Penetration Testing
  • Web
    • Reconnaissance
      • Search Engine Discovery
      • Fingerprint Web Server
      • Review Webserver Metafiles
      • Enumerate Applications
      • Review Webpage Content
      • Identify Application Entry Points
      • Map Execution Paths
      • Fingerprint Web Application Framework
      • Map Application Architecture
    • Open Source Intelligence
      • Infrastructure
      • People Investigation
    • Misconfiguration
      • Network Configuration
      • App Platform Configuration
      • File Extensions Handling
      • Review Old Backup
      • Enumerate Admin Interfaces
      • HTTP Methods
      • HTTP Strict Transport Security
      • RIA Cross Domain Policy
      • File Permission
      • Subdomain Takeover
      • Cloud Storage
      • Content Security Policy
      • Path Confusion
    • Identity Management
      • Role Definitions
      • User Registration
      • Account Provisioning
      • Account Enumeration
      • Weak Username Policy
    • Broken Authentication
      • Credentials Encrypted Channel
      • Default Credentials
      • Weak Lock Out Mechanism
      • Bypassing Authentication Schema
      • Vulnerable Remember Password
      • Browser Cache Weaknesses
      • Weak Password Policy
      • Weak Security Question Answer
      • Weak Password Reset Functionalities
      • Weaker Authentication in Alternative Channel
      • Multi-Factor Authentication
    • Broken Authorization
      • Directory Traversal File Include
      • Bypassing Authorization Schema
      • Privilege Escalation
      • Insecure Direct Object References
      • OAuth Weaknesses
    • Session Management
      • Session Management Schema
      • Cookies Attributes
      • Session Fixation
      • Exposed Session Variables
      • Cross Site Request Forgery
      • Logout Functionality
      • Session Timeout
      • Session Puzzling
      • Session Hijacking
      • JSON Web Tokens
    • Input Validation
      • Reflected Cross Site Scripting
      • Stored Cross Site Scripting
      • HTTP Verb Tampering
      • HTTP Parameter Pollution
      • SQL Injection
      • LDAP Injection
      • XML Injection
      • SSI Injection
      • XPath Injection
      • IMAP SMTP Injection
      • Code Injection
      • Command Injection
      • Insecure Deserialization
      • Format String Injection
      • Incubated Vulnerability
      • HTTP Splitting Smuggling
      • HTTP Incoming Requests
      • Host Header Injection
      • Server Side Template Injection
      • Server Side Request Forgery
      • Mass Assignment
      • Regular Expression DoS
      • PHP Type Juggling
    • Error Handling
      • Improper Error Handling
      • Stack Traces
    • Weak Cryptography
      • Weak Transport Layer Security
      • Padding Oracle Attack
      • Information Unencrypted Channel
      • Weak Encryption
    • Business Logic
      • Logic Data Validation
      • Ability to Forge Requests
      • Integrity Checks
      • Process Timing
      • Race Conditions
      • Circumvention of Work Flows
      • Defenses Against Application Misuse
      • Upload of Unexpected File Types
      • Upload of Malicious Files
      • Payment Functionality
    • Client Side
      • DOM-Based Cross Site Scripting
      • JavaScript Execution
      • HTML Injection
      • Client Side URL Redirect
      • CSS Injection
      • Client Side Resource Manipulation
      • Cross Origin Resource Sharing
      • Client Side Template Injection
      • Cross Site Flashing
      • Clickjacking
      • WebSockets
      • Web Messaging
      • Browser Storage
      • Cross Site Script Inclusion
      • Reverse Tabnabbing
    • API Attacks
      • Broken Object Level Authorization
      • Broken Authentication
      • Excessive Data Exposure
      • Lack of Resources and Rate Limiting
      • Broken Function Level Authorization
      • Mass Assignment
      • Security Misconfiguration
      • Injection Attack
      • Improper Assets Management
      • Insufficient Logging and Monitoring
  • Mobile
    • Mobile App Taxonomy
    • Mobile App Security Testing
    • General
    • Android
    • iOS
  • Cloud
    • Reconnaissance
    • SaaS
    • IaaS
    • Azure
    • AWS
    • GCP
    • IBM
    • Digital Ocean
    • Kubernetes
    • CI/CD
    • Active Directory
  • Network
    • Introduction
    • Intelligence Gathering
    • Vulnerability Analysis
    • Logical Vulnerabilities
    • Exploitation of Remote Services (User-Mode)
    • Exploitation of Remote Services (Kernel-Mode)
  • Wireless
    • Page 4
  • iot
    • Page 5
Powered by GitBook
On this page
  • Check List
  • Cheat Sheet
  • Search Engine
  • Useful Website
  • Whois
  • DNS
  • IP Address
  • Maltego
  • Recon-NG
  • Metadata Extraction

Was this helpful?

  1. Web
  2. Open Source Intelligence

Infrastructure

PreviousOpen Source IntelligenceNextPeople Investigation

Last updated 4 months ago

Was this helpful?

