148

There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues: File extensions: login.php is most likely a PHP script. HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page ...


29

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. ...


17

For guessing the programming language, you can follow the three steps approach detailed below: STEP 1 - Search evidences on the site itself Manually... Search on a site page at the bottom for phrases like: -> "Powered by XXX" -> "Proudly Powered by XXX" -> "Running on XXX" -> ... Search on the site if it will attend any conference where they ...


16

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about available machines and resources. The underlying space of network (IP) addresses is sparsely populated (and IP:port combinations even more so), so narrowing down the ...


16

It's simple. Add Wapplyzer extension available for Chrome as well as Firefox. It tells about programming language, server, analytics tool or about CMS & Frameworks on which website is built. Give it a try, you will love it.


10

This relies on some factors. When its a big company and they own complete subnets these information are stored within the whois record. You can either use commercial tools which allow you to search a dump of whois records for the company or lookup all public available hostnames of that company. You would normally start with the address of the web, mail and ...


9

Based on https://superuser.com/questions/363018/how-do-i-tell-what-version-and-edition-of-windows-is-on-the-filesystem you can find the Windows Version and Service pack in C:\Windows\System32\license.rtf for Windows 7. For Windows XP the information is in C:\Windows\System32\eula.txt. For Windows 10 licenses.rtf does not contain the version. Instead it ...


9

Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment. Enumerating subdomains is crucial as they may point to different parts of a web application or may lead to another website hosted on another server with a different IP address. This allows you to come up with an ...


8

Besides the Wappalizer browser extension, there are several sites that detect what technologies power a given website: http://builtwith.com/ http://onlinewebtool.com/cmsdetector.php - for CMS detection http://guess.scritch.org/ - Detect CMS, web framework


7

There are all sorts of reasons: You might not have access to local DNS servers. You might want to query against a specific non-default DNS server within the organisation, which you suspect may leak more information than their defaults. You might not want to alert a sysadmin / blue team by performing lots of DNS lookups across the infrastructure, so you ...


7

The tool you linked explained their techniques: DNS zone transfer DNS enumeration based on a specially chosen wordlist Public search engine queries Word mutation techniques The Kali tools you mentioned can do some of those things, but perhaps not all. You might need to combine them or configure them differently. Without knowing the specifics of what ...


6

There is no simple way. The company probably has a website, but it may be hosted on premises as well as elsewhere. And even if it is on their premises, it may have a different IP range as the rest of the network. For example Microsoft.com's IP address is 104.43.195.251, which is in the range 104.40.0.0 - 104.47.255.255. But if you look for bing.com, it has ...


6

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts. You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...


6

The range 49152–65535 (215+214 to 216−1) contains dynamic or private ports that cannot be registered with IANA.[310] This range is used for private, or customized services or temporary purposes and for automatic allocation of ephemeral ports. Likewise, UDP 56183 does not appear on the official IANA port listing source document: http://www.iana.org/...


5

All security tests will have a scope and its this scope that would typically drive the process of the review. So I'm assuming from the question that you're thinking about a network based review as opposed to a review of a specific application. With this kind of review the starting point is likely to be a set of IP address ranges that are in-scope of the ...


4

1. Zone transfer Some nameservers allow for DNS zone transfers to anyone on the internet, usually unintentionally. In this question, it is explained further: DNS zone transfer attack. Tools for zone transfers The second answer on that question mentions how to test for it for both Windows and Linux: Windows: nslookup > server <DNS you are ...


4

Generally speaking anything which sends traffic directly to a company's site is considered active rather than passive. Now most organisations will realise that traffic to a public facing site is fine and not an attack (as long as it's not excessive enough to cause a Denial of Service) but it is a legal grey area as, for example, a spider could hit content ...


4

Imagine a car robber specialized in stealing Toyota Prius models from 2010 to 2015. It will be pretty easy for him to identify this type of car, just by looking around and analyzing the model characteristics. Now let's assume the car robber is blind and can only identify the car models by touching them. This would make it much harder for him, to spot the ...


4

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups. The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized ...


4

No, this adds no real security value. Depending on the approach of your attacker, the first thing he might do is fingerprint the server and libs and do a crawl of the whole site himself (that's what I would do if the point is to find a vulnerability in the code). Crawling a site like this is extremely trivial (and easily automated), so the gain is ...


4

To directly answer your question, you can see some research on damaged QR codes here: http://datagenetics.com/blog/november12013/ A barcode is nothing more than a specialized font designed so that a computer can read reliably. It's much easier for a computer to recognize and read a pattern of stripes than it is for it to read Courier or Arial. And just ...


4

I believe the kind of tool you are looking for is called a "web fuzzer." A quick search turned up an open source tool called wfuzz, which contains a folder called wordlist which has lists that seem to be pretty close to what you describe.


3

You might be interested in an online tool http://www.whatweb.net/ or an equivalent whatweb program in *nix. (http://www.morningstarsecurity.com/research/whatweb).


3

OSes respond to invalid packets because that is very helpful in diagnosing network configuration problems. If you send a packet and nobody answers, you have no idea what happened to the packet: did some router eat it? Was its reply misrouted? Is there a connectivity problem? Or did the target receive the packet but not like it? If the target replies, you ...


3

Jason Haddix wrote my favorite subdomain/hostname discovery tool that depends on a very-recent version of recon-ng -- available here -- https://github.com/jhaddix/domain subbrute is decent, fierce -dns <domain> works great, dnsmap <domain> -r file.txt is also valid, and I don't see any reason to dislike knock -wc <domain> (although the ...


3

I would try it with knock but watch out: there is a risk of being blacklisted. Unfortunately is there no way around bruteforcing if a zone transfer doesn't work.


3

Some background information for context : Some organizations save full-packet captures for their high-security or production networks. There are commercial products which do this too. People definitely do what you are talking about but not always for the reason you mention although that's a good side benefit. Ideally what you want is an optical tap at key (...


3

If you are looking to map out your immediate LAN, a simple ARP sniffer (probably written in Python with the scapy library), would work just fine. But, if you're looking to find the entire network topology, there is a way to do it, but the circumstances are a bit specific. If the network utilizes Cisco routers, and those routers route dynamically using OSPF,...


3

On the web servers I run, I deny access to any type of server log files and sensitive files that contain web app configuration details such as WordPress's wp-config.php file However, if you're running a website, denying access to PHP, HTML, CSS, in addition to some other file types would render your website unusable since browsers need to access those files ...


3

The question is selective & is about approaches to the penetration testing methodology followed on a large scale network. To be precise, there needs to be a scope of work which could be mapped something like below: This will be first hand information gathering phase & if you're into an Enterprise Network, I assume - all such info could be retained ...


Only top voted, non community-wiki answers of a minimum length are eligible