Questions tagged [reconnaissance]

The process of collecting information about an intended target of a malicious hack by probing the target system.

Filter by
Sorted by
Tagged with
105
votes
6answers
131k views

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...
36
votes
8answers
46k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
18
votes
1answer
2k views

How to protect yourself against OSINT?

I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where. Given this is now ...
17
votes
6answers
40k views

How to identify a company's public network address range?

Which methods can I use to identify a company's public network address range(s)?
8
votes
3answers
9k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
7
votes
2answers
4k views

What is the best way of finding subdomains of a domain?

I need to find most subdomains of a domain. I know there are many options. I've tried many available in Kali Linux: dnsmap dnsenum dnsrecon dnswalk fierce urlcrazy Most of them only find 2 or 3 ...
7
votes
1answer
361 views

What is the purpose of using different DNS server in nmap?

nmap allows the use of different DNS servers (not local). What is the benefit of doing so?
5
votes
2answers
3k views

What is the purpose of subdomain enumeration?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
5
votes
2answers
335 views

How do pentesters approach a large complex network?

Lots of books talk about using tools such as whois and other information gathering tools to collect information on the network and of course, not forgetting nmap. However, in a real network with such ...
5
votes
2answers
1k views

Extra p0f v3 fingerprints files?

p0f v3 is a passive operating system detector. The latest release is 3.08b, dating to November, 2014. Given the releases of Windows 10, multiple Linux, Firefox and Chrome versions since then, the ...
4
votes
4answers
244 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
4
votes
3answers
639 views

IP addresses readily available on black market?

I know that criminals can readily find on the black market large dumps of password databases from hacked sites. These may contain the username, password, and email address for millions of users. But ...
4
votes
3answers
808 views

Security implications of WAF revealing internal IP addresses

What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world? A specific example is with F5 products: They use a ...
3
votes
2answers
2k views

How to map a network passively with wireshark dumps?

I'm currently diving into network mapping and thought that in order to do this stealthily why not listen to the existing network traffic; a wireshark dump usually contains a metric ton of information -...
3
votes
2answers
1k views

Can I trick a mail server into sending me an email?

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
3
votes
1answer
2k views

OS fingerprinting protection - why not by default?

This article describes how to fool nmap in it's OS fingerprinting detection. In short, nmap sends malformed packets to open and closed ports and listens to the responses. Because every OS implements ...
3
votes
2answers
1k views

Is it possible to “fingerprint” the “patches” applied to a Windows system?

Two situations with a similar goal: 1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
3
votes
1answer
221 views

Does OpenSSL leave any traces that a server uses it?

I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL? -- Clarification: Speaking in terms ...
3
votes
1answer
2k views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
2
votes
1answer
28k views

How to find Windows version from the file on a remote system

I need to find out what Windows and Service Pack system is currently running. All I have is ftp access, it means I cannot run any the software. Is there a way to determine what version of Windows, ...
2
votes
1answer
274 views

What is UDP port 56183

We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?
2
votes
2answers
170 views

How much information does an improperly obscured barcode leak? [closed]

Often while sharing information on social media, some people may hide PII and yet still allow some aspect of a barcode to leak. Question Is there any research that describes how a damaged/obscured ...
2
votes
3answers
114 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
2
votes
1answer
152 views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
2
votes
2answers
107 views

How to conclude from a target IP to associated URL(s)?

Given a target IP or target IP(s). Is there any reasonable way to conclude from the IP to hosted URL(s). I can scan the IP(s) with nmap and possibly conclude on which ports a webserver is running, ...
2
votes
1answer
2k views

import list of domains into recon-ng

Is there a way to add domains into recon-ng from a text file (newline delimited)? I've tried comma delimiting entries but reco-ng takes the comma as part of the domain. At the moment I am doing: for ...
2
votes
0answers
111 views

Are there successors to httprecon [closed]

httprecon appears to be dead, the latest update per changelog is from 2009. Are there any successors?
1
vote
2answers
953 views

Is there a tool to detect what technologies a website uses? [closed]

I'm looking for the name of a tool I've used a long time ago, that for a given URL/website address would extract the technologies used for that site. For example that the site is running Apache, using ...
1
vote
1answer
132 views

Is using a website copier considered active reconnaissance in penetration testing?

