OSINT

OSINT (Open Source Intelligence) is crucial for any penetration test because it provides a foundation of publicly available information that helps testers understand the target environment. It can help identify potential attack vectors, vulnerabilities, and entry points without alerting the target or causing disruption. We can find domain names, IP addresses, technology stacks, exposed services, user accounts, and more.

---

Nmap

Starting with NMap Scans to find common ports, and common alternative ports. Then go into further enumeration such as findings services, versioning, etc.

• Full Scan:

sudo nmap -sS -Pn -sV --open -iL targets.txt -p- -vv --min-hostgroup 255 --initial-rtt-timeout 150ms --max-rtt-timeout 300ms --max-scan-delay 0 -oA FULL

• UDP:

sudo nmap -Pn -sU -iL targets.txt -p 1-1024,5353,1900 -vvv | grep "/open" | awk '{ print $2 }' > UDP.txt

• LDAP:

sudo nmap --open -p 389 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 389.txt

• HTTP:

sudo nmap --open -p 80 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 80.txt

• HTTPS:

sudo nmap --open -p 443 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 443.txt

• Alt HTTP:

sudo nmap --open -p 8080 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 8080.txt

• Alt HTTPS:

sudo nmap --open -p 8443 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 8443.txt

• FTP:

sudo nmap --open -p 21 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 21.txt

• SSH:

sudo nmap --open -p 22 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 22.txt

• RDP:

sudo nmap --open -p 3389 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 3389.txt

• All-in-One Scan - This takes longer

sudo nmap --open -p 389 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 389.txt && sudo nmap --open -p 80 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 80.txt && sudo nmap --open -p 8080 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 8080.txt && sudo nmap --open -p 443 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 443.txt && sudo nmap --open -p 8443 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 8443.txt && sudo nmap --open -p 21 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 21.txt && sudo nmap --open -p 22 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 22.txt && sudo nmap --open -p 3389 -iL targets.txt -oG - | grep "/open" | awk '{ print $2 }' > 3389.txt && sudo nmap -Pn -sU -iL targets.txt -p 1-1024,5353,1900 -vvv | grep "/open" | awk '{ print $2 }' > UDP.txt

---

Plugin

Identifying technologies being used on a website is important to identify versioning to then search for vulnerabilities and exploits. For this I use:

• Wappalyzer

  • Firefox Plugin

  • Chrome Plugin

---

Websites

• Shodan

• Fofa

• Web-check.xyz

• Censys

• DNSDumpster - DNSDumpster Github

• DNSTwist

Using multiple websites helps us also find other ports and services running, being sure to note down:

• A Records - Map the network and identify potential targets for scanning or exploitation.

• AAAA Records(if IPv6 infrastructure is being used)

• MX Records - Mail servers can be attack vectors.

• NS Records - Knowing authoritative DNS servers helps in DNS enumeration and potential DNS attacks.

• TXT Records.

• Subdomains - Often host different services or environments (dev, staging,etc.)

---

User Enumeration

• OneDriveUserEnum

  • Get the tenant name from AAD Internals.

  • We will need a user list, such as Statistically Likely Usernames.

sudo ./onedrive_enum.py -t tenant-name -d domain -U user-list

• DeHashed-API-Tool

  • This will need an active subscriptions AND API credits on Dehashed.

dehashapitool -d DOMAIN -o Outfile.csv

---

Enumeration

• Fast-Google-Dorks-Scan

sudo ./FGDS.sh domain

• Ffuf

  • Will need a fuzzling wordlist list, such as Seclists

sudo ffuf -recursion -mc all -ac -c -e https://domain/FUZZ -w wordlist.txt

sudo ffuf -recursion -mc all -ac -c -e .htm,.shtml,.php,.html,.js,.txt,.zip,.bak,.asp,.aspx,.xml -w wordlist.txt -u https://domain/FUZZ -fc 400,401,403,404,406,500,502 > domain.txt

• Sublist3r

sudo python3 sublist3r.py -d domain

• Nikto

sudo nikto -h URL

• Amass

sudo amass enum -d domain

• Subfinder

sudo subfinder -d domain -v

---

Wordpress Enumeration

If a site is running Wordpress, we can look at:

• [site]/wp-admin

• [site]/wp-login

• [site]/wp-json

• [site]/wp-json/wp/v2/users

• [site]/author/[user]

We can also use WPSCan, this does require an API-Token.

sudo wpscan --url URL --api-token TOKEN --enumerate vp,vt,u,tt --random-user-agent -o domain.txt

---

OWA Enumeration

If they are using OWA we can find some more information with curl

curl -v -I --http1.0 https://[ip]/owa -k -H 'Location:'

curl -v -I --http1.0 https://[ip]/owa -k -H 'HEADER:'