17
votes
Accepted
How to protect yourself against OSINT?
Open source intelligence has been around for sometime even though it's received attention only in the recent past. Here's what I do to keep a check on myself.
Step 1: Hack yourself
Have you ever ...
- 873
9
votes
How can I find subdomains of a site?
1. Zone transfer
Some nameservers allow for DNS zone transfers to anyone on the internet, usually unintentionally. In this question, it is explained further: DNS zone transfer attack.
Tools for zone ...
- 33.1k
7
votes
What is the best way of finding subdomains of a domain?
The tool you linked explained their techniques:
DNS zone transfer
DNS enumeration based on a specially chosen wordlist
Public search engine queries
Word mutation techniques
The Kali tools you ...
- 132k
6
votes
Accepted
What is UDP port 56183
The range 49152–65535 (215+214 to 216−1) contains dynamic or private ports that cannot be registered with IANA.[310] This range is used for private, or customized services or temporary purposes and ...
- 14.3k
5
votes
Accepted
How do pentesters approach a large complex network?
All security tests will have a scope and its this scope that would typically drive the process of the review.
So I'm assuming from the question that you're thinking about a network based review as ...
- 62.6k
4
votes
How much information does an improperly obscured barcode leak?
To directly answer your question, you can see some research on damaged QR codes here: http://datagenetics.com/blog/november12013/
A barcode is nothing more than a specialized font designed so that ...
- 34.7k
4
votes
Accepted
List of common website endings/pages for enumeration?
I believe the kind of tool you are looking for is called a "web fuzzer." A quick search turned up an open source tool called wfuzz, which contains a folder called wordlist which has lists that seem to ...
- 10.5k
4
votes
Accepted
Are IPv4 more intuitively hard to track than IPv6?
An IP address does not inherently represent a geographic location. An IP address space is owned by a company and this company is using an IP address for a specific purpose which is often tied to a ...
- 208k
3
votes
Is there a term for one specific step at beginning of reconnaissance?
Kill chains are not linear. They are loops of loops. So;
there was an "info gathering/reconnaissance" phase that identified that the modem was not on and that a custom cable was required
a &...
- 132k
3
votes
Accepted
Is it possible to determine the specific version of a website's web server?
There is no general way to reliably determine the exact server version from remote and it is not even possible to reliably get the more general type of server (i.e. apache, nginx, IIS ...).
While ...
- 208k
3
votes
Accepted
How can I determine the vulnerability for a sub domain takeover attack?
I actually know Patrik personally and will definitely ping him concerning your request.
I have published numerous technical write-ups on subdomain takeovers that include identifying vulnerable hosts ...
- 1,336
3
votes
How do pentesters approach a large complex network?
The question is selective & is about approaches to the penetration testing methodology followed on a large scale network. To be precise, there needs to be a scope of work which could be mapped ...
- 1,600
3
votes
Is it possible to trace a MAC address to an individual?
Technically, it would be next to impossible to trace back a random MAC address to an individual.
Notwithstanding the fact that MAC addresses can easily be spoofed or changed (which means that your ...
- 18.7k
2
votes
How to identify a company's public network address range?
You can do the bellow command for each of the entities. RIPE, ARIN, etc...
Example with Asia Pacific.
You will get the return of everything that has the string you put that exists in the database.
...
- 1,721
2
votes
Extra p0f v3 fingerprints files?
I checked out Fingerbank's fp file and the fingerprints are the same fingerprints from 3.09b distribution. The number in the labels relates to the id of the device table in the downloadable ...
- 21
2
votes
Spoofing OS during browsing
There are also options such as:
User Agent Switcher
Firefox Add-on:
https://addons.mozilla.org/En-us/firefox/addon/user-agent-switcher/
Chrome Extension:
(Also available, query for it, OP asked ...
- 121
2
votes
How to conclude from a target IP to associated URL(s)?
Crawlers can find these over different ways:
Read sitemap files or the robot.txt
Use statuscodes like 403 or 404 to guess whether there is a file or not
- 1,072
2
votes
Accepted
Is it possible to trace a MAC address to an individual?
NIC manufacturers do keep records of MAC Addresses they've used up. Do they keep shipping records by MAC address... hard to say. A good number of them use serial numbers instead of MAC addresses for ...
- 2,656
2
votes
How much information does an improperly obscured barcode leak?
This question is broad, and can only be answered rigorously if both the encoding and the application of the barcode is known. Nonetheless, here are some examples of barcodes leaking information:
...
- 4,861
2
votes
Accepted
On urlscan.io Indicators of Compromise, what do the hashes represent?
This site uses an unusual understanding of the term IOC (Indicators of compromise). Essentially it just lists all resources it has found on the site, no matter if these actually indicate a compromise ...
- 208k
2
votes
What is the best way of finding subdomains of a domain?
Essentially, you need to look for zone cuts or authoritative NS records. A zone cut can be detected by checking the DNS response header for a NOERROR status when attempting a resolve a resource ...
2
votes
Is there a term for one specific step at beginning of reconnaissance?
I would suggest that if this is targetted, this is part of reconnaissance. Specifically you talk about attacking the telephone network so reverse engineering the correct protocols, etc, which involves ...
- 409
2
votes
Subdomains resolving to bogon IPs
Why am I getting those IPs in the resolution of subdomains (that do not exist)
These IP address do exist. These are IP address in the private address space, which can be used in local networks.
...
- 208k
2
votes
How i can grep only subdomain names without "target.com"
With grep specifically (assuming it is compiled with libpcre):
grep -Po '^.*\b(?=\.bugbountytarget\.com$)' domainlist.txt
This just looks for the target at the end, in a forward lookahead (not a part ...
- 12.1k
1
vote
Accepted
Recon-ng v5 - How to add domains?
Nevermind, found the answer, it's:
db insert domains
same thing with others as well, for companies it's "db insert companies"
- 325
1
vote
On urlscan.io Indicators of Compromise, what do the hashes represent?
It's a hashed representation (in SHA256) of the resource in question, potentially malicious. They check and track other domains/URL where the same resource was seen or reported, as an indicators of ...
- 49
1
vote
How to determine all public IP adresses from within an organization?
This is not possible.
As you mention, you will have a route (or a few) to get out of your network and you can see the outbound public IP address for there.
This may be only one of the many addresses ...
- 9,088
1
vote
how to do internal subdomain enumerations in corp network?
Internal DNS are widely configured to authorized zone transfert in the internal context.
you can use the tool fierce for example. It makes an initial AXFR request (zone transfert) or use dig @...
- 1,368
1
vote
Is there an alternative to google blocked searches?
If continuing with regular search queries, you need to change your IP address, as simple as this. Users using proxies in the cloud often experience such issue, just because even though they have their ...
- 2,154
1
vote
Accepted
import list of domains into recon-ng
recon-ng already supports import of external data (by newlines) with the SOURCE variable. SOURCE should be available via most plugins, including the domain ones you are interested in.
Check the wiki -...
- 19.1k
Only top scored, non community-wiki answers of a minimum length are eligible