Recon For Web Pen-Testing!!
medium.com/@theUnixe/recon-for-web-pen-testing-6a6333673818
theUnixe April 30, 2023
theUnixe
Reconnaissance, or recon for short, is the process of gathering information about a target
to identify vulnerabilities and potential attack vectors.
In this article, we’ll discuss a step-by-step approach to web pen-testing recon, starting
with the sketch to more advanced techniques.
So, Whenever I start any subdomain the first thing, I do is start my passive recon. Below I
mentioned every tool/website I use.
Dig: Stands for Domain Information Groper,Dns lookup by querying name servers
and displaying the result to you!!
~#root㉿kali:
1/17
Wayback machine to view old files likes robots.txt and URLS
Tools use to automate this
waybackurls.py
Download:
https://gist.github.com/mhmdia/adf6bff70142e5091792841d4b372050
2/17
— Knockpy: —
GitHub - guelfoweb/knock: Knock Subdomain Scan
Knockpy is a portable and modular python3 tool designed to quickly
enumerate subdomains on a target domain through…
github.com
Usage: ./knockpy target.com
— Sublist3r: —
GitHub - aboul3la/Sublist3r: Fast subdomains enumeration tool for
penetration testers
Sublist3r is a python tool designed to enumerate subdomains of websites
using OSINT. It helps penetration testers and…
github.com
Usage:python sublis3r.py -d target.com -p 80 443
— SubBrute: —
GitHub - TheRook/subbrute: A DNS meta-query spider that
enumerates DNS records, and subdomains.
3/17
SubBrute is a community driven project with the goal of creating the
fastest, and most accurate subdomain enumeration…
github.com
Usage: ./subbrute.py google.com
Google Dork:
site:target.com -site www.target.com
Online Resource:
– https://dnsdumpster.com/
– https://searchdns.netcraft.com/
– https://www.virustotal.com (Go
to search and
type target.com)
– https://crt.sh/?q=%25paypal.com (Use “%target.com”. )
Don’t Stop Here!!
Find Sub-domains of Sub-doamin
!!!!!!Some website have 5th and 6th level sub-domain!!!!!
Tool: altdns (https://github.com/infosec-au/altdns)
Input : sub-domain list
Usage: ./altdns.py -i subdomains.txt -o
data_output -w words.txt -r -s output.txt
Tool: SubBrute
./subbrute.py target.com > sudomains.txt
Then
./subbrute.py –t subdomains.txt
dnsx:is a fast and multi-purpose DNS toolkit designed for running various probe
through the retryabledns libery.Usage: https://github.com/projectdiscovery/dnsx
4/17
Ffuf: iS a fast directory fuzzing tool, you can use it to enumerate more
directories in less amount of time!!
~#root㉿kali:
Now We Ha ve
5/17
WaybackURls
+
Subdomains
+
Subdomains of Subdomains
Check subdomain Validation
Tool: EyeWitnes
GitHub - FortyNorthSecurity/EyeWitness: EyeWitness is designed
to take screenshots of websites…
EyeWitness is designed to take screenshots of websites, provide some
server header info, and identify default…
github.com
provide a list of all subdomains and it will give you like a report with screenshots of all
sub-domain
Usage: ./EyeWitness.py -f subdomain.txt
Check Target IP Range
url: https://whois.arin.net
url: https://bgp.he.net/
Search by Target IP
Found Good IP Range
6/17
Real Case Study_-
Patrik Fehrenbach (@ITSecurityguard)
Wrote a Bash script to download phpinfo.php
file (if found) from Yahoo! IP range
(98.136.0.0–98.139.255.255)
Bash Script
ipa 98.13{6..9}.{0..255}.{0..255}; wget -t 1 -T 5 http:///phpinfo.php; &
Censys: is another great online tool that will give you juicy information about
your target!!
censys.io: https://censys.io/
Photon: is basically a data extraction tool which helps us find many useful
information from the websites.
Download: https://github.com/s0md3v/Photon
Usage: python3 photon.py -u target.com — keys — dns
7/17
DnsDumpster: is very similar to dig,is it provides a GUI for you to work on.
Usage: https://dnsdumpster.com/
Github Recon
What you can find on Github?
• FTP Credentials
• Secret Keys [API_key, Aws_secret key, etc.]
• Internal credentials [Employee credentials]
• API Endpoints
• Domain Patterns
Go to github and searchEg.- “target.com” “dev”- “dev.target.com”- “target.com”
API_key- “target.com” password- “api.target.com”
8/17
Google can also helpsite: “github.com” + “Target” + password
shodan: is the world’s first search engine for internet-connected devices.Explore
the Platfrom.
p Addresses.
SSL Certificates.
Services.
