Domain Spray and Pray - Revision history

Booda at 11:38, 21 March 2024

2024-03-21T11:38:36Z

← Older revision		Revision as of 11:38, 21 March 2024
Line 18:		Line 18:
	** <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>		** <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>

	=== Domains ===		=== Cloud Domains ===
	To begin, download all of the cloud providers text files and parse them.		To begin, download all of the cloud providers text files and parse them.

	* https://kaeferjaeger.gay/?dir=sni-ip-ranges		* https://kaeferjaeger.gay/?dir=sni-ip-ranges
	* https://github.com/duckduckgo/tracker-radar

	Output all cloud provider text files into one big file:		Output all cloud provider text files into one big file:

Booda: /* Mass Scanning */

2023-10-01T00:03:48Z

Mass Scanning

← Older revision		Revision as of 00:03, 1 October 2023
Line 4:		Line 4:

	=== Mass Scanning ===		=== Mass Scanning ===
	If you don't want to limit your scan by cloud providers and you want to get more coverage for domains you can use both [https://github.com/zmap/zmap zmap] and [https://github.com/zmap/zgrab2 zgrab] to port scan and download SSL certificate data to then grep for domains.		If you don't want to limit your scan by cloud providers and you want to get more coverage for domains you can use both [https://github.com/zmap/zmap zmap] and [https://github.com/zmap/zgrab2 zgrab] to port scan and download SSL/TLS certificate data to then grep for domains. A lot of organizations suffer from shadow IT and dont have great insights into the assets they own and are exposed. We can exploit this with mass spray and pray campaigns.

	==== Zmap ====		==== Zmap ====

Booda: /* Zgrab */

2023-09-18T23:49:17Z

Zgrab

← Older revision		Revision as of 23:49, 18 September 2023
Line 14:		Line 14:
	* <code>[https://github.com/zmap/zgrab2 zgrab2] tls --input-file=targets.txt --output-file=certs.json</code>		* <code>[https://github.com/zmap/zgrab2 zgrab2] tls --input-file=targets.txt --output-file=certs.json</code>

	After which you will want to parse output for government top level domains:		After which you will want to parse the output for government top level domains ([https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains or other]):
	* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' certs.json > domains.txt</code>		* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' certs.json > domains.txt</code>
	** <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>		** <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>

Booda: /* Zgrab */

2023-09-18T23:46:53Z

Zgrab

← Older revision		Revision as of 23:46, 18 September 2023
Line 14:		Line 14:
	* <code>[https://github.com/zmap/zgrab2 zgrab2] tls --input-file=targets.txt --output-file=certs.json</code>		* <code>[https://github.com/zmap/zgrab2 zgrab2] tls --input-file=targets.txt --output-file=certs.json</code>

	After which you will want to parse for domains:		After which you will want to parse output for government top level domains:
	* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' certs.json > domains.txt</code>		* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' certs.json > domains.txt</code>
			** <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>

	=== Domains ===		=== Domains ===

Booda at 23:41, 18 September 2023

2023-09-18T23:41:51Z

← Older revision		Revision as of 23:41, 18 September 2023
Line 2:		Line 2:

	'''NOTE:''' This is very loud and not recommended. However for large scale hacktivist operations where the operation seeks to target as much as possible in regards to specific TLDs or countries this method works quite well in regards to identifying low hanging fruit vulnerabilities. A more targeted penetration test against a target list will be much better and more effective.		'''NOTE:''' This is very loud and not recommended. However for large scale hacktivist operations where the operation seeks to target as much as possible in regards to specific TLDs or countries this method works quite well in regards to identifying low hanging fruit vulnerabilities. A more targeted penetration test against a target list will be much better and more effective.

	~~=== Domains ===~~
	~~To begin, download all of the cloud providers text files and parse them.~~

	* https://kaeferjaeger.gay/?dir=sni-ip-ranges
	* https://github.com/duckduckgo/tracker-radar

	=== Mass Scanning ===		=== Mass Scanning ===
Line 23:		Line 17:
	* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' certs.json > domains.txt</code>		* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' certs.json > domains.txt</code>

	=== ~~Parse output~~ ===		=== Domains ===
			To begin, download all of the cloud providers text files and parse them.

