Information Gathering (Reconnaissance) – Practical Ethical Hacking by TCM

by Kal Bartal

Passive Reconnaissance Overview

Physical / Social Recon

Location Information

  • Satellite images
  • Drone recon
  • Building layout (badge readers, break areas, security, fencing)

Job Information

  • Employees (name, job title, phone number, manager, etc.)
  • Pictures (badge photos, desk photos, computer photos, etc.)

Web / Host

  • Target Validation (WHOIS, nslookup, dnsrecon)
  • Finding Subdomains (Google Fu, dig, Nmap, Sublist3r, Bluto, crt.sh, etc.)
  • Fingerprinting (Nmap, Wappalyzer, WhatWeb, NuiltWith, Netcat)
  • Data Breaches (HaveIBeenPwned, Breach-Parse, WeLeakInfo)

Identifying our Target

https://bugcrowd.com/programs

Discovering Email Addresses

https://hunter.io

https://phonebook.cz

https://www.voilanorbert.com

https://connect.clearbit.com

https://www.emailhippo.com

https://email-checker.net

A typical search would be:

  1. Google search person/company
  2. phonebook.cz or hunter.io to identify the format of the email address
  3. optional Clearbit search
  4. verify email address at email Hippo or Email Checker

Gathering Breached Credentials with Breach-Parse

https://github.com/hmaverickadams/breach-parse

Hunting Breached Credentials with DeHashed

https://www.dehashed.com

https://hashes.com/en/decrypt/hash

Hunting Subdomains

sublist3r

Use “-t” switch for threading. (faster results)

sublist3r -d tesla.com -t 100

crt.sh

crt.sh uses Certificate Fingerprinting
”%” is the wildcard on crt.sh

We are typically looking for subdomains as:
webmail
xmail
stg
test
qa
vpn
dev
api
sso (single sign on)

ctr.sh can go to deeper levels of subdomains. (below level3)

OWASP Amass
OWASP is a more comprehensive tool but it takes a long time to run. OWASP Amass is the go-to tool for bug bounty hunting.

https://github.com/OWASP/Amass

tomnomnom httprobe
It probes/validates a list of subdomains.

https://github.com/tomnomnom/httprobe

Identifying Website Technologies

https://builtwith.com

Wappalyzer extension

whatweb

Information Gathering with Burp Suite

Burp Suite is a web proxy and it has the capability to intercept web traffic.

1, Set manual proxy to 127.0.0.1 on port 8080

2, Download CA Certificate at https://burp

3, View and import certificate

4, Click proxy in Burp Suite (to intercept requests)

5, Turn intercept off and click target to view request and response.

Google Fu

https://ahrefs.com/blog/google-advanced-search-operators

site:tesla.com – items only from the specified domain
site:tesla.com -www – as above but without the www subdomain
site:tesla.com filetype:docx – as above + with specific file type

Utilising Social Media

Social media images can reveal employee names, various props and badges.

Related Posts

14 comments

Mike Taft July 27, 2022 - 6:05 am

Hello

We all know the importance that dofollow link have on any website`s ranks.
Having most of your linkbase filled with nofollow ones is of no good for your ranks and SEO metrics.

Buy quality dofollow links from us, that will impact your ranks in a positive way
https://www.digital-x-press.com/product/150-dofollow-backlinks/

Best regards
Mike Taft

support@digital-x-press.com

Reply
ErnestfeT July 30, 2022 - 6:52 am

Hello! kalbartal.net

We present

Sending your message through the feedback form which can be found on the sites in the contact partition. Contact form are filled in by our software and the captcha is solved. The advantage of this method is that messages sent through feedback forms are whitelisted. This method increases the chances that your message will be read.

Our database contains more than 27 million sites around the world to which we can send your message.

The cost of one million messages 49 USD

FREE TEST mailing Up to 50,000 messages.

This letter is created automatically. Use our contacts for communication.

Contact us.
Telegram – @FeedbackMessages
Skype live:contactform_18
WhatsApp – +375259112693
We only use chat.

Reply
Mike Forster August 2, 2022 - 9:28 am

Hi there

Do you want a quick boost in ranks and sales for your website?
Having a high DA score, always helps

Get your kalbartal.net to have a DA between 50 to 60 points in Moz with us today and reap the benefits of such a great feat.

See our offers here:
https://www.monkeydigital.co/product/moz-da50-seo-plan/

On SALE:
https://www.monkeydigital.co/product/ahrefs-dr60/

Thank you
Mike Forster

Reply
Mike Derrick August 2, 2022 - 4:27 pm

Hi

This is Mike Derrick

Let me introduce to you our latest research results from our constant SEO feedbacks that we have from our plans:

https://www.strictlydigital.net/product/semrush-backlinks/

The new Semrush Backlinks, which will make your kalbartal.net SEO trend have an immediate push.
The method is actually very simple, we are building links from domains that have a high number of keywords ranking for them. 

