🖍️
nullbrain
  • Intro
  • Tools
    • Preparation
  • basics/pre-req
    • Backpack
    • Linux
  • Working Tools
    • List of Note taking tools!
  • Practice Tools
    • Netcat
    • Socat
    • Powercat
    • PowerShell
  • Network Analysis Tools
    • Wireshark
    • Tcpdump
  • PRIVILEGE ESCALATION
    • Example
    • 🏁Kernel Exploits
    • 🪛Credentials
      • Reuse Passwords
      • Bash History
      • Local Database
  • Passive Information Gathering
    • Index
    • Tools
      • Recon-ng
        • Recon-ng [Usage]
      • Google Hacking DB [GHDB]
      • Whois
    • Techniques
      • Google Hacking
      • Website Recon
        • WR with Python
  • Active Information Gathering
    • Enumeration
      • NFS
      • SMB
    • Masscan
    • Nmap
    • Port Scanning
    • DNS
      • Scripts
      • Lookup
      • DNSRecon
      • DNSenum
  • Vulnerability Scanning
    • Vulnerability Scanning
    • Nmap
  • Web Application Exploit
    • Enumeration
      • Techniques
    • Tools
      • DIRB
  • Buffer Overflow
    • Memory
  • Real World!
    • Bruteforce
    • Tools
    • Enumeration
      • Enumeration MindMap
      • Tools
    • SQL Injection
    • Server-Side Template Injection
    • Hashcat
      • Hashcat options
    • Web Reconnaissance
    • Recon
    • Port Scanning
    • Privilege escalation
      • File permissions
      • Service Exploits
      • Kernel Exploits
      • Privilege Checker
      • snapd
      • SUID
      • Splunk
    • Reverse Shell
      • PHP deserialization
    • PHP
    • Exploits & Footholds
      • Exploit Mindmap
  • Checklist (CTF targetted)
    • checklist
  • Malicious payload
    • Metasploit APK
Powered by GitBook
On this page
  • Acquisitions: good to know what it acquired
  • ASN Enumeration: [bgp.he.net]
  • Finding Subdomains: linked and js discovery:
  1. Real World!

Recon

Recon Tools & Frameworks

PreviousWeb ReconnaissanceNextPort Scanning

Last updated 3 years ago

Acquisitions: good to know what it acquired

ASN Enumeration: [bgp.he.net]

ASN: A top level number given to org when network is big enough..and shows all ips org have.

  • Tools:

    • ASNLookup

    • bgp.he.net

    • amass

Using amass:

docker build -t amass (docker run amass intel -asn ASN_NUM,1,2,3)

Reverse WHOIS: whoxy.com (lets you search).

  • Good for API

  • Free Credits

DOMLink: recursively go through all whoxy output

Ad/Analytics Relationships: Builtwith.com

Google-Fu "<some search string>" inurl:<domain>

Shodan: Infrastructure spider. domain scanning. Free API.

Finding Subdomains: linked and js discovery:

  • Linked Discovery

    • gospider

    • hakrawler

  • Subdomain Enumeration:

    • subdomainizer

    • subscraper

Google FU:

exclusion example: site:<rootdomain> -www.<rootdomain>

(e.g: minus out subdomains; i.e pull out of some sub-domain)

Subdomain Scraping: Amass amass -d <domain>

  • Tools

    • subfinder:

    • github-subdomains.py

    • shosubgo (golang)

Subdomain Bruting

Amass:

amass enum -brute -d <domain> -src

amas enum brute -d <domain> -rf resolvers.txt -w bruteforce.list

suffleDNS:

https://github.com/OWASP/Amass.git