Check List
Cheat Sheet
Application Components
Web Server
Copy nmap -p 80,443 -sS -sV --mtu 5000 --script http-server-header $WEBSITE
Copy services.http.response.headers: (key: "Server" and value.headers: "*")
Copy nmap -p 80,443 -sS -sV --mtu 5000 --script http-server-header,http-enum $WEBSITE
Copy amass enum -passive -d $WEBSITE
Copy dnsenum $WEBSITE -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
Copy services.http.response.body: {"cloud", "platform", "app engine", "heroku", "azurewebsites"} Serverless
Copy nmap -sS -sV --mtu 5000 --script http-enum,http-title,http-headers $WEBSITE
Copy services.http.response.body: {"lambda", "cloud functions", "azure functions", "serverless"} Microservices
Copy nmap -sS -sV --mtu 5000 --script http-enum,http-title,http-headers $WEBSITE
Copy kube-hunter --remote $CLUSTER
Copy services.http.response.body: {"microservices", "kubernetes", "docker", "service mesh"} Static Storage
Copy nmap -sS -sV --mtu 5000 --script http-enum,http-title,http-headers $WEBSITE
Copy gcpbucketbrute -k $USER -u
Copy services.http.response.body: {"s3.amazonaws.com", "storage.googleapis.com", "blob.core.windows.net"} Enum Clouds
Extract Cloud IPv4 Ranges
Google
Copy wget -qO- https://www.gstatic.com/ipranges/cloud.json | \
jq '.prefixes[] | .ipv4Prefix' -r Amazon
Copy wget -qO- https://ip-ranges.amazonaws.com/ip-ranges.json | \
jq '.prefixes[] | .ip_prefix' -r Azure
Copy jq < /path_file/ServiceTags_Public_*.json '.values | .[] | .properties.addressPrefixes | .[]' -r Scanning Large Ranges
Amazon
Copy wget -qO- https://ip-ranges.amazonaws.com/ip-ranges.json | \
jq '.prefixes[] | if .region=="us-east-1" then .ip_prefix else empty end' -r | \
sort -u > /tmp/range-ip-output.txt
Copy masscan -iL /tmp/range-ip-output.txt -oL /tmp/range-ip-output.masscan -p 80,443 --rate 10000000 && head -25 /tmp/range-ip-output.masscan
Copy awk '/open/ {print $4}' /tmp/range-ip-output.masscan > /tmp/range-ip-output.tlsopen && head -25 /tmp/range-ip-output.tlsopen Attributing Hosts
Extract TLS IP
Copy head -1 /tmp/range-ip-output.tlsopen && export IP=$(head -1 /tmp/range-ip-output.tlsopen) OpenSSL
Copy openssl s_client -connect $IP:443 2>/dev/null | \
openssl x509 -text | \
grep Subject: TLS Scan
TLS Test
Copy echo $IP | \
tls-scan --port=443 --cacert=ca-bundle.crt -o /tmp/range-ip-output-tlsinfo.json Interpreting TLS Scan Results
Extract Subject
Copy cat /tmp/range-ip-output-tlsinfo.json | \
jq '[.ip, .certificateChain[].subjectCN] | join(",")' -r > /tmp/range-ip-output-tlsinfo.csv | \
head -2 /tmp/range-ip-output-tlsinfo.csv
Database
Copy nmap -p 3306,5432,1433,1521 \
-sS -sV --mtu 5000 \
--script db2-das-info,mysql-info,ms-sql-info,mongodb-info,oracle-tns-version $WEBSITE
Copy msfconsole -qx "
use auxiliary/scanner/mysql/mysql_version;
set RHOSTS $WEBSITE;
run;
exit"
Copy msfconsole -qx "
use auxiliary/scanner/postgres/postgres_version;
set RHOSTS $WEBSITE;
run;
exit"
Copy services.service_name: {MYSQL, POSTGRES, MSSQL} Authentication
Identifying Authentication Services Using Related Scripts
Copy nmap -sS -sV --mtu 5000 --script http-auth-finder $WEBSITE Checking SSH-Based Authentication
Copy nmap -p 22 -sS -sV --mtu 5000 --script ssh-auth-methods $WEBSITE
Copy services: (http.response.headers: (key: "WWW-Authenticate" and value.headers: *)) and services.port: 80 or services: (service_name: SSH and banner: * and port: 22) Third Party Services and APIs
Copy nmap -p 80,443 -sS -sV --mtu 5000 --script http-enum $WEBSITE
Copy wget -qO- $WEBSITE | grep -E "api|cdn|sdk"
Copy dirsearch -u $WEBSITE -e api,php,json,xml Dig
Copy amass enum -d $WEBSITE
Copy services.http.response.body: {"api", "third-party", "integration", "webhook"} Network Components
Reverse Proxy
Copy nmap -p 80,443 -sS -sV --mtu 5000 --script http-server-header,reverse-index $WEBSITE
Copy services.http.response.headers: (key: "Server" and value.headers: {"nginx", "Apache", "HAProxy"}) Load Balancer
Copy nmap -p 80,443 -sS -sV --mtu 5000 --script http-server-header $WEBSITE
Copy for i in {1..10}; do curl -I $WEBSITE; done
Copy services.http.response.headers: (key: "Server" and value.headers: {"nginx", "HAProxy", "F5", "AWS ELB"}) Content Delivery Network
Copy nmap -p 80,443
-sS -sV --mtu 5000
--script http-trace --script-args=http-trace.host=$WEBSITE $WEBSITE Dig
Copy services.http.response.headers: (key: "Server" and value.headers: {"Cloudflare", "Akamai", "Fastly", "Amazon CloudFront"}) Security Components
Network Firewall
Identifying Software-Based Firewalls
Copy nmap -sS -sV --mtu 5000 --script firewall-bypass $WEBSITE
Copy services: (port: {80, 443} and http.response.headers: (key: "Server" and value.headers: "*Firewall*")) Web Application Firewall
Copy nmap -p 80,443 -sS -sV --mtu 5000 --script http-waf-fingerprint $WEBSITE Identifying Cloud Based WAFs
Copy msfconsole -qx "use auxiliary/gather/cloud_lookup;set HOSTNAME $WEBSITE;run;exit"
Copy services.http.response.headers: (key: "Server" and value.headers: {"ModSecurity", "Cloudflare", "Imperva", "AWS WAF"}) 