Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
Uploaded byNirmalthapa24
PPTX, PDF852 views

Recon like a pro

- The document provides an overview of reconnaissance techniques for penetration testing and bug bounty hunting. - It discusses infrastructure reconnaissance like scanning IP ranges to find domains, reverse whois lookups, and using Shodan to search for targets. - Content discovery techniques are presented like probing web ports and using wordlists to find pages and endpoints. - Additional techniques include hunting for secrets in JavaScript files, Android apps, and code sharing websites. Vhost fuzzing and recon of code repositories are also covered.

Internet◦
Download to read offline
RECON LIKE A PRO - Nirmal Thapa (@tnirmalz)
$ WHOAMI • Nirmal Thapa (mpz) • Full time Security stuffs @ Cotiviti • Part time Bug Bounty Hunter and CTF player • Acknowledged by Apple, Facebook, Google, US DoD, Instacart, Grab, AT&T, Swisscom, Zomato, Coinbase, etc
TOPICS WE’LL COVER TODAY • Infra recon (ASN, IP ranges, port scanning) • Reverse whois • Domain/Subdomain enumeration • Shodan Recon • Content discovery • VHOST Fuzzing • Hunting for secrets in android apps • Data leaks in code sharing websites (github, dockerhub, gitlab, codepen, pastebin, jsfiddle)
WHAT IS RECON? • Short for “Reconnaissance” • From google – “military observation of a region to locate an enemy or ascertain strategic features. • In pentest & bug bounties – Understanding infra of the target, how things are setup, how the app works, finding possible entry points and so on.
INFRA RECON • ASN? Autonomous System Number • Big orgs like Google, Apple have their own ASN and IP ranges • Easy for us to map our targets
Example: Apple Inc, ASN: AS714, IP range: 17.0.0.0/8
• /8 of Apple contains 16M+ IP addresses • We can divide it into smaller /24s and look for potential targets • For demo - 17.120.252.6/24 • Masscan can be used for quick port scan • masscan 17.120.252.6/24 -p 80,443 --rate 2000
Tips: 1. Scan for other web ports like 3000,5000,8000,8080,8888 etc. 2. Perform full port scan with masscan and pass the result to nmap
SCANNING SSL CERTS FROM IP RANGES • https://github.com/arbazkiraak/certasset • This tool can be used to scan IP ranges to gather more domains/subdomains • IP range -> masscan port 443 -> if open -> parse SSL certs and output hosts
REVERSE WHOIS • Whois lookup = Identify owner of a domain (gives info like owner/org name, email, phone number, name servers, etc.) • Reverse Whois lookup = Identify domains from name servers and owner’s info like org name, email etc. • https://viewdns.info/reversewhois/ • https://tools.whoisxmlapi.com/reverse-whois-search
$ whois apple.com
SHODAN RECON • Search engine for internet connected devices and systems • With right filters and queries we can find juicy hosts of our target • Some common filters: all, asn, city, country, org, ip, ssl, ssl.cert.subject.cn, http.title, http.component, etc. • https://www.shodan.io/search/filters • Examples: • Asn:AS714 • country:”US” • Org:apple • Ip: 17.188.199.148 • Ssl:apple • Ssl.cert.subject.cn:corp.apple.com • http.title:admin • .. And so on
Combining multiple filters and filtering the result
• At this point, you should have a bunch of domains and subdomains • Enumerate more subdomains with tools like amass, subfinder, findomain, knockpy • Bruteforce/Resolve with massdns/puredns/shuffledns, dnsx, etc. • When you have a list of resolved or “alive” hosts, probe for web ports 80,443 with tools like httprobe, httpx • https://github.com/projectdiscovery/httpx • https://github.com/tomnomnom/httprobe
CONTENT DISCOVERY • For effective content discovery, use curated wordlists • Understand the technology used by your target and use respective wordlist • No point bruteforcing wordpress wordlists in Django targets • https://wordlists.assetnote.io/ • https://github.com/ayoubfathi/leaky-paths
HUNTING FOR ENDPOINTS IN JS FILES • JS files are goldmines for discovering new endpoints for the target • They often contain API endpoints, URLs, hardcoded secrets, etc. • Subjs tool can be used to fetch javascript files in bulk (https://github.com/lc/subjs) • The obtained js files can now be parsed with LinkFinder (https://github.com/GerbenJavado/LinkFinder) • Gather js files from multiple subdomains with subjs -> generate wordlist with linkfinder -> sort and combine them all -> You have a target specific wordlist now
VHOST FUZZING • One server can have multiple domains associated with it • For example, ip 192.168.1.1 can host app.example.com and staging.app.example.com too • Curl http://192.168.1.1 –H “Host: app.example.com” • Curl http://192.168.1.1 –H “staging.app.example.com” • Ffuf (https://github.com/ffuf/ffuf) can be used to fuzz the host header
HUNTING FOR SECRETS IN ANDROID APPS • Decompile the apk with tools like apktool, jadx • Check files like AndroidManifest.xml, manifest.xml, strings.xml • Recursive grep for secrets and keywords like password, token, Authorization: Bearer, jwt, jwt_secret and so on.. • Easy as that!
DATA LEAKS IN CODE SHARING WEBSITES • Many developers push their internal source codes in public code sharing websites like github, gitlab • For quick testing they even use public sandbox like jsfiddle, dotnetfiddle, codepen • We can use google dorks to find these code leaks which often contains hardcoded secrets or internal URLs • Site: jsfiddle.net “corp.apple.com” • Site: dotnetfiddle.net “prod.apple.com” • Site: codepen.io “internal.apple.com”
GITHUB RECON • Check the organization page of the target • Check repos one by one and note all the users who have pushed commits to the org repos • When you have a list of users, check for keywords like password, username, secret, secret_key, jwt_key, admin, ssh, ftp, mongodb, postgres_password, docker_password etc. • More dorks and keywords: https://github.com/techgaun/github-dorks • Also look for branches of the repo and commit history • Often developers remove password from git but still it can be obtained from git commits.
THANK YOU 