banner
leaf

leaf

It is better to manage the army than to manage the people. And the enemy.
follow
substack
tg_channel
HomeArchives作品集情报公司研报钱的属性指南针计划友情链接

Ideas and Tools for Information Gathering

#情报105
AI Translation
This post is translated from Chinese into English through AI.View Original
AI-generated summary
The document outlines strategies and tools for information gathering, particularly in the context of penetration testing. The overall approach involves collecting data on subdomains, IP addresses, and ports, followed by asset identification and fingerprinting. It emphasizes the importance of gathering internal network information without immediately using scanning tools, suggesting an examination of network interfaces, command history, and other system information on compromised machines. Various tools for automated information collection are listed, including Water Margin, SRC, ARL, Goby, Xray, Nuclei, and fscan. Additionally, resources for company asset collection and subdomain enumeration are provided, such as Tianyancha and various online services. The document also discusses methods for identifying CDN usage and bypassing it to obtain the real IP address of a target. Techniques include querying subdomain IPs, checking historical DNS records, and using foreign hosts to probe for real IPs. Finally, it mentions the potential to extract real IP addresses from email communications.

Ideas and Tools for Information Gathering#

==========

IMG_20250304_110756

  • Reference Links:

  • Overall Approach:

    • Subdomain -> IP -> Full Ports -> http, https -> Asset Acquisition -> Fingerprinting
    • Mini Programs, Official Accounts, APPs
    • Non-web assets identified through port recognition -> such as databases: first conduct bulk weak password detection, then construct a dictionary for brute force based on the obtained information

  • Internal Network Information Gathering Approach (Do not start with fscan scanning)

    • First, check the network card information, history command history, netstat port information, arp table, ps processes, configuration files, etc., on the compromised machine to gather information about other internal network segments connected to the controlled machine.
    • Check domain information in threat intelligence communities like Weibu Online.
      • If there is no resolved IP, it may be a domain accessible only from the internal network; try ping the domain on the controlled machine to get the internal network address.
      • If there is an internet-resolved IP, you can also try ping the domain on the controlled machine to get the internal network address.
    • Sometimes, there are redirects to internal systems on websites from the internet, such as OA systems, unified identity authentication systems; clicking may redirect to the internal network, thus obtaining internal address information.
    • Successful exploitation through certain vulnerabilities -> for example, Fanwei -> check the Fanwei configuration files, such as database configuration files; the database system may be on another internal network server, thus confirming the existence of the internal network.
    • More techniques can be found in this article: How to Determine the Existence of an Internal Network

Comprehensive Use of Tools#

Company Name Asset Collection#

Subdomain Collection#

CDN#

CDN Judgment#

image

  • Use nslookup to resolve the domain to determine
    • If the Name field points to something like cname.vercel-dns.com, it indicates the use of CDN technology.
    • 🌰 www.baidu.com, where the Address field points to two different IPs, indicating that www.baidu.com may be using CDN.

image

Bypassing CDN to Obtain Real IP#

  • Resolve subdomain IP

    • Using CDN costs money, so many websites only apply CDN acceleration to the main site, while subdomains may not have it. Subdomains may be on the same server or the same C-class network as the main site, so querying the IP information of the subdomain can help determine the real IP information of the main site.

  • Query historical DNS records

  • Use foreign hosts to request the domain

    • Some domestic CDN acceleration service providers only apply CDN acceleration to domestic lines, but not to foreign lines. Thus, real IP information can be detected through foreign hosts. You can use your own foreign host or select foreign detection nodes from Global Ping Test to determine real IP information.

  • Email Information

    • Email systems are generally internal and not resolved through CDN. By utilizing the target website's email registration, password recovery, or RSS subscription functionalities to send emails, you can view the source of the received reply email to obtain the target's real IP.
    • Image from mathwizard

image

  • Information Leakage

    • Utilize sensitive information and files exposed through information leakage (e.g., phpinfo pages, website source code (backup) files, information leaked on GitHub, etc.) to obtain real IP information.
      • The SERVER_ADDR field of the phpinfo page will display the real IP of the host.

  • Target Website APP Application

    • If the target website has its own App, you can try using traffic capture tools like Burp Suite to capture requests from the App, which may reveal the target's real IP.

IP Reverse Lookup Domain (Side Station Query)#

Fingerprinting#

JS and Interface Information#

APP#

Email Collection#

WAF Identification#

Sensitive Information#

Cloud Storage Engine#

Google Hack Syntax#

  • Backend Address
    • site.com intitle: management | backend | login | administrator | system | internal
    • site.com inurl|admin|system|guanli|denglu|manage|admin_login|auth|dev
  • Sensitive Files
    • site.com (filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR --filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype OR filetype)
  • Testing Environment
    • site.com inurl|ceshi
    • site.com intitle: Test
  • Email
    • site.com (intitle:"Outlook Web App" OR intitle:"Email" OR inurl:"email" OR inurl:"webmail")
  • Others
    • site.com inurl|uid=|id=|userid=|token|session
    • site.com intitle.of "server at"
  • Google Syntax Generator

Information Gathering for Penetration Testing#

*   Information Gathering for Penetration Testing
*    Open Source Intelligence Information Gathering (OSINT)
*    github
*     whois query / registrant reverse lookup / email reverse lookup / related assets
*     google hacking
*     Create Company Password Dictionary
*       Subdomain Acquisition
*     Dictionary List
*     Email List Acquisition
*      Leaked Password Query
*    Collect external information related to the company Open Source Intelligence Information Gathering (OSINT)
*     github
*    Github_Nuggests (automatically crawls sensitive information leaks on Github): https://github.com/az0ne/Github_Nuggests
*    GSIL (can achieve near real-time (within 15 minutes) discovery of leaked information on Github): https://github.com/FeeiCN/GSIL
*    x-patrol (Xiaomi team's): https://github.com/MiSecurity/x-patrol  whois query / registrant reverse lookup / email reverse lookup / related assets  
*   Webmaster Home: http://whois.chinaz.com/?DomainName=target.com&ws=
*   Aizhan: https://whois.aizhan.com/target.com/
*   Weibu Online: https://x.threatbook.cn/
*  IP Reverse Lookup: https://dns.aizhan.com/
*  Tianyancha: https://www.tianyancha.com/
*   Huma Check: http://www.whomx.com/
*  Historical Vulnerability Query:
*   Online Query: http://wy.zone.ci/
*   Self-built: https://github.com/hanc00l/wooyun_publi/  google hacking
* Create Company Password Dictionary  Dictionary List   passwordlist: https://github.com/lavalamp-/password-lists

 Domain Transfer Vulnerability Linux dig @ns.example.com example=.com AXFR Windows nslookup -type=ns xxx.yyy.cn #Query the DNS server for a certain domain name nslookup #Enter nslookup interactive mode server dns.domian.com #Specify DNS server ls xxx.yyy.cn #List domain information

Github#

  • @xxx.com password/secret/credentials/token/config/pass/login/ftp/ssh/pwd
  • @xxx.com security_credentials/connetionstring/JDBC/ssh2_auth_password/send_keys
Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.