Questions tagged [reconnaissance]
The process of collecting information about an intended target of a malicious hack by probing the target system.
58 questions
-1
votes
1
answer
120
views
How i can grep only subdomain names without "target.com" [closed]
i have w wordlist of subdomains contains like this :
admin.bugbountytarget.com
portal.bugbountytarget.com
sales.bugbountytarget.com
vpn1.bugbountytarget.com
dev.test.bugbountytarget.com
...
And I ...
0
votes
1
answer
631
views
DNS Enumeration by IP Address
I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address?
My ...
- 11
0
votes
1
answer
358
views
Subdomains resolving to bogon IPs
During experimentation with the gobuster tool, and trying to find the subdomains matches of a domain (let's call that testdomain.com), I got some strange results and I explain.
The command used was $ ...
- 1
1
vote
3
answers
216
views
Is there a term for one specific step at beginning of reconnaissance?
If the hacker decides to attack the system, the first step is reconnaissance.
But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
- 195
0
votes
0
answers
246
views
How does the Amass intel module correlate information?
Can someone explain to me how OWASP Amass correlates information regarding the intel module domain search?
As an example, if I run the command:
amass intel -d example.com -whois
I'll get a list of ...
-1
votes
1
answer
956
views
Are IPv4 more intuitively hard to track than IPv6?
I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4:
For example, since I configured ...
user123574
0
votes
1
answer
12k
views
Recon-ng v5 - How to add domains?
I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4.
I was able to update myself with simple additions like ...
- 325
19
votes
1
answer
4k
views
How to protect yourself against OSINT?
I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where.
Given this is now ...
- 193
1
vote
2
answers
3k
views
Is it possible to determine the specific version of a website's web server?
I know I can use tools such as BuiltWith and Wappalyzer to find a web app's web server, but is there a way of determining the specific web server's version?
The web app I am looking at has a nginx ...
- 13
0
votes
0
answers
109
views
Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?
I'm conducting a penetration test, where I'm facing the following problem:
After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...
- 1,297
1
vote
1
answer
812
views
How can I determine the vulnerability for a sub domain takeover attack?
I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
- 23
0
votes
1
answer
217
views
Enumerating hosts running Elastic Stack
I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
- 23
0
votes
2
answers
2k
views
On urlscan.io Indicators of Compromise, what do the hashes represent?
When I look up a domain of interest on urlscan.io, I see a lot of interesting information.
When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
- 6,923
2
votes
1
answer
1k
views
List of common website endings/pages for enumeration? [closed]
I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
- 692
0
votes
1
answer
357
views
How to determine all public IP adresses from within an organization?
I can determine a single public IP address from within the organization (using NAT) by sending a HTTP request to one of the publically available services:
curl ipinfo.io/ip
However, if my request ...
- 1,297
1
vote
0
answers
644
views
What is the reason why I am not able to able to use Maltego unless I disable port 135 (RPC) inbound on my Windows computer?
I originally attempted to use Maltego before making any configuration changes to my firewall; however, I was being blocked because I had port 135 disabled which is what Windows uses for RPC. After ...
- 17
7
votes
2
answers
5k
views
What is the best way of finding subdomains of a domain?
I need to find most subdomains of a domain. I know there are many options.
I've tried many available in Kali Linux:
dnsmap
dnsenum
dnsrecon
dnswalk
fierce
urlcrazy
Most of them only find 2 or 3 ...
- 172
0
votes
1
answer
1k
views
how to do internal subdomain enumerations in corp network?
I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
- 41
0
votes
2
answers
4k
views
Is it possible to trace a MAC address to an individual?
Ethernet cards have a unique MAC address that is assigned during manufacture. If you capture a MAC address, and no other information, can you trace this to an individual?
Perhaps the manufacturers ...
- 34.7k
5
votes
2
answers
801
views
How do pentesters approach a large complex network?
Lots of books talk about using tools such as whois and other information gathering tools to collect information on the network and of course, not forgetting nmap. However, in a real network with such ...
- 439
2
votes
1
answer
393
views
What is UDP port 56183
We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?
- 1,971
0
votes
3
answers
916
views
Is there an alternative to google blocked searches? [closed]
I'm trying to do some research on google. I'm using specific keywords like inurl, site, etc.... But google seems to think I'm trying to do harm (actually I'm doing recon on a website for a friend)... ...
- 379
2
votes
2
answers
315
views
How much information does an improperly obscured barcode leak? [closed]
Often while sharing information on social media, some people may hide PII and yet still allow some aspect of a barcode to leak.
Question
Is there any research that describes how a damaged/obscured ...
- 51.1k
2
votes
2
answers
190
views
How to conclude from a target IP to associated URL(s)?
Given a target IP or target IP(s). Is there any reasonable way to conclude from the IP to hosted URL(s).
I can scan the IP(s) with nmap and possibly conclude on which ports a webserver is running, ...
