Video Summary
Start by identifying root domains, acquisitions, and ASNs to expand scope and find seed domains.
Use massenum/masscan and subfinder for large-scale subdomain discovery; verify live hosts with http-probe.
Leverage Burp Suite (JS discovery, crawler, extensions) to parse JavaScript and collect additional endpoints.
Port-scan with dnmass/masscan then run nmap for full service enumeration; automate screenshots with Eyewitness.
Use Nuclei templates for subdomain takeover and CVE checks; write custom templates for tailored recon checks.
He used Office Depot, focusing on a semi-public responsible disclosure program scoped to www.officedepot.com. It's notable because the program accepts high-severity reports (P1/P2) but isn't heavily advertised, making it a 'hidden bounty' opportunity.
Identify root domains, research acquisitions (e.g., via Crunchbase) to find legacy domains, and enumerate ASNs (using bgp.he.net) to gather the organization's IP ranges as seeds for broader discovery.
Jason demonstrates massenum/masscan and subfinder for enumeration, uses http-probe to filter live web hosts, and supplements findings with GitHub searches, favicon hashing (Shodan), and Burp JS Link Finder to extract JavaScript-linked endpoints.
Filter for live hosts, take automated screenshots (Eyewitness) to visually triage pages, prioritize custom or outdated-looking apps for manual testing, then run targeted scans (Nuclei, fuzzing, API checks) on high-value assets.
Use Nuclei templates (including community takeover templates) to check for takeover vectors and Burp extensions like Bounty to add custom active scans. For blind XSS, integrate XSS Hunter payloads into Burp scans to detect out-of-band callbacks.
"Today we’re going to track a new project I’ve never demoed before at any of my workshops."
"Today’s target is Office Depot, which runs a responsible disclosure program that is scoped to www.officedepot.com."
"The first thing in our methodology is to identify our root domains."
"We want to run tooling on them to see what other seed domains we can get out of these ranges."
"Masscan is a tool to do reconnaissance on domains."
"The larger we build this scope, the better it will be for us."
The process begins with the identification of Default Credentials vulnerabilities in various services, which can help in the initial stages of reconnaissance.
Building a larger scope for the target is essential as it allows for a more thorough investigation and identification of potential weaknesses.
The speaker emphasizes the importance of enumerating the Autonomous System Numbers (ASN) and suggests that this step is vital in the reconnaissance phase.
"Reverse WHOIS is a medium fidelity technique that might yield valuable information, albeit requiring significant manual effort."
The speaker transitions to using Waxy.com for Reverse WHOIS data aggregation, which provides a detailed view of domain registration information linked to a specific company, in this case, Office Depot.
They describe a method of searching for domains registered under a company’s name and highlight that this technique may reveal parked domains, potentially useful for further research.
While this method requires careful analysis to filter out irrelevant results, it can lead to discovering seed domains that the target may own.
"By examining ad and analytics trackers, you can correlate them to other sites for discovering new seed domains and subdomains linked to your main target."
The speaker introducesBuiltWith.com, a platform that provides technology data and a relationship profile of websites based on their analytics and ad tracker usage.
By accessing the relationship profile, users can identify other websites that share the same tracking codes, hinting at ownership or operational links to the main target.
This method of relationship mapping helps in identifying potentially valuable subdomains associated with the target, broadening the scope of the investigation.
"You can automate some of these processes, but for demonstration purposes, we are only briefly covering each technique."
The speaker notes that while various automated tools can assist in the processes discussed, the emphasis in the training is on understanding the methods rather than fully automating them for speed.
Additional domain and subdomain enumeration strategies are mentioned as the session progresses, focusing on discovering valuable information that could aid in the overall objective of penetration testing.
Time management is prioritized during the demonstration, allowing for an overview of multiple techniques rather than exhaustive detail on each one.
"JavaScript discovery is the first part of subdomain enumeration."
The process begins with using LinkedIn JavaScript discovery, which serves as a way to gather seeds for subdomain enumeration.
Burp Suite is introduced as the tool of choice for this workflow. The presenter mentions using both versions 1.7 and 2.0 but prefers version 1.7 due to familiarity.
However, for this demonstration, version 2.0 is selected despite some reservations about its updated scanning engine and crawling capabilities.
"The first thing we want to do is set a scope item here."
The initial task involves configuring Burp to set specific scope items by allowing advanced scope control. This enables the user to input terms more generally rather than using fully qualified domain names.
The presenter chooses to add "office" as a general term to capture related content while still retaining data outside of this scope.
The user interface is shown to display only items within this defined scope as the crawling process begins, with an intention to crawl through newly discovered subdomains.
"In the scan configuration for 2.0, I want the fastest crawler strategy."
The user navigates to the scan configuration settings in Burp and opts for the fastest crawling strategy while ensuring the crawler doesn't stop due to application errors.
Resource pooling is adjusted, initially set to 100 but ultimately limited to 50 to avoid disrupting the live stream.
