# Reconnaissance and Initial Access ## Passive Enum ### whois `whois $domain -h $ip` ### Google Dorking `site`, `intext`, `inurl`, `intitle`, `filetype` [google hacking database](https://www.exploit-db.com/google-hacking-database) ### Shodan [Filter Reference](https://www.shodan.io/search/filters) [API Reference ](https://developer.shodan.io/api)(python module sucks last I used it, use requests) `http.favicon.hash` - mm3 hash of the base64 encoding of the favicon (very fun!). [Here ](https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv)are some pre-hashed ones for your enjoyment. ```python import mm3h import base64 with open('favicon.ico', 'rb') as f: h = mm3h.hash(base64.b64encode(f.read())) ``` ### Greynoise Not really Enum, to be moved [Search Cheatsheet](https://viz.greynoise.io/cheat-sheet) ### Misc Passive and Semi-passive tools [securityheaders.com](https://securityheaders.com/) and [ssltest](https://www.ssllabs.com/ssltest) [urlscan.io](https://urlscan.io) [crt.sh ](https://crt.sh/)- certificate search ## Active Enum ### ARP scanning `sudo arp-scan --interface=XXX 192.168.0.0/24` to scan that `/24` on interface XXX (usually `eth0`), you can also just use `--localnet` instead to generate the address range based on your interface configuration. `sudo net-discover -r 192.168.0.0/24` to scan that `/24` has a fancy interface vs arp-scan ### SSH Just try to `ssh`into it, if it's real old or something you can manually specify kex, cipher, host key with `-oKexAlgorithms=+{kex}`, `-c {cipher}`, and `-oHostKeyAlgorithms=+{host_key}` respectively. You might get a banner or something, not usually very useful for now. ### DNS `host` is used to go from domain name to ip, specify type with `-t` (default is A) `dnsrecon` is a python script, `-d` for domain and `-t` for recon type from the following ``` std: SOA, NS, A, AAAA, MX and SRV. rvl: Reverse lookup of a given CIDR or IP range. brt: Brute force domains and hosts using a given dictionary. srv: SRV records. axfr: Test all NS servers for a zone transfer. bing: Perform Bing search for subdomains and hosts. yand: Perform Yandex search for subdomains and hosts. crt: Perform crt.sh search for subdomains and hosts. snoop: Perform cache snooping against all NS servers for a given domain, testing all with file containing the domains, file given with -D option. tld: Remove the TLD of given domain and test against all TLDs registered in IANA. zonewalk: Perform a DNSSEC zone walk using NSEC records. ``` DNS brute force `dnsrecon -d $domain -D $list -t brt` `dnsenum` is better though, just pass it the domain like `dnsenum $domain` In :b:indows we can use `nslookup` to do the same as `host`, use `-type={TXT,MX,etc}` for other types and specify the dns server after the domain to use a specific one! IE `nslookup -type=MX $domain $dns_server` ### Port Scanning `nc` is awesome, as we all know, and you can actually do a port scan with it `nc -nvv -w 1 -z $ip $port_lower-$port_upper` `-w` is timeout, `-z` specifies zero i/o, `-nvv` is numeric IPs and extra verbosity respectively. `-u` can also be used for UDP, `-i` is delay interval Important UDP scanning detail, ICMP contol messages are used to determine port is closed so if they're filtered by a firewall closed ports will be reported as open. For :b:indows, we can use `Test-NetConnection` for port scanning, cop this ps oneliner ```powershell 1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("192.168.50.151", $_)) "TCP port $_ is open"} 2>$null ``` ### nmap nmap gets its own section because it's so important. `-sS` "stealth" SYN scan, not even remotely stealthy anymore but used to be because connections wouldn't be logged if they weren't fully established or something. `-sT` 3-way handshake connect scan, useful with "some proxies", also the default `-sU` UDP scan, uses more than the ICMP method to detect ports on a per-port basis (ie SNMP enum for 161). Can be used with other scanning methods `-sC` Default scripts `-sn` network sweep, ICMP echo, SYN to 443, TCP ACK to 80, ICMP timestamp request Outputs are `-oN/-oX/-oS/-oG : Output scan in normal, XML, s| ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.