			* https://kaeferjaeger.gay/?dir=sni-ip-ranges
			* https://github.com/duckduckgo/tracker-radar

	Output all cloud provider text files into one big file:		Output all cloud provider text files into one big file:

Booda: /* Mass Scanning */

2023-09-18T23:40:32Z

Mass Scanning

← Older revision		Revision as of 23:40, 18 September 2023
Line 14:		Line 14:
	==== Zmap ====		==== Zmap ====
	Scan the internets IPV4 space for port 443:		Scan the internets IPV4 space for port 443:
	* <code>sudo zmap -p 443 -o targets.txt</code>		* <code>sudo [https://github.com/zmap/zmap zmap] -p 443 -o targets.txt</code>

	==== Zgrab ====		==== Zgrab ====
	Using zmaps output as input now download the certificate data:		Using zmaps output as input now download the certificate data:
	* <code>zgrab2 tls --input-file=targets.txt --output-file=certs.json</code>		* <code>[https://github.com/zmap/zgrab2 zgrab2] tls --input-file=targets.txt --output-file=certs.json</code>

	After which you will want to parse for domains:		After which you will want to parse for domains:

Booda at 23:39, 18 September 2023

2023-09-18T23:39:25Z

@@ Line 9: / Line 9: @@
 * https://github.com/duckduckgo/tracker-radar
-Output all text files into one big file:
+=== Mass Scanning ===
 * <code>user@host:~/sni_ip_ranges$ cat *.txt > all.txt</code>

Booda: /* Domains */

2023-09-18T22:19:24Z

Domains

← Older revision		Revision as of 22:19, 18 September 2023
Line 7:		Line 7:

	* https://kaeferjaeger.gay/?dir=sni-ip-ranges		* https://kaeferjaeger.gay/?dir=sni-ip-ranges
	** https://github.com/duckduckgo/tracker-radar		* https://github.com/duckduckgo/tracker-radar

	Output all text files into one big file:		Output all text files into one big file:

Booda: /* Domains */

2023-09-18T22:19:09Z

Domains

← Older revision		Revision as of 22:19, 18 September 2023
Line 7:		Line 7:

	* https://kaeferjaeger.gay/?dir=sni-ip-ranges		* https://kaeferjaeger.gay/?dir=sni-ip-ranges
			** https://github.com/duckduckgo/tracker-radar

	Output all text files into one big file:		Output all text files into one big file:

Booda: Domain Spray and Pray

2023-09-18T22:02:52Z

Domain Spray and Pray

New page

To get a list of government domains (as an example) you can either masscan the internet using [https://github.com/zmap/zmap zmap] for port 443 and then proceed to grab banners and certificates using [https://github.com/zmap/zgrab2 zgrab] and then grep for <code>.gov</code> TLDs or you can [https://kaeferjaeger.gay/?dir=sni-ip-ranges download a list of domains] from popular cloud providers (limiting) such as Amazon, Digital Ocean, Google, Microsoft and Oracle.

'''NOTE:''' This is very loud and not recommended. However for large scale hacktivist operations where the operation seeks to target as much as possible in regards to specific TLDs or countries this method works quite well in regards to identifying low hanging fruit vulnerabilities. A more targeted penetration test against a target list will be much better and more effective.

=== Domains ===
To begin, download all of the cloud providers text files and parse them.

* https://kaeferjaeger.gay/?dir=sni-ip-ranges

Output all text files into one big file:
* <code>user@host:~/sni_ip_ranges$ cat *.txt > all.txt</code>

Parse all.txt for domains:
* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/all.txt > domains.txt</code>

Grep specifically for your targets TLDs:
* <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>

=== Enumerate Subdomains ===
To be thorough in our scanning we will enumerate all the domains in the domains.txt file for their subdomains to ensure complete coverage (nuclei will filter duplicates).

* <code>[https://github.com/projectdiscovery/subfinder subfinder] -dL gov_domains.txt -o government_domains.txt</code>

=== Port scan ===
To ensure a thorough vulnerability scan we will want to port scan our targets for their open ports to ensure we scan all their services.

* <code>[https://github.com/projectdiscovery/naabu naabu] -l government_domains.txt -o government_domains_final.txt</code>

=== Vulnerability Scan ===
Finally we vulnerability scan the targeted domains to later exploit.

* <code>[https://github.com/projectdiscovery/nuclei nuclei] -l government_domains_final.txt -s critical,high -o vuln_gov_domains.txt</code>