wtfis

Found an interesting tool called wtfis.

wtfis is a commandline tool that gathers information about a domain, FQDN or IP address using various OSINT services. 

This tool assumes that you are using free tier / community level accounts, and so makes as few API calls as possible to minimize hitting quotas and rate limits.

Setup

wtfis uses these environment variables:

• VT_API_KEY (required) - Virustotal API key
• PT_API_KEY (optional) - Passivetotal API key
• PT_API_USER (optional) - Passivetotal API user
• SHODAN_API_KEY (optional) - Shodan API key

Installation

$ pip install wtfis

Usage:

$ wtfis -h
usage: wtfis [-h] [-m N] [-s] [-n] [-1] [-V] entity

positional arguments:
  entity                Hostname, domain or IP

options:
  -h, --help            show this help message and exit
  -m N, --max-resolutions N
                        Maximum number of resolutions to show (default: 3)
  -s, --use-shodan      Use Shodan to enrich IPs
  -n, --no-color        Show output without colors
  -1, --one-column      Display results in one column
  -V, --version         Print version number

Links:

• https://github.com/pirxthepilot/wtfis
  

ZMAP

ZMap is a fast single-packet network scanner optimized for Internet-wide network surveys. 

On a computer with a gigabit connection, ZMap can scan the entire public IPv4 address space on a single port in under 45 minutes. With a 10gigE connection and PF_RING, ZMap can scan the IPv4 address space in 5 minutes.

Installation (Ubuntu)

$ sudo apt install zmap

$ sudo zmap 192.168.31.0/24

Installation (manual)

$ cmake -DWITH_REDIS=ON -DWITH_JSON=ON -DCMAKE_INSTALL_PREFIX=/usr/local/bin .
$ make -j4
$ make install

Sample Usage

┌──(xx㉿wsl2)-[~]
└─$ sudo zmap --probe-module=icmp_echoscan 192.168.31.1/24 --quiet
Oct 24 19:07:15.790 [INFO] zmap: output module: csv
Oct 24 19:07:15.790 [INFO] csv: no output file selected, will use stdout
192.168.31.227
192.168.31.1
192.168.31.210
192.168.31.214
192.168.31.239
192.168.31.209
192.168.31.202
192.168.31.224
192.168.31.208
192.168.31.236
192.168.31.216
192.168.31.205
192.168.31.213
Oct 24 19:07:23.939 [INFO] zmap: completed

Links:

• The ZMap Project
• ZMap: The Internet Scanner and wiki
  

Finding bugs with Nuclei

Nuclei is a community-powered scanner that can scan for almost every web-based vulnerability. But how does it work and how can you tailor it to your needs? All that and much more will be covered in this session.

Links:

• Nuclei - Community Powered Vulnerability Scanner 
• https://github.com/projectdiscovery/nuclei
  

Drop-in Replacement For Nmap

Smap - a drop-in replacement for NMAP that powered by Shodan. It is a replica of Nmap which uses shodan.io's free API for port scanning. It takes similar cmdline arguments as Nmap and produces the same output which makes it a drop-in replacement for Nmap.

Smap is super fast since it simple fetches existent port data from shodan.io. It can be used as:

• a super fast port scanner (200 hosts per second)
  
• vulnerability detection (services/version fingerprinting)
  
• reconnaissance on most common ports (limited to top 1237) 
  
• connection-less or passive-scan to the target
  

 

 Most important is, it doesn't require any account/api key.

Links:

• https://github.com/s0md3v/Smap
• https://www.kitploit.com/2022/04/smap-drop-in-replacement-for-nmap.html

A Pentest Story

This is an interesting story about penetration testing.

It demonstrates the pentest by starting from OSINT, recon, RCE, phishing, social engineering and finally getting a reverse shell access.

Enjoy the story at There is a shell in your lunch-box (by Rotimi Akinyele).

Links:

• https://hakin9.org/shell-lunch-box-rotimi-akinyele/
• Glassdoor - https://www.glassdoor.com/
  

Active Directory Penetration Testing Checklist

A short article that show Active Directory Penetration Testing, including reconnaissance commands and brute force Active Directory.