New to PT and would like to test recon skills. First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? ...
1
vote
2answers
416 views

Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
1
vote
1answer
471 views

Does shodan JSON API use my IP address?

I want to find out if shodan uses my ip adresse to query the target after sending this HTTP request: https://api.shodan.io/shodan/host/{target_ip}?key={MY_API_KEY} so is shodan API a passive or ...
1
vote
2answers
92 views

Is it possible to determine the specific version of a website's web server?

I know I can use tools such as BuiltWith and Wappalyzer to find a web app's web server, but is there a way of determining the specific web server's version? The web app I am looking at has a nginx ...
1
vote
1answer
2k views

Determine a Web Application's version of AngularJS

For reconnaissance, is there a definitive way to determine the version of AngularJS that a web application uses. Other tools, such as wappalyzer and builtwith show the frameworks, but not the version....
1
vote
2answers
1k views

How can you enumerate an internal network with minimal outside knowledge?

The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet. Right out of the gate you know your IP, gateway, ...
1
vote
2answers
3k views

Detecting access point model

Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it? Sniffing packets with Wireshark or other does not give any info , ...
1
vote
2answers
4k views

Spoofing OS during browsing

I am using http://www.mybrowserinfo.com/ to gather some info about me while browsing. I want to change my OS to appear that its a Windows Xp machine.(No VM solutions please:D) If you have any ...
1
vote
0answers
61 views

What is the reason why I am not able to able to use Maltego unless I disable port 135 (RPC) inbound on my Windows computer?

I originally attempted to use Maltego before making any configuration changes to my firewall; however, I was being blocked because I had port 135 disabled which is what Windows uses for RPC. After ...
1
vote
0answers
127 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
2answers
1k views

Is it possible to trace a MAC address to an individual?

Ethernet cards have a unique MAC address that is assigned during manufacture. If you capture a MAC address, and no other information, can you trace this to an individual? Perhaps the manufacturers ...
0
votes
1answer
126 views

Is it a good idea to preventive use a robots.txt that disallows all search engines to index query strings in order to slow down reconnaissance?

I know that robots.txt is not a security feature. But, indexed and cached information by search engines might be incredibly helpful in the reconnaissance phase of a penetration test and potentially ...
0
votes
2answers
450 views

On urlscan.io Indicators of Compromise, what do the hashes represent?

When I look up a domain of interest on urlscan.io, I see a lot of interesting information. When I click on "Indicators of compromise" (IOC), I see a list of hashes that are actually links to pages ...
0
votes
1answer
113 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
0
votes
1answer
256 views

How can I determine the vulnerability for a sub domain takeover attack?

I have found research efforts on explaining how sub domain takeovers can take place authored by a gentleman named "Patrik Hudák". Through his site's blogs he illustrates and conveys an understanding ...
0
votes
1answer
51 views

How to determine all public IP adresses from within an organization?

I can determine a single public IP address from within the organization (using NAT) by sending a HTTP request to one of the publically available services: curl ipinfo.io/ip However, if my request ...
0
votes
1answer
468 views

how to do internal subdomain enumerations in corp network?

I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
0
votes
3answers
391 views

Is there an alternative to google blocked searches? [closed]

I'm trying to do some research on google. I'm using specific keywords like inurl, site, etc.... But google seems to think I'm trying to do harm (actually I'm doing recon on a website for a friend)... ...
0
votes
1answer
354 views

Techniques to find out the domain a given name server resolves for

So I am asking this question cause I have been stuck in this situation a few times while carrying out pen tests. A few times I find an IP with DNS service up and running and I am not able to find out ...
0
votes
2answers
94 views

Deniable discussions online [closed]

Consider this scenario: Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she ...
0
votes
1answer
151 views

Recon-ng v5 - How to add domains?

I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4. I was able to update myself with simple additions like ...
0
votes
0answers
38 views

Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?

I'm conducting a penetration test, where I'm facing the following problem: After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...