Favicon Hashes.
etc
9/17
Zoomeye: is another search engine and can be use to discover..
Web Servers.
IP & Ports.
Headers & Status Codes.
Vulnerabilities.
etc.
usage:https://www.zoomeye.org/
Content Discovery: —
10/17
• Google is your friend
• Use Google Dork to find:-
- File Extensions
- Parameters
- Login Page
- Sometimes
Directory Structure
- Important Stuff
• I often use Google Dork to find files with
specific extension which also reveal
technology used by Target.
-site:target.com filetype:php- site:target.com filetype:aspx- site:target.com
filetype:swf (Shockwave Flash)- site:target.com filetype:wsdl
Find Parameter
• Google Dork:
- site: target.com inurl:.php?id=
- site: target.com inurl:.php?user=
- site: target.com inurl:.php?book=
Find Login Page
• Google Dork
- site: target.com inurl:login.php
- site: target.com intext: “login”
- site: target.com inurl:portal.php
- site: target.com inurl:register.php
(Note: if site has register page, there are chancesthat site also have login page)
Find Directory Structure
• Google Dork:
-site: target.com
intext: “index of /”
11/17
Tools:
Gobuster- https://github.com/OJ/gobuster
Dirsearch- https://github.com/maurosoria/dirsearch
Feroxbuster- https://github.com/epi052/feroxbuster
paramSpider- https://github.com/devanshbatham/ParamSpider
Usage: python3 paramspider.py — domain target.com
assetfinder:https://github.com/tomnomnom/assetfinder
subzy: https://github.com/LukaSikic/subzy
Finding Hidden GET & POST Parameters!!
During Bug Bounty, I discovered some interesting parameters. Sometimes developers
“hide” parameters in GET or POST queries, and sometimes it can be interesting to try to
find these parameters and inject payloads into them.
To help me with this hunt, I use a good tool called Arjun. This python script will bruteforce
the GET and POST parameters. Try and you will see!
Download:
GitHub - s0md3v/Arjun: HTTP parameter discovery suite.
12/17
HTTP Parameter Discovery Suite Arjun can find query parameters for URL
endpoints. If you don't get what that means…
github.com
LinkFinder: is a python script written to discover endpoints and their parameters in
java Scripts files.
Download: https://github.com/GerbenJavado/LinkFinder
Usage: ./linkfinder.py -i https://target.com-o cli
Vulnerability Scanning
Nuclei: it’s extremely good and you can make your own templates in YAML and use
thousands of other templates by other hackers!!
cat subs.txt | nuclei
subs.txt | nuclei -t /nuclei-templates/<your template>
13/17
Nikto: https://github.com/sullo/nikto
TiDos: is an offensive web application framework with lots of modules.It helps in
many penetration testing task from performing recon to attacking a web
application.
Download: https://github.com/0xInfection/TIDoS-Framework
Usage: ./tidos.py
NoTe: TiDos Installation (https://www.youtube.com/watch?v=5a_GFWeovYI)
BurpSuite —
Run Spider tool on your target in Burp Suite
• Once the spider has finished right click on the host
and click “Copy Urls in this host“
14/17
Zscanner
Once copied, paste them into urls.txt• Put urls.txt file in the root of ZscannerEg.
c/xampp/htdocs/zscanner/urls.txt• Now open zscanner in browser
Click on “Begin Scanner”
/outputs/ folder:
• 4 files are outputted in the
JS-output.txt, GET-output.txt, POSTHost-
output.txt, POSTData-output.txt
• Copy JS-output.txt file and put
it in the root of
JS-Scan root folder
Eg. c/xampp/js-scan/JS-output.txt
15/17
JS-Scan
Open JS-Scan in browser
Takeaways
• Endpoints extracted from JS files are more
vulnerable then Endpoints defined in
WebPages.
• Automated Scanners generally don’t scan
Endpoints defined in JS files.
• Developers & Testers don’t care about them.
Amazon Web Services (AWS or S3 Buckets)
AWS Simple Storage Service (often shortenedto S3) is used by companies that
don’t want tobuild and maintain their own storagerepositories• By using Amazon
Simple Storage Service, theycan store objects and files on a virtual serverinstead of
on physical racks
After the user has created their bucket, theycan start storing their source
code,certificates, passwords, content, databasesand other data.
What if target is vulnerable?
You can get full access to S3 bucket• You can download, upload and overwrite files
How to find S3 Buckets?
site: amazonaws.com inurl: yahoo(Download:
Burp Suite can also Help
16/17
AWS Hacking
Open Terminal
Install awscli in kali: sudo apt-get install awscli
Interact with Bucket: aws ls s3://hackerone-attachments
Find World Writable Direcotry : aws s3 mv test.txt s3://hackerone-attachments
Thank You!!
17/17