Check List

Cheat Sheet

Search Engine

Sub Domains

site:$WEBSITE

HTTP Title

intitle:"login" |
intitle:"admin" |
intitle:"administrator"
site:$WEBSITE

URI

inurl:conf |
inurl:env |
inurl:cgi |
inurl:bin |
inurl:etc |
inurl:root |
inurl:sql |
inurl:backup |
inurl:admin |
inurl:php
site:$WEBSITE

File Types

filetype:pdf |
filetype:csv |
filetype:xls |
filetype:xlsx
site:$WEBSITE

Extensions

ext:log | 
ext:txt | 
ext:conf | 
ext:cnf | 
ext:ini | 
ext:env | 
ext:sh | 
ext:bak | 
ext:backup | 
ext:swp | 
ext:old | 
ext:~ | 
ext:git | 
ext:svn | 
ext:htpasswd | 
ext:htaccess | 
ext:json | 
ext:daf 
site:$WEBSITE

Exact Phrase

"choose file" site:$WEBSITE

Cache

cache:"$WEBSITE"

Port

port:22

Country

country:"IR"

City

city:"Tehran"

Organization

org:"United States Department"

Product

product:"Apache"

Date

product:"apache" after:"22/02/2009" before:"14/3/2010"

Service

services.service_name: "HTTP"

Country

location.country: "Iran"

TLS Cipher

services.tls.certificate.parsed.subject.common_name: "$WEBSITE"

ASN

autonomous_system.asn: 15169

Banner

services.banner: "Apache"

Port

port:80

Application

app:"Apache"

Country

country:"Iran"

IP

ip:"$TARGET"

City

city:"Tehran"

OS

os:"Windows"

Useful Website

Whois

Whois

Revers Whois

DNS

IP Address

Domain Scan

Run Machine > URL To Network And Domain Information > Fill in Input your Target > Right Click Domain > All Transforms

Create New Graph

Application Menu > New

Entity Palette > Infrastructure > Drag & Drop Domain > Enter Domain Name

Get IP Address

Right-click Domain > Run Transforms > All Transforms > [Securitytrails] DNS History Field A

DNS Records

Right-click Domain > Run Transforms > All Transforms > [WhoisXML] DNS lookup

Name Servers

Right-click Domain > Run Transforms > All Transforms > [Securitytrails] DNS History Field NS

Right-click Domain > Run Transforms > All Transforms > To DNS Name - NS

Mail Servers

Right-click Domain > Run Transforms > All Transforms > To DNS Name - MX

Whois Information

Right-click Domain > Run Transforms > Domain owner detail

Right-click Domain > Run Transforms > Domain owner detail > To Entities from WHOIS [IBM Watson]

Right-click Domain > Run Transforms > Domain owner detail > To Entities from WHOIS > To WHOIS Records [Whois XML]

Emails Related to Domain

Right-click Domain > Run Transforms > Find in Entity Properties > To E-Mail addresses [within Properties]

Right-click Domain > Run Transforms > hunter > Find Email Address [Hunter]

Subdomains

Right-click Domain > Run Transforms > All Transforms > [Securitytrails] List Subdomains

Right-click Domain > Run Transforms > All Transforms > To Subdomains (+Historical)[Shodan]

Right-click Domain > Run Transforms > All Transforms > To Subdomains(Passive DNS)[OTX]

Right-click Domain > Run Transforms > All Transforms > To Subdomains[Shodan]

Right-click Domain > Run Transforms > All Transforms > To Subdomains[VirusTotal Public API]

Phone Numbers

Right-click Domain > Run Transforms > To Phone numbers [From whois info]

Right-click Domain > Run Transforms > To Phone Numbers [using Search Engine]

Right-click Domain > Run Transforms > To Phone Numbers [within Properties]

Run Recon-ng

recon-ng

List Commands

[recon-ng][default] > help

View All Modules

[recon-ng][default] > marketplace search

Install a Module

[recon-ng][default] > marketplace install recon/domains-contacts/hunter_io

Load a Module

[recon-ng][default] > modules load hunter_io

List Module Options

[recon-ng][default][hunter_io] > options list

Set Module Options

[recon-ng][default][hunter_io] > options set SOURCE $WEBSITE

Run Module

[recon-ng][default][hunter_io] > run

List API Keys

[recon-ng][default] > keys list

Add API Key

[recon-ng][default] > keys add hunter_io 9918b4ea[...]b46a73f071

Remove API Key

[recon-ng][default] > keys remove hunter_io

Metadata Extraction

metagoofil -d $WEBSITE -t pdf,xls,xlsx,csv -l 100 -n 7 -f ~/result.html
exiftool $FILE

Application Menu > Project > New Project > Fill the Inputs > Create > Select Path for Result > Select Extensions and Search Engine > Search All

Google
Shodan
Censys
Zoomeye
Maltego
Recon-NG
Metagoofil
ExifTool
FOCA
OSINT Framework
Logocrt.sh | Certificate Search
Wayback Machine
LogoICANN Lookup
LogoICANN Lookup
https://builtwith.com/builtwith.com
LogoDetect which CMS a site is using - What CMS?
LogoWhois Lookup, Domain Availability & IP Search - DomainTools
LogoWHOIS Search, Domain Name, Website, and IP Tools - Who.is
LogoWhois API | Whois Lookup API | Domain Whois API
LogoWHOIS Domain Lookup - Find out who owns a website - GoDaddy CAGoDaddy
https://viewdns.info/reversewhois/viewdns.info
LogoReverse WHOIS API | Reverse Whois Lookup | Free Reverse Whois
LogoReverse Whois Lookup - Domain search based on email or name
LogoReverse Whoissecgron
https://dnsdumpster.com/dnsdumpster.com
Logohttp://searchdns.netcraft.com/
https://viewdns.info/viewdns.info
https://securitytrails.com/securitytrails.com