2 - Footprinting & Recon
Last updated
Last updated
Go to https://www.netcraft.com and insert company's domain.
After that you can use a people search service as https://www.peekyou.com to find people from the target organization.
In addition there're famous tools such as:
theHarvester: this tool gathers email, subdomains, hosts, empleyee names, open ports and banners from different publicsh source (e.g. search engines, PSG key and SHODAN computer DB, Google, Bing, etc) and extract valuable information from the target domain.
Sherlock, a powerful command line tool provided by Sherlock Project, can be used to find usernames across many social networks.
Analyzing the output, if there're packets lost, we adjust the size or length of the packet, reducing -l value till to have 100% of packets sent!
Photon is a Python script used to crawl a given target URL to obtain information such as URLs (email, social media, file, secret key and subdom). The extracted info can further be exported in JSON format.
CentralOps is a free online network scanner that investigates domain and IP addresses, DNS records, traceroute, nslookup, whois searches, etc.
It allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site's relative link-structure. Simply open a page of the "mirrored" website in your browser, and you can browse the site from link to link, as if you were viewing it online.
Using Scan Rules tab we can add custom file format to select.
After downloading all, we can press Browse Mirrored Website to see website dumped.
Other Email Tracking Tools
Infoga
Mailtrack
DomainTools website permits to perform Whois lookup on a website URL.
Other Tools
SmartWhois
Batch IP Converter
Nslookup is a network administration command-line utility, generally used for querying the DNS to obtain a domain name or IP address mapping or for any other specific DNS record. The utility is available both as a command-line utility and web app.
It's possible to do nslookup to query for the IP address of given domain setting type=a and take a CNAME lookup directly against the domain's authoritative name server and lists the CNAME record for a domain.
DNS Lookup is used for finding the IP addresses for a given domain name, and the reverse DNS operation is performed to obtain the domain name of a given IP address.
Using Reverse IP Domain Check tool we can find the other domains/sites that share the same web server as our target server.
Network range info assists in creating a map of the target network.
We can use ARIN Whois db search tool to do it.
Traceroutes the network configuration information on the target domain
There's an additional online tool called SolarWinds.
Path Analyzer Pro performs network route tracing with performance test, DNS, Whois and network resolution to investigate network issues.
Network route tracing can determine the intermediate nodes traversed towards the destination and can detect the complete route (path) from source to destination.
Set Protocol -> ICMP
Target -> <Target_IP>
Port -> 65535
Time to trace -> 3 min
Stop or wait finish, and see report, synopsis log stats and others output.
If we want, there's an option to export result in .csv file format.
Recon-ng is a web reconnaissance fw with indipendent modules and db interaction that provides an environment in which open-source web-based reconnaissance can be conducted.
marketplace install all -> install all modules
modules search -> displays all modules
workspaces create -> create a new workspace
workspaces list -> list your available workspaces
db insert domains -> add a domain to the database to search
modules load brute -> view all modules related to brute forcing
Maltego is a footprinting tool used to gather maximum information for the purpose of EH, computer forensics, and pentesting. It provides a library of transforms to discover data from open sources and visualize them in a graph format.
OSINT Framework is an open-source intelligence gathering framework that helps security professionals for performing automated footprinting and reconnaissance, OSINT research and intelligence gathering.
