Active
Directly interacts with a target system to obtain information.
Last updated
Was this helpful?
Directly interacts with a target system to obtain information.
Last updated
Was this helpful?
Designed to take screenshots of websites provide some server header info, and identify default credentials if known.
eyewitness --web -x <nmap_scan>.xml -d <output_name>
eyewitness --web -x <nessus_scan>.xml -d <output_name>
eyewitness -f <subdomains> -d <output_name>
Tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface.
cat <nmap_scan>.xml | ./aquatone -nmap
whatweb -v <DOMAIN>
whatweb -v -a <LEVEL_AGGRESSIVE> <DOMAIN>
Allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
wafw00f -v -a <DOMAIN>
Subdomain passively via online sources.
subfinder -d <DOMAIN>
gobuster dns [-r <SERVER_DNS>] -d <DOMAIN> -w <WORDLIST>
Create the list with own NameServers/Domain (ex., myResolver.txt)
subbrute.py -r myResolver.txt <DOMAIN> [-s <WORDLIST>]
ffuf -c -w <WORDLIST>:X -u http://X.<DOMAIN>/
ffuf -c -w <WORDLIST>:X -u http://<IP:PORT or DOMAIN>/ -H 'Host: X.<DOMAIN>'
Zone Transfer is how a secondary (slave) DNS server receives information from the primary (master) DNS server and updates it. The primary DNS server may not be configured correctly. If we can successfully perform a zone transfer for a domain, we will get all the information available for that domain.
Need to find all possible Subdomains and Name Servers.
Need to perform Asynchronous Full Transfer Zone (AXFR) queries on each element found at 1.
host
host -l <DOMAIN> <SERVER_DNS>
nslookup
nslookup -type=any -query=AXFR <DOMAIN> <SERVER_DNS>
dig
dig axfr @<SERVER_DNS> <DOMAIN>
Finding the active host and ports for then proceeding with services enumeration.
nmap -sn <NETWORK>
ARP scan.
nmap -iL <FILE>
Input from list of hosts/networks
nmap -sn -PE/-PS/-PA/-PU <NETWORK>
ICMP/TCP-SYN/TCP-ACK/UDP scan.
--disable-arp-ping
Disable ARP.
--packet-trace, --reason
For investigating.
Internet-scale port scanner, for very large networks
sudo masscan <NETWORK>
ICMP scan
fping -a -q -g <NETWORK>
ARP scan
arp-scan -g -S <SOURCE_MAC> -i <INTERFACE> <NETWORK>
The Modern Port Scanner
rustscan -a <IP> [<NMAP OPTIONS>]
netcat
for i in $(seq 1 254); do nc -zv -w 1 X.X.X.$i 445;done
()
Scripts for enumeration and attack of services. ()