Recon的一些技巧和tips

sandalwood

原文链接：Recon的一些技巧和tips

Recon的一些技巧和tips

声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任

前言

主要是Orwa在IWCON2022上面分享的

这里整理成笔记,记录如下:

子域名枚举相关

https://crt.sh/?q=%25.target.com

https://securitytrails.com/list/apex_domain/target.com

https://securitytrails.com/list/apex_domain/baidu.com

https://www.shodan.io/search?query=Ssl.cert.subject.CN%3A%22target.com%22

Ssl.cert.subject.CN:"target.com"

对于单个domain而言注意使用amass对服务器的配置是有相当的要求的,配置一般的不建议使用,否则后果自负)

amass enum -passive -norecursive -noalts –d domain .com -o sub-list.txt

Domains List:

amass enum -passive -norecursive -noalts -df domians.txt -o subs-list.txt

子域名枚举工具

https://github.com/iamthefrogy/frogy

https://github.com/Cyber-Guy1/domainCollector

https://gitlab.com/prawps/ohdns

剔除重复的子域名

cat full-subdomain-list.txt | sort -u > sub-list.txt

过滤子域名

cat sub-list.txt | httpx -o live-subs.txt

用naabu扫描端口

naabu -list sub-list.txt -top-ports 1000 -exclude-ports 80,443,21,22,25 -o ports.txt naabu -list sub-list.txt -p - -exclude-ports 80,443,21,22,25 -o ports.txt

naabu -list sub-list.txt -p - -exclude-ports 80,443,21,22,25 -o ports.txt

如何找接口

https://urlscan.io/search/#target.com

https://web.archive.org/cdx/search/cdx?url=*.target.com&fl=original&collapse=urlkey

是有搜索引擎

#Google dorking

site:target.com

#Bing dorking

site:target.com

寻找源代码和backup files

orwa.iwcon.com

orwa.iwcon.com/orwa.zip - iwcon.zip – admin.zip – backup.zip

orwa.iwcon.com/orwa/orwa.zip - iwcon.zip – admin.zip – backup.zip

orwa.iwcon.com/iwcon/orwa.zip - iwcon.zip – admin.zip – backup.zip

orwa.iwcon.com/admin/orwa.zip - iwcon.zip – admin.zip – backup.zip

用于模糊测试backup用的一个工具:

https://github.com/musana/fuzzuli

寻找更多的敏感信息

在github里面搜索:

Target.com password Target.com passwd Target.com pwd Target.com pass Target.com secret Target.com ldap

除此以外还需要关注:

gist.github.com

Gitlab.com

以上工作建议两天一次(蛮考验人的耐心的。。。)

google dorking

在谷歌上搜索PII(个人身份信息),泄露的证书等

site:docs.google.com/spreadsheets "company name“

site:groups.google.com "company name"

unauthorized access

正常情况:

• HTTP/1.1 302 Found

• Location: ../login/?redirect=//location/?5

绕过:

• HTTP/1.1 200 OK

• And Deleted Header Location: ../login/?redirect=//location/?5