Scanning and Recon: Difference between revisions
Line 143: | Line 143: | ||
=== Intercepting proxies === | === Intercepting proxies === | ||
* https://enlacehacktivista.org/index.php?title= | * https://enlacehacktivista.org/index.php?title=Hacking_APIs#Intercepting_proxies | ||
== Exploitation == | == Exploitation == | ||
For automatic exploit tools and payloads, see [[exploitation]]. | For automatic exploit tools and payloads, see [[exploitation]]. |
Revision as of 18:35, 26 July 2023
These tools will scan web applications for vulnerabilities and misconfigurations, remember that they will cause a lot of traffic making lots of requests.
NOTE: This is not an exhaustive list.
WAF detect
Your target may have a web application firewall (WAF) which might try to prevent scanning, exploitation and other security tests. It's important that we can identify what WAF is in place so we can try and bypass it. Some targets might be vulnerable and normally an exploit would work however the WAF is preventing the exploit from popping the box. You can try to encode the payload (Burpsuite is good for this) amongst other things to bypass the WAF.
- Blog: https://labs.detectify.com/2022/05/09/discovering-the-origin-host-to-bypass-waf
- Blog: https://blog.yeswehack.com/yeswerhackers/web-application-firewall-bypass
- https://github.com/EnableSecurity/wafw00f
- https://github.com/Ekultek/WhatWaf
- https://github.com/0xInfection/Awesome-WAF
- https://github.com/projectdiscovery/nuclei-templates/blob/master/technologies/waf-detect.yaml
Vulnerability scanners
To quickly cover a lot of ground it's a good idea to scan your target using vulnerability scanners as they might be able to discover a vulnerability or misconfiguration that you can't find. To avoid WAFs make sure to use a list of random user-agent strings and a residential proxy list if possible and maybe encode some payloads.
- Axiom distributes the load of your scanning tools across multiple servers. https://github.com/pry0cc/axiom | Twitter Thread
- https://github.com/six2dez/reconftw | Free scan config (no API)
- https://github.com/projectdiscovery/nuclei | The Ultimate Guide to Finding Bugs With Nuclei
- https://github.com/osmedeus/osmedeus-base [Free and Paid]
- https://github.com/Tuhinshubhra/CMSeeK
- https://github.com/jaeles-project/jaeles | Jaeles Scanner
- https://github.com/1N3/Sn1per
subfinder -d nasa.gov -silent | httpx -silent | nuclei -silent -s critical,high,medium,low -o vulns.txt
- https://github.com/wpscanteam/wpscan | WPScan Documentation [Free and paid]
- https://github.com/OWASP/joomscan
- https://github.com/immunIT/drupwn
- https://www.zaproxy.org
- https://github.com/fgeek/pyfiscan
- https://github.com/rapid7/metasploit-framework | Metasploit - Cheatsheet
- https://github.com/root-tanishq/userefuzz
- https://sourceforge.net/projects/grendel
- https://nmap.org/book/man-nse.html | Nmap Scripting Engine | Scripts
- https://github.com/v3n0m-Scanner/V3n0M-Scanner
- https://github.com/yogeshojha/rengine
Subdomain enumeration
Enumerate your targets top level domain (TLD) as part of your recon to identify entry points in your targets infrastructure. Pay special attention to interesting subdomains such as test, dev, backup, etc. Your targets subdomains may also be running out of date software, subdomains might not be behind a WAF where the main page will be, less or no authentication where there should be and more vulnerabilities may exist as opposed to the TLD.
You can also try using reconftw for a more comprehensive subdomain enumeration, using different tools and techniques.
./reconftw.sh -d nasa.gov -s
- https://github.com/projectdiscovery/subfinder
- Subdomain enumeration dork:
site:*.nasa.gov
- https://github.com/projectdiscovery/shuffledns
- https://github.com/projectdiscovery/dnsx
- https://github.com/infosec-au/altdns
- https://github.com/resyncgg/ripgen
Subdomain takeover
A subdomain takeover allows us to gain control over a misconfigured or abandoned subdomain. This is done by exploiting vulnerabilities in DNS settings, expired or deleted services, or incomplete migrations. Once control is established, we can employ social engineering tactics such as phishing, this could be hosting phishing pages on legitimate company subdomains that are already trusted by employees.
- https://github.com/EdOverflow/can-i-take-over-xyz
- https://github.com/Ice3man543/SubOver
- https://github.com/projectdiscovery/nuclei-templates/tree/main/http/takeovers
- https://www.hackerone.com/application-security/guide-subdomain-takeovers
Subdomain monitoring
Monitor your target for new subdomains whenever they pop up. Sometimes developers will create a new and temporary subdomain for testing and development, be notified whenever this happens. Include vulnerability scanners into the below bash script such as nuclei to automate some security testing as well.
- https://github.com/projectdiscovery/subfinder
- https://github.com/tomnomnom/anew
- https://github.com/projectdiscovery/notify
while true; do subfinder -silent -dL domains.txt -all | anew subdomains.txt | notify; sleep 3600; done
Content discovery
Find endpoints, URLs, Parameters, Resources and much more with content discovery.
- https://github.com/praetorian-inc/fingerprintx
- https://github.com/projectdiscovery/httpx
- https://github.com/tomnomnom/waybackurls
Fuzzing
- https://github.com/sullo/nikto
- https://github.com/epi052/feroxbuster
- https://github.com/OJ/gobuster
- https://github.com/ffuf/ffuf
- https://github.com/maurosoria/dirsearch
Word Lists
Word lists can be used in your content discovery when performing directory bruteforcing and subdomain bruteforcing.
- https://wordlists.assetnote.io
- https://github.com/danielmiessler/SecLists
- https://github.com/ameenmaali/wordlistgen
- https://gist.github.com/jhaddix/b80ea67d85c13206125806f0828f4d10
- https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content
Port scanners
When performing a port scan pay special attention to non-standard ports.
- https://github.com/nmap/nmap
- https://github.com/projectdiscovery/naabu
- https://github.com/robertdavidgraham/masscan
- https://github.com/zmap/zmap
- https://github.com/RustScan/RustScan
Technology scanners
NOTE: using browser add-ons will change your browser fingerprint and reduce anonymity.
When performing a penetration test we will want to know what technology is running on the target and what version it's running as so that later we can start looking for possible working public exploits.
- https://www.wappalyzer.com
- https://www.whatruns.com
- https://builtwith.com
- https://github.com/urbanadventurer/whatweb
- https://github.com/rverton/webanalyze
subfinder -d nasa.gov -silent | httpx -silent | nuclei -t technologies -silent
Web Crawlers
Crawl a website, extract all URL endpoints and save them for further analysis.
- https://github.com/projectdiscovery/katana
- https://github.com/jaeles-project/gospider
- https://github.com/hakluke/hakrawler
- https://www.zaproxy.org
- https://github.com/edoardottt/cariddi
ASN scanners
Map out an organizations network ranges using ASN information.
- https://github.com/projectdiscovery/asnmap
- https://github.com/banviktor/asnlookup
amass intel -asn AS21556
echo 'nasa' | metabigor net --org -v
echo 'AS21556' | metabigor net --asn -v
Google hacking
- (Book) Google Hacking for Penetration Testers 3rd Edition
- https://github.com/Proviesec/google-dorks
- https://www.exploit-db.com/google-hacking-database
- https://dorksearch.com
Intercepting proxies
Exploitation
For automatic exploit tools and payloads, see exploitation.