Links:

• https://gbhackers.com/active-directory-penetration-testing-checklist/
• https://github.com/sense-of-security/ADRecon
  

FindDomains

FindDomains is a multithreaded search engine discovery tool.

It retrieves domain names/web sites which are located on specified ip address/hostname. It can be very useful for penetration testers during reconnaissance domain names/web sites/virtual hosts/virtual IP.

Main highlights:

• Uses Bing search engine. Works with first 1000 records.
• Multithreaded on crawling and DNS resolution.
• Performs DNS resolution for extracted domains to eleminate cached/old records.
• Has a console interface.
• Works with Mono (under Linux), but running under Windows is more efficient.
• Requires .NET framework 3.5

Find it at http://code.google.com/p/finddomains/

Swiss Army Knife Internet Tool

Today, I've been introduced a new online tool to perform information gathering, called robtex.

With rotex, we can search for:

• RBL checks multible RBL
• DNS checks: detailed DNS information for a hostname or a domain
• IP-number checks: IP number information such as DNS reverse/forwards
• C-net checks an entire c-network
• WHOIS lookup checks.
• Route: checks a specific routed prefix
• AS numbers: checks information on an AS-number
• BGP announcements: checks prefixes origined from a specific AS-number
• AS macros: checks who belongs to an AS-macro (example: as-ams-ix-peers)
• RFC documents.

Virtual Host and DNS Enumeration Techniques

This is a great post on techniques to performing virtual host and DNS enumerations for reconnaissance in penetration testing.

Here's the summary:

• DNS enumeration
• Banner grabbing
• SSL/TLS enumeration
• HTTP Protocol enumeration
• Active/Passive Web enumeration

Check out this site from Lonerunners. It does mention about Hostmap too.

HostMapping

Everyone perform reconnaissance during penetration testing. Here comes a handy tool to help you to perform hostmapping for information gathering.

It helps you using several techniques to enumerate all the hostnames associated with an IP address. This is similar to SpyOnWeb.

The major features are:

• DNS names and virtual hosts enumeration.
• Multiple discovery techniques, to read more see user guide.
• Results correlation, aggregation and normalization.
• Multithreaded and event based engine.
• Platform independent.

Download a copy of this handy tool here!

Spy On Web

SpyOnWeb.com takes the information from public sources, then structures it for your quick and convenient search for the websites that probably belong to the same owner. The web crawler picks out the following data: IP address, Google Adsense ID, Google Analytics ID, Yahoo Publisher Network ID, Yandex Direct ID.

This greatly helpss a pentester to disclose any websites with the same IP address and same owner during reconnaissance. Simply enter website URL, IP address, adversting or statistics code to discover the targetted internet business and use this data for your further strategy.

According to the website, they have indexed more than 72 million domains with more than:

• 8 499 550 sites with Google Analytics code.
• 3 603 150 sites with Google AdSense code.
• 20 347 sites with Yahoo Publisher Network code.
• 13 448 sites with Yandex Direct code.

Online Web Information Gathering

Here is a very useful service I’ve discovered today.

Sucuri WIGS (Web information gathering) is a simple tool to collect public information from any web site. It is very lightweight, executing just a few normal requests to your site and processing the information internally.

Enter the site URL, it will shows you:

• The web server information: banner, version.
• Related hosts and IP address: sub-sites.
• DNS lookup information.
• HTTP header information.
• Whois information.
• List of links.

Find here the online service from Sucuri web site.

Reverse Lookup with Bing

I learn this unique feature at Microsoft latest search engine, Bing.

You may perform reverse lookup with an IP address for a main site and generate a list of sub-site with Bing search engine.

For example, you enter "ip:216.34.181.45" (without the quote). This is the IP address for SlashDot main. It will results in 310,000 answers with a list of sub-site that hosting at the same public IP address.

This is a great feature as it can allow a pentester to find out how many websites are hosted at one particular IP address during reconnaissance. Cool!