -s https://crt.sh/\\?q\\=\\%.target.com\\&output\\=json | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
censys -> Digital Certificates
HAVEN’T TESTED:
- webscreenshot
- Photon (Subdomain ennum, internal links, keys, etc.)
- metasploit
- sublist3r
- Nahamsec's Lazyrecon
- Tib3rius' autorecon
- ffuf - codingo tutorial
- Nuclei
- Recon-ng
DNS Pentesting
DNS Transfer
Email Tools
Check DKIM without knowing the DKIM Selector → Check “Detect all selectors”
HOSTS - Enumeration & Port Scanning
‣
Nmap
‣
Threader3000
‣
Shodan (Document this more)
‣
RustScan
‣
Netcat
‣
Masscan
HTTP/S webscreenshot:
- Extract IP addresses (1 outfile for every port)
- Run webscreenshot:
Filter results for port 80, 443, 8080, etc. (Only extract IP addresses that have p. 80 open) > http_ips.txt, https_ips.txt, etc.
Filter for not_http_ips.txt
Dependencies: sudo apt install phantomjs
xvfb-run webscreenshot --no-xserver --renderer-binary $(which phantomjs) -s -r phantomjs -i https_ips.txt -p 80 -o mytarget_screenshots_80
# -s for SSL, http only fails if this flag is not usedURL Scanners
Web Scanners
Geekflare: Several security testing tools (Wordpress scans, TLS, etc.)
Net tools (Anonymous)
Web Security Mindmap:
Quick Recons + OSINT
WAF Bypassing & Info
git clone https://github.com/christophetd/cloudflair.git
cd cloudflair
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
export CENSYS_API_ID=...
export CENSYS_API_SECRET=...
python cloudflair.py myvulnerable.site
General Recon & Commands
lazyrecon.sh -d domain.mx- Using OWASP amass:
amass enum -d domain.org | tee domain.com.amassenum # OutfileParsing results
#!/bin/bash
# Input: amass enum results
# get output file from amass domain:ip and other results and only look for domains/subdomains, then probe for
# response and write a new file
# (The output of amass is > domain ip,ip,ip)
#
# Note: This could be also useful for any input file containing domains/subdomains
#
DOMAIN=$1 # example.com
AMASS_FILE=$DOMAIN.amassenum # amass_outfile.txt (I normally use the format domain.com.amassenum for organization)
# Automatically enumerate with amass
amass enum -d $DOMAIN | tee $AMASS_FILE
#
cat $AMASS_FILE | grep $DOMAIN | awk '{print $1}' | httprobe | tee $AMASS_FILE.httprobed
# Then:
# (Clean http/https probes and sort results)
echo "------------------------------------------------"
cat $AMASS_FILE.httprobed | sed 's/http.*:\/\///g' | sort | uniq | tee $DOMAIN.amassenum.hosts
# TO-DO: Automate this and use only 1 output file instead of writing a file and reading it agan,
# then writing another one.
# But *.httprobed could be useful to see what methods the hosts accept- Using the Harvester
# Extract results from the Harvester, clean up http/https://, do an automatic nslookup
theHarvester -d domain.mx -b otx | httprobe | sed 's/.*:\/\///' | nslookup | grep 'name =' | awk '{print $NF}'Recon-ng theHarvester -d domain.co -l 500 -b otx arjun -u api-endpoint.example.com
