Art of Reconnaissance

Hello, my name is Rupali, and I’m excited to share my first blog on reconnaissance. Reconnaissance or recon, is the starting point in cybersecurity. It’s all about gathering information about a target to understand its strengths and weaknesses. In this blog, we’ll cover the basics of recon, exploring simple techniques and tools that can help you get started. Whether you’re new to cybersecurity or just looking to brush up on the basics, this guide will help you understand the importance of recon and how to do it effectively. Let’s dive in!

So first of all let’s see the mind map of this blog. Then after that we will see in detail.

• Subdomain Enumeration
• GitHub and Shodan Searching
• History of target
• Find all URLs of the target
• Find Endpoints from .js files
• Find sensitive and hidden directory

Let’s start exploring these points

Subdomain Enumeration

Subdomain enumeration is a critical technique in reconnaissance, used to discover subdomains associated with a primary domain. These subdomains can reveal additional attack surfaces and potentially sensitive information about the target. By identifying these subdomains, security professionals can better understand the scope of the target’s network and locate potential vulnerabilities.

Tools And Search Engines

• VirusTotal
• Subfinder
• Knock
• Dome
• Google Dorking

Now let’s see these tools in brief with an example

VirusTotal: VirusTotal is a valuable tool not only for malware analysis but also for subdomain enumeration. By leveraging VirusTotal’s extensive database, you can uncover subdomains associated with a target domain. I’m taking webappsecurity.com as an example.

Methods That I followed to get Subdomains.

• Firstly go to the URL https://www.virustotal.com/gui/home/url
• Then go to the URL tab, put the parent domain in the search box, and hit enter.

• Then Click on the domain name as shown below.

• After that go to the Relations tab.
• Then you get the subdomains as given below.

Subfinder: Subfinder is an efficient and fast tool designed for subdomain discovery, widely used in cybersecurity for tasks such as penetration testing and bug bounty hunting. It specializes in passive reconnaissance, meaning it gathers subdomain information without directly interacting with the target domain. Instead, Subfinder collects data from numerous public sources like search engines, DNS databases, and certificate transparency logs.

Command given below

subfinder -d target.com

Knock: Knock is an open-source subdomain enumeration tool designed to help security researchers and penetration testers discover subdomains associated with a target domain. Written in Python, Knock automates the process of querying various sources and utilizing dictionary attacks to uncover hidden or less obvious subdomains that could potentially be exploited during security assessments.

Command given below

 python knockpy.py target.com

Note: I am also using my own wordlist which has more subdomains as compared to Knock’s default wordlist. And command for wordlist given below.

python knockpy.py target.com -w sub1.txt

Dome: Dome is a subdomain enumeration tool that focuses on identifying and mapping subdomains for security assessments. It is designed to aid cybersecurity professionals in discovering subdomains that might not be immediately visible through standard reconnaissance methods.

I am using dome for my biggest subdomain wordlist it takes time in brute force the subdomains.

Command given below

python dome.py -d target.com -m active -w .\wordlists\sub2.txt

Google Dorking: Google Dorking for Subdomain Enumeration involves leveraging advanced search operators in Google to uncover subdomains associated with a specific domain. By using the site: operator with a wildcard (*), you can search for subdomains indexed by Google. This technique helps in discovering subdomains that might be exposed unintentionally, such as admin portals, development environments, or specific file types hosted on subdomains. While effective, it’s important to note that Google Dorking only reveals what has been indexed by Google and may not uncover all subdomains.

How to use

site:*.target.com

site:*.test.target.com

GitHub and Shodan Searching

GitHub Reconnaissance

GitHub Recon, or GitHub reconnaissance, refers to the process of gathering information from GitHub repositories, accounts, and activity to identify sensitive data, credentials, or other valuable information that might be exposed inadvertently. This technique is particularly useful in cybersecurity for understanding an organization’s or individual’s code practices, identifying security weaknesses, and discovering sensitive information like API keys or passwords that may have been accidentally committed.

Get Rupalisunhare’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

How to use

• First, we need to search like “target.com”
• Then sort and extract the data like “target.com” username:

• Now we got some usernames and passwords and when I was checking all of them so I got the correct username and password.

• Then I Checked by login with these credentials it logged in me.

Shodan Recon

Shodan is a database of billions of publicly available IP addresses. Users can perform a search using the Shodan search engine based on an IP address, device name, city, and a variety of other technical categories. Shodan attempts to grab the system’s banner directly, gathering the data by way of the associated server’s ports. So in simple words, if you search on Google then Google will show limited things to the target and if you search on Shodan then Shodan will show you everything, that information will also not be available on Google.

