Tools

Amass

amass enum -d [domain] > amass.txt

---

Assetfinder

assetfinder [domain] | grep [domain] > subdomains.txt

---

DNS

dnsenum --dnsserver [target ip] --enum -p 0 -s 0 -o subdomains.txt -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt [TLD domain]

dnsrecon -r [range] -n [dns host ip] -d [domain]

• range should be the network, so something like 127.0.0.0/24 when on the same network

• -d is not really useful here but it a needed flag - can flll with garbage

---

HTTProbe

cat hosts.txt | httprobe

This will check port 80 and 443, if we want to narrow this down to only ssl, we can add the following parameters to httprobe:

cat hosts.txt | httprobe -s -p https:443

---

ip-thc

Great recon tool from thc.org, using their REST api

GitHub - haltman-io/ip-thc: A CLI tool written in Golang to perform queries on over 5.14 billion mapped assets in The Hackers' Choice datasets (https://ip.thc.org/). Supports Reverse DNS, Subdomain, and CNAME queries.GitHub

ip-thc --target [domain] --subdomain
ip-thc --target [target-ip] --reverse-dns
ip-thc --target [domain] --cname [--all]

---

Nmap

• network scan

• using list of hosts

  • -iL [host list]

• -sT is the most stealthy scan, as it uses the entire TCP handshake to check ports

• -sA to bypass many IPS and IDS

• -Pn disable ping

• -sU UDP scan

• -p- scan all ports (not just top 1000)

• -n disable DNS resolution

• --disable-arp-ping disable ARP ping, good for investigating further

• --packet-trace get more info on send and recv

• --reason get more info on the port state

• -D decoy - nmap inserts random IPs in the IP header of the scans

• --source-port specify a source port, often 53 to slide through dns port

  • can also specify this in netcat when connecting to a port

---

NFS

• list mounts:

  • showmount -e [ip]

• mount share:

  • mount -t nfs -o nolock [ip]:[share] /mnt

---

SMB

SMB shares can be enumerated many ways

smbclient -N -L //[target ip]
smbclient //server/share -U user

crackmapexec smb [target ip] --shares -u '' -p ''

nxc smb [target ip] --shares -u '' -p ''

smbmap -H [target ip]

• can add directory recursion with -r --depth [num]

• can pass the hash with -p (password or hash)

rpcclient -U "" [target ip]

smbget -R //[target ip]/[share name]

enum4linux-ng [target ip]

---

SMTP

smtp-user-enum -U [username file] -M VRFY -t [target ip] -D [domain]

---

SNMP

snmpwalk -v2c -c [community string] [target ip] 

onesixtyone -c /usr/share/wordlists/seclists/Discovery/SNMP/snmp.txt [target ip]

braa [community string]@[target ip]:.1.3.6.*

---

SSL Certs

• crt.sh to get cert information (goes down often)

curl -s https://crt.sh/\?q\=[domain]\&output\=json | jq .

• Pipe this string of commands to grep, cut and awk the unique domain names

grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u

• Example: find all dev subdomains on facebook.com:

curl -s "https://crt.sh/?q=facebook.com&output=json" | jq -r '.[]
 | select(.name_value | contains("dev")) | .name_value' | sort -u

• https://search.censys.io/