Recon
https://twitter.com/dc9221/status/1233349429828243456/photo/1
A Web App Tool to Run and Keep all your recon in the same place.
https://docs.reconness.com/
Discover IP Space
look for different asns http://bgp.he.net prefixes v4 presents different IP ranges inside the CIDR notationwhois -h whois.cymru.com $(dig +short tesla.com) #finds CIDR notation for tesla.com - finds ip address for websitecareful not to pick up shared hosting amassfind subdomains for each of of these ASNsamass intel -asn 123456#find more details about ip ranges/countries etcwhois.arin.netripe.netshodan.io https://beta.shodan.io/search/filters #useful filters org:"Tesla" #maybe some false positivesDiscovering New Targets and TLDs
Find different attack surfaces which other people might not have discovered, ie from acquisitionsWikipedia search for subsiduriesCrunchbase.com search for org look for acquisitionsOwler.com search for org look for acquisitionsAcquiredby.co search for org acquisitionsLinkedIn affiliated pages or similiar pagesReversewhois amass intel -d tesla.com -whoisBuiltwith Relationship Profile look for anaylitical codes under ID # google tracking codes that are linked to different sitesGoogleDorks intext:"copyright tesla motors"ShodanDorks http.favicon.hash:81586312 # Jenkins favicon hash can narrow it down after that Subdomain Enumeration
https://github.com/tomnomnom/assetfinder/ assetfinder -subs-only offsecnewbie.comamass enum -d tesla.com -ip setup config.ini file get access to a lot more data than baseline toolsubfinder # not used much but has a few extra sources subfinder -d tesla.com -t 25 -timeout 5 -silentDNS bruteforcing https://youtu.be/La3iWKRX-tE?t=802all.txt + goaltdns + commonspeak --> massdns / gobuster3 https://github.com/subfinder/goaltdns massdns #download all.txt sed -e 's/$/.tesla.com/' -i all.txt #adds tesla.com to start of each line - overrides file massdns -r lists/resolvers.txt -t CNAME all.txt -o S > results #massdns much faster than gobuster but can get you blacklisted from dns resolovers - a lot of false positives and negatives rapid 7 fdns#download latest file here: https://opendata.rapid7.com/sonar.fdns_v2/ pv 2019-10-27-1572199582-fdns_cname.json.gz | pigz -dc | grep -E "\.tesla\.org\"," | jq -r '.name'certstream certstream | grep -E "\.tesla\.com$" #Real-time certificate transparency log update streamFingerprinting
what is running, narrow down attack surface
builtwith.comwhatweb #follows redirection http-->httpsmassscan & nmap masscan -p1-65535 $(dig +short tesla.com) --rate 1000Dorking
shodan dork org:"Tesla" ssl:"Tesla" #accurate and can prove ownership to organisation ssl:"Tesla" http.component:"Drupal" ssl:"Tesla" http.title:"Login"censys.io 443.https.tls.certificate.parsed.subject.organizational_unit: Tesla Motorsgithub dork "tesla.com" password "tesla.com" key "tesla.com" apihttps://github.com/condingo/dorky #automate the dorking process - tool to be released​Content Discovery
Burpcrawler crawl siteLinkfinder https://github.com/GerbenJavado/LinkFinderjsparser - similar to abovegobuster & recursebuster # recurse only does directory otxurls echo "www.tesla.com" | otxurls | head -n 300 #attempts to find urls within alienvaultwaybackurls echo "www.tesla.com" | waybackurls | head -n 300 #similar to above, you can get parameters back which can be useful when fuzzing​Parameter Discovery
https://github.com/maK-/paramethAutomation
https://github.com/codingo/InterlaceInterlace #multithreads other tools interlace -tL domains.txt -c "amass enum-d _target_" -o siubdomains.txt -threads 20LazyRecon #outofdate but still good baselineGHDB + others GUI tool
https://www.bishopfox.com/resources/tools/google-hacking-diggity/attack-tools/Username discovery
To find out what sites a user is registered:
https://namechk.com/https://whatsmyname.app/Last updated
Was this helpful?