My Recon
Last updated
Was this helpful?
Last updated
Was this helpful?
Note: As said earlier, everyone's Recon methodology may differ. Here you can find mine in which some tools or methods may be outdated or the latest one. feel free to add the new one to your methodology.
Here I gonna differentiate my recon methodology into two different approaches.
1) Recon in Web Application security assessment
2) Recon in Infrastructure security assessment
⭐ Recon in Web Application security assessment ⭐
Note: There are plenty of tools, techniques available on the internet and I don't want to dump it all in you. So here you can find some of my commonly used tools and tutorials to install and use it.
1) Collect Information from the Internet about Target
Tools:
- Search engine used to discover devices connected to the internet.
Installation in Kali Linux - pip install shodan
Working - &
- Way back machine used to crawl the past and present histories of our target.
Installation in kali Linux -
Working -
- Used to perform network mapping and discover the external assets using OSINT.
- Used to retrieve organization assets from the internet.
Working -
Commands: “example.com” internal
& Many.
2) Collect Information like Technologies and services used
Tools:
- Cool Addon available for both chrome and firefox browsers used to find technologies, the framework, server, programming language and etc, used in that visited website.
- Used to find technologies and infrastructure used in that site.
- Used to take screenshots of given sites, servers, and services.
Working:
3) Crawling Endpoints
Tools:
- A Default feature available in the Burpsuite tool. Used to crawl endpoints of the targeted site.
- Tool used to discover endpoints and assets in that site.
Installation in kali Linux - go get github.com/hakluke/hakrawler
Working -
- This awesome tool is used to extract much information from the endpoints and save it in an organized manner.
Working -
- Another cool tool used for crawl endpoints and additional information from it.
4) DNS Discovery & Port Scanning
Tools:
- A master tool for pentesters used to scan ports and services.
Working -
more about enumeration ->
- Online site used to retrieve Host records and all information related to that target.
- Used to enumerate DNS Subdomain scanner.
Working -
- One of the fastest Internet port scanner.
Working -
5) Collect Sensitive and Interesting information
Tools:
Trust me sometimes /robots.txt reveals some interesting paths.
, , & - These are some awesome Web Content scanners that retrieve some cool sensitive endpoints.
Working -
Below are some of my nice Google Dorks which lead to Sensitive Information Disclosure
site:example.com intext:"sql syntax near" | intext:"syntax error has occurred" | intext:"incorrect syntax near" | intext:"unexpected end of SQL command" | intext:"Warning: mysql_connect()" | intext:"Warning: mysql_query()" | intext:"Warning: pg_connect()"
site:example.com ext:log | ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini | ext:sql | ext:dbf | ext:mdb | ext:perf
6) Subdomain Scanner and Takeovers
Tools:
- It is a collection of 8+ Subdomain scanners tool which will enumerate many subdomains and subdomains of subdomains too.
- Tool used to takeover subdomains by identifying which one can be hijacked.
Installation in Kali Linux: go get github.com/haccer/subjack
- Tool that can easily detect and report potential subdomain takeovers that exist.
7) Tools to recon application frameworks:
Tools:
- WordPress scanner and vulnerability database.
- WordPress vulnerability scanner
- Joomla Vulnerability Scanner
- CMS Detection and Exploitation suite
- Joomla CMS Scanner
- Scans for WordPress, Joomla, Drupal, vBulletin Sites for vulnerabilities.
- A Plugin based scanner.
- Drupal Recon and Exploitation tool.
8) Always check Source Code, JS Files and understand how each mechanisms works.
⭐ Recon in Infrastructure security assessment ⭐ 1) Scan the whole network: Tools: - Detects ports, services, and it's version in the network - , , , for better GUI. 2) If Powershell allows full language go for PS scripts. , , and other . 3) Look for internal applications and portals Always Check for default credentials and commonly used credentials Sites: Always check the official documentation check repos too 4) Check for local admin privilege escalation 5) Check network VLAN's 6) Understand the network architecture