In This Article We gonna talk about 😎 Some cool Reconnaissance Technique that could help you find more sweaty stufs 😋
Technique 1: Active subdomain enumeration
A very common technique but a lot of researchers rely on passive subdomain enumeration rather than active subdomain enumeration. Lets talk about active subdomain enumeration:
There are 2 ways to perform Active subdomain enumeration
Brute forcing subdomains using wordlist: In this technique we use a DNS wordlist to bruteforce a particular subdomain. This can easily be done using FFuF and Best DNS Wordlist.
Command: ffuf -u “https://FUZZ.target.com" -w <path_to_wordlist> -mc 200,301,302,403
Permutation Bruteforce : In this technique we create a new resolved subdomain list from already known subdomains/domains by using permutation, mutation, and alteration with a wordlist. This can easily be done using altdns
Command: altdns -i hackerone.txt -o data_output -r -s final.txt -w words.txt
Technique 2: Favicon Hashes
Favicons are icons that serve as branding to your website. Each Favicon has some unique hash values which can be used to gather domains with the same hash function.
Favicon hashes are simple to calculate with the help of a tool called FavFreak.
Command: cat urls.txt | python3 favfreak.py
Once the hash is calculated, you can use the same on internet search engines such as shodan to get the mass websites.
More About this Tool here.
Technique 3: Nrich
A brilliant command line tool, Nrich, can be used to analyze IPs in a file for CVEs and open ports and vulnerabilities.
Note: Nrich only accepts IP address as input and not domain names . Hence the problem of finding IP addresses of hostnames can be easily solved using the tool called as dnsx.
Command: cat subdomains.txt | dnsx -a -resp-only | nrich -
Technique 4: Choosing the right target
Assume you have a medium scope application with a lot of subdomains. It is challenging to choose a subdomain and start hunting on this. No worries we have got you covered.
You can use the interestingsubs gf pattern list to find interesting subdomains you can hunt upon.
cat subdoma.txt | gf interestingsubs
Technique 5: Reverse Whoislookup
This test will return WHOIS registration results for a DOMAIN name which can be used to gather all assets belonging to an organization.
Steps :
A. Perform whoislookup on target domain and check for Tech Emails
B. Visit drs.whoisxmlapi.com and Signup/Login (Initially you will get 500 free credits )
Now Search with the Tech Email to discover all the assets belonging to target organization
Technique 6: Uncover
Uncover is a beautiful tool developed by the team Projectdisovery. Uncover allows you to quickly discover exposed hosts on the internet.
It finds hosts using shodan, censys and fofa. All you need is API Keys to be configured.
Now, Find subdomains and give them to nuclei to automate vulns, Find exposed panels, Mass hunt CVEs, and Find services. Basically, automate everything related to internet search engines.
To use this effectively, create a dorks list as shown in the below image and feed it to uncover.
Command: cat dorks.txt | uncover
Technique 7: Finding hidden paths using meg
Hidden paths or Directory bruteforcing is an important recon technique.
Meg is a powerful tool that allows you to find hidden paths/directories very quickly without flooding traffic.
Command: meg paths.txt hosts.txt output
Technique 8: Finding open ports and services
Every web application might have some other ports which are open and the services on these might be vulnerable. One should always look for these open ports and services running on them.
But this might be time-consuming. Naabu is a fast port scanner that can help you find these ports and services. The best thing of using naabu is that you can also run nmap scans in this too
Command: naabu -host target.com
Thanks You 😃 So much for Reading this Amazing Blog 📃 on Best Reconnaissance Technique