- 1,019
2
votes
0
answers
194
views
Are there successors to httprecon [closed]
httprecon appears to be dead, the latest update per changelog is from 2009. Are there any successors?
- 724
0
votes
0
answers
191
views
How to identify additional resources when pivoting
I'm currently looking into pivoting when performing network penetration tests, but I'm having issues with reconnaissance.
Given the scenario I have full control over a server, which is publicly ...
- 1,019
2
votes
1
answer
3k
views
import list of domains into recon-ng
Is there a way to add domains into recon-ng from a text file (newline delimited)? I've tried comma delimiting entries but reco-ng takes the comma as part of the domain.
At the moment I am doing:
for ...
- 439
1
vote
1
answer
4k
views
Determine a Web Application's version of AngularJS
For reconnaissance, is there a definitive way to determine the version of AngularJS that a web application uses.
Other tools, such as wappalyzer and builtwith show the frameworks, but not the version....
- 151
0
votes
1
answer
1k
views
Techniques to find out the domain a given name server resolves for
So I am asking this question cause I have been stuck in this situation a few times while carrying out pen tests.
A few times I find an IP with DNS service up and running and I am not able to find out ...
- 1
1
vote
2
answers
3k
views
How can you enumerate an internal network with minimal outside knowledge?
The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet.
Right out of the gate you know your IP, gateway, ...
- 758
0
votes
1
answer
232
views
Is it a good idea to preventive use a robots.txt that disallows all search engines to index query strings in order to slow down reconnaissance?
I know that robots.txt is not a security feature. But, indexed and cached information by search engines might be incredibly helpful in the reconnaissance phase of a penetration test and potentially ...
- 7,055
4
votes
3
answers
987
views
IP addresses readily available on black market?
I know that criminals can readily find on the black market large dumps of password databases from hacked sites. These may contain the username, password, and email address for millions of users.
But ...
- 100k
3
votes
2
answers
1k
views
Can I trick a mail server into sending me an email?
Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
- 7,055
2
votes
3
answers
189
views
Should public access to specific filenames and -types be denied preventively?
Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames:
in the server configuration (in case of a shared hosting server) or,
as a rewrite ...
- 7,055
5
votes
4
answers
534
views
What is the best way to explain (a non-technical person) the risk of leaking version information?
I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided.
...
- 7,055
4
votes
2
answers
5k
views
How to map a network passively with wireshark dumps?
I'm currently diving into network mapping and thought that in order to do this stealthily why not listen to the existing network traffic; a wireshark dump usually contains a metric ton of information -...
- 670
4
votes
3
answers
2k
views
Security implications of WAF revealing internal IP addresses
What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world?
A specific example is with F5 products: They use a ...
- 1,297
125
votes
6
answers
260k
views
How to find out what programming language a website is built in?
I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in.
I know that URL extensions, HTTP headers, ...
- 1,742
20
votes
6
answers
62k
views
How to identify a company's public network address range?
Which methods can I use to identify a company's public network address range(s)?
- 528
6
votes
2
answers
62k
views
How to find Windows version from the file on a remote system
I need to find out what Windows and Service Pack system is currently running. All I have is ftp access, it means I cannot run any the software.
Is there a way to determine what version of Windows, ...
- 233
1
vote
2
answers
3k
views
Is there a tool to detect what technologies a website uses? [closed]
I'm looking for the name of a tool I've used a long time ago, that for a given URL/website address would extract the technologies used for that site.
For example that the site is running Apache, using ...
- 19
7
votes
2
answers
2k
views
Extra p0f v3 fingerprints files?
p0f v3 is a passive operating system detector. The latest release is 3.08b, dating to November, 2014. Given the releases of Windows 10, multiple Linux, Firefox and Chrome versions since then, the ...
- 4,582
1
vote
3
answers
6k
views
Detecting access point model
Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it?
Sniffing packets with Wireshark or others does not give any info, but ...
- 1,742
1
vote
1
answer
278
views
Is using a website copier considered active reconnaissance in penetration testing?
New to PT and would like to test recon skills.
First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? ...
- 11
4
votes
2
answers
5k
views
What is the purpose of subdomain enumeration?
There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder:
What's the purpose of that in terms of security / hacking?
Is there any way to do that other ...
- 149
7
votes
1
answer
463
views
What is the purpose of using different DNS server in nmap?
nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
- 71
3
votes
2
answers
2k
views
Is it possible to "fingerprint" the "patches" applied to a Windows system?
Two situations with a similar goal:
1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
- 2,040
1
vote
2
answers
764
views
Reconnaissance countermeasures
I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated.
...
- 589
0
votes
2
answers
166
views
Deniable discussions online [closed]
Consider this scenario:
Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she ...
- 198
1
vote
0
answers
247
views
Find the location of a hidden host [closed]
I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
- 3,606