Forget about the SEO metrics or any other factors that so many tools try to teach you that is good. The most valuable link is the one that comes from a website that has a healthy trend and lots of ranking keywords.
We thought about that, so we have built this plan for you

Check in detail here:
https://www.strictlydigital.net/product/semrush-backlinks/

Cheap and effective

Try it anytime soon

Regards

Mike Derrick

mike@strictlydigital.net

Reply
Duncan Smith August 3, 2022 - 5:06 pm

Dear Sir/Madam

You can only achieve financial freedom when you create multiple streams of income.

I have an investment portfolio that will benefit both of us and I hope it will be appealing to you.

If interested contact me for more information via my E-mail: duncansmith280@gmail.com

I look forward to your quick reply.

Regards
Duncan Smith

Reply
Mike Galbraith August 11, 2022 - 10:17 am

Hi there

If you have a local business and want to rank it on google maps in a specific area then this service is for you.

Google Map Stacking is one of the best ways to rank your GMB in a specific mile radius.

More info:
https://www.speed-seo.net/product/google-maps-pointers/

PS: Want an all in one Local Plan that includes everything?
https://www.speed-seo.net/product/local-seo-package/

Reply
Mike Howard August 15, 2022 - 8:06 pm

Greetings

I have just took a look on your SEO for kalbartal.net for its SEO metrics and saw that your website could use a boost.

We will enhance your SEO metrics and ranks organically and safely, using only whitehat methods, while providing monthly reports and outstanding support.

Please check our services below, we offer SEO at cheap rates.
https://www.hilkom-digital.de/cheap-seo-packages/

Start enhancing your sales and leads with us, today!

regards
Mike Howard

Hilkom Digital Team
support@hilkom-digital.de

Reply
Mike Chapman August 24, 2022 - 8:57 am

Hello

We all know the importance that dofollow link have on any website`s ranks.
Having most of your linkbase filled with nofollow ones is of no good for your ranks and SEO metrics.

Buy quality dofollow links from us, that will impact your ranks in a positive way
https://www.digital-x-press.com/product/150-dofollow-backlinks/

Best regards
Mike Chapman

support@digital-x-press.com

Reply
Mike Gerald August 30, 2022 - 3:33 pm

Good Day

This is Mike Gerald

Let me present you our latest research results from our constant SEO feedbacks that we have from our plans:

https://www.strictlydigital.net/product/semrush-backlinks/

The new Semrush Backlinks, which will make your kalbartal.net SEO trend have an immediate push.
The method is actually very simple, we are building links from domains that have a high number of keywords ranking for them. 

Forget about the SEO metrics or any other factors that so many tools try to teach you that is good. The most valuable link is the one that comes from a website that has a healthy trend and lots of ranking keywords.
We thought about that, so we have built this plan for you

Check in detail here:
https://www.strictlydigital.net/product/semrush-backlinks/

Cheap and effective

Try it anytime soon

Regards

Mike Gerald

mike@strictlydigital.net

Reply
Mike Kennedy August 31, 2022 - 8:43 pm

Hi there

Do you want a quick boost in ranks and sales for your website?
Having a high DA score, always helps

Get your kalbartal.net to have a DA between 50 to 60 points in Moz with us today and reap the benefits of such a great feat.

See our offers here:
https://www.monkeydigital.co/product/moz-da50-seo-plan/

On SALE:
https://www.monkeydigital.co/product/ahrefs-dr60/

Thank you
Mike Kennedy

Reply
Mike Kennedy September 7, 2022 - 11:13 am

Hi there

If you have a local business and want to rank it on google maps in a specific area then this service is for you.

Google Map Stacking is one of the best ways to rank your GMB in a specific mile radius.

More info:
https://www.speed-seo.net/product/google-maps-pointers/

PS: Want an all in one Local Plan that includes everything?
https://www.speed-seo.net/product/local-seo-package/

Reply
Mike Baker September 15, 2022 - 7:35 pm

Good Day

I have just took a look on your SEO for kalbartal.net for its SEO Trend and saw that your website could use a push.

We will improve your SEO metrics and ranks organically and safely, using only whitehat methods, while providing monthly reports and outstanding support.

Please check our plans here, we offer SEO at cheap rates.
https://www.hilkom-digital.de/cheap-seo-packages/

Start increasing your sales and leads with us, today!

regards
Mike Baker

Hilkom Digital Team
support@hilkom-digital.de

Reply
Mike Young September 24, 2022 - 6:48 am

Hello

We all know the importance that dofollow link have on any website`s ranks.
Having most of your linkbase filled with nofollow ones is of no good for your ranks and SEO metrics.

Buy quality dofollow links from us, that will impact your ranks in a positive way
https://www.digital-x-press.com/product/150-dofollow-backlinks/

Best regards
Mike Young

support@digital-x-press.com

Reply
Mike Clapton September 29, 2022 - 6:54 pm

Hi there

Do you want a quick boost in ranks and sales for your website?
Having a high DA score, always helps

Get your kalbartal.net to have a DA between 50 to 60 points in Moz with us today and reap the benefits of such a great feat.

See our offers here:
https://www.monkeydigital.co/product/moz-da50-seo-plan/

On SALE:
https://www.monkeydigital.co/product/ahrefs-dr60/

Thank you
Mike Clapton

Reply

Leave a Comment