How can we use

• First, I searched like “target.com”, but it did not give anything so I tried some Shodan dorks.
• Then I searched like ssl:”target.com”

ssl for checking the common name

• After that, I clicked on the IP. And I got some open ports, some CVEs, and some other information.

Note: I also use this dork — Ssl.cert.subject.CN:

History of target

To get the history of the target I use Wayback Machine — The Wayback Machine is a digital archive of the World Wide Web, created by the Internet Archive. It allows users to view historical snapshots of web pages, including past versions of websites. This can be useful for a variety of purposes, including web research, retrieving lost content, and reconnaissance in cybersecurity.

Now let’s see How I use it

• Search the whole URL in search box like http://www.target.com

• Scroll the year calendar bar and check the first one when the site was build.

With this tool, we are able to see the history of the target like the webpage, UI, Versions, old directories, etc. As shown in the above image.

Find all URLs of the target

In this, we automate finding the directories and parameters that are hidden and easily available on the target for save time. For this many tools are available but I will explain the tools that I use.

Tools

• Waybackurl
• Gospider

Waybackurl

WaybackURL is a straightforward tool for checking if a specific URL is archived in the Wayback Machine. By simply entering the URL into the WaybackURL search field, you can quickly determine whether the URL has historical snapshots available. This tool provides a direct link to any archived versions if they exist, streamlining the process of retrieving and reviewing past versions of web pages without manually navigating through the Wayback Machine. It’s a convenient way to access historical data for web pages efficiently.

waybackurl target.com

Gospider

Gospider is an open-source web crawling tool written in Go that helps in discovering and enumerating URLs on websites. It efficiently crawls a site to collect information about its structure, including links, directories, and files. Gospider supports various features such as depth control, rate limiting, and customizable user agents, making it a versatile tool for web reconnaissance and security assessments. It’s particularly useful for mapping out websites and gathering data for further analysis.

gospider -s "http://www.target.com" -d 5 -a

-d 5 for  MaxDepth limits the recursion depth of visited URLs. (Set it to 0 for infinite recursion) (default 1)

-a for Find URLs from 3rd party (Archive.org, CommonCrawl.org, VirusTotal.com)

Find Endpoints from .js files

After that, I find the target’s endpoints and .js files. Many times the file is very useful for hackers because from the file we can find out what is the behavior of the webpage. What are the parameters that are not showing normally and what will be his response. So this allows important to find the endpoints and .js file. So it is important to find the endpoints and .js file. Tool for finding it.

Linkfinder

LinkFinder is a Python-based tool designed for discovering and extracting URLs and links from web pages and web application source code. It is commonly used in security assessments and web scraping to identify potential endpoints, hidden resources, and application vulnerabilities. LinkFinder scans the HTML, JavaScript, and other content of web pages to locate URLs and links, which can then be analyzed for further investigation or enumeration. Its flexibility and ease of use make it a valuable tool for reconnaissance and vulnerability research.

python3 linkfinder.py -o cli -i <target url>

Find sensitive and hidden directory

And last but not least, finding sensitive and hidden directories. In this we are perform brute force to get those directories which are no available for for normal users. For this I use four tools, three of which require a wordlist and one has its own wordlist. Tools are

• Dirsearch
• FFUF

Let’s move on the tools

Dirsearch

Dirsearch is a popular open-source tool used for directory and file enumeration on web servers. Written in Python, it performs brute-force scanning to discover hidden directories, files, and paths within a web application. Dirsearch is commonly used in security assessments and penetration testing to identify potential entry points or sensitive files that could be exploited.

dirsearch -u http://www.target.com -t 5

-t for threads

FFUF

ffuf (Fuzz Faster U Fool) is a fast and versatile tool for web fuzzing and directory enumeration. It helps security professionals and researchers discover hidden directories, files, and endpoints on web servers by performing brute-force attacks with customizable wordlists. ffuf supports various HTTP methods and advanced filtering options, allowing users to refine their search based on status codes, response sizes, or patterns. Its speed and flexibility make it a valuable tool for uncovering potentially vulnerable or obscure resources in web applications.

 ffuf -w .\common.txt -u http://www.target.com/FUZZ -r -c -v -mc all -t 10 -fw 44

So that’s a wrap on my blog about reconnaissance. I’ve covered the essential techniques and tools that I’ve learned so far, and I hope this guide provides valuable insights for those new to the field. As I continue to expand my knowledge, I’ll be sure to share more updates and tips with you.

Thank you for taking the time to read my blog. Don’t forget to follow me on Medium and LinkedIn for more update.

rupalisunhare — linkedIn account

Be a Cyber Guardian—Hack Responsibly