As the crawling commences, more subdomains are discovered, and the dashboard provides a visual representation of the crawling progress.
"I use a couple of extensions; I prefer Flow."
The presenter discusses the use of extensions in Burp, emphasizing tools like Flow, which logs events or changes within Burp and streamlines the user experience.
Another extension highlighted is the error extension, which alerts the user to certain errors encountered across various technologies, such as PHP, Perl, Java, and ASP.NET.
Burp JS Link Finder is also mentioned, designed to parse JavaScript files from the crawl, extract links, and present them in a list, though the export process is described as cumbersome.
"Vulners is a pretty sweet plugin with a whole bunch of built-in vulnerability checks."
The speaker mentions the importance of the Vulners plugin, which performs checks against URLs to identify potential vulnerabilities based on the responses received from visited links.
This leads to a demonstration involving another site, Twitch, where similar methodologies apply to gather a broader scope of links and identify vulnerabilities.
The tediousness of getting all findings correctly aggregated for further analysis is acknowledged, particularly when dealing with the need to discover new paths during the crawl.
"There's a lot of manual tweaking in the first four steps that I might have to do."
There is mention of the user’s preference for manual exploration during the initial phases of a project, conducting subdomain enumeration manually until enough useful seeds are gathered for automation.
The importance of accurately tweaking scope rules in Burp is emphasized to eliminate the risks of scanning unintended domains.
Some suggested tools for automating the discovery of JavaScript files and subsequent analysis are also noted, underscoring the blend of manual and automated methods in the vulnerability assessment process.
"Subdomain scraping is the next section. I'm pretty sure you already know some of these tools, so we're going to go over them quickly."
Jason begins by discussing the tools used for subdomain enumeration, highlighting that both Masscan and Subfinder are essential for the task.
He introduces "massenum" as the first tool to utilize, explaining that it will run on a list of routes for a target domain, such as officedepot.com.
The tool queries multiple sources like Census, Robtex, Wayback Machine, Netcraft, Security Trails, Cert DB, and SSL Spotter to fetch references for subdomains associated with the target.
As Massenum runs, he checks the output to ensure viewers can see the text, indicating the tool is actively finding multiple subdomains.
"We're starting to pull down subdomains for this target, and as we get these, we will dump them in our mind map."
Jason emphasizes the importance of both manual and automatic approaches in subdomain enumeration.
He explains how he manually captures subdomains while utilizing Subfinder and other command-line tools that provide similar functionality.
Jason shares insights on a custom script he developed, referred to as "Hunter," which automates the tool utilization process, significantly speeding up subdomain enumeration.
As the subdomain enumeration unfolds, he multitasks by visiting GitHub to search for vulnerable files, including passwords and configuration files while waiting for the results from Massenum.
"The reason I'm not using a tool that does GitHub analysis automatically is that I want to find a general search across all GitHub."
Jason explains his strategy for leveraging GitHub to look for leaked information rather than using automated tools that focus on specific organizations.
He seeks out instances where developers inadvertently sync sensitive information, such as bash profiles or public source codes, on GitHub.
As he conducts manual searches, he monitors results for passwords and sensitive configurations, discussing how filtering by language or indexing date helps in locating relevant data.
Jason mentions his typical investment of time in GitHub reconnaissance, indicating he evaluates based on the likelihood of information leaks depending on the organization’s size and presence.
"We're now parsing our subdomains to gather essential data for the next steps."
The process begins with identifying all subdomains from the source code of a target website, which is crucial for further analysis.
The automation involves running a mass tool followed by a subdomain finding tool called Subfinder.
The speaker typically executes the subdomain hunt script only once per target, after which they analyze the identified subdomains.
"We need to ensure that our lists are organized and ready for the next phase of the hunt."
The speaker showcases a method to categorize the gathered subdomains into a structured mind map for better organization.
They mention the importance of verifying whether the scraped subdomains are still active by filtering them through an http probing tool.
It’s essential to maintain a raw list of subdomains for potential further analyses, like port scanning.
"Using tools like http probe allows us to filter for live servers."
The tool http probe is utilized to sift through the collected subdomains to determine which ones have an active web server running.
The speaker highlights that while they're primarily searching for web links, some subdomains might still host services on other ports that are valuable.
A clear distinction is made between subdomains that might be offline versus those that are live and should be prioritized for further exploitation.
"There's no magic trick—just open the sites in a browser and start hacking."
Once the probing is complete, the speaker emphasizes the importance of manual inspection of the websites associated with the live subdomains.
They utilize a specific Chrome extension to facilitate opening all identified links in tabs, integrating their findings seamlessly with existing analysis tools.
The speaker notes that creativity and a hands-on approach are necessary as they begin identifying potential vulnerabilities directly through engagement with the sites.
"If vulnerable, I can register the domain and inherit their trust, making it easier to phish users."
The process of checking for subdomain takeovers is discussed, with an emphasis on how a certain service, like Ping Identity, can present vulnerabilities that can be exploited.
The speaker uses a specialized project to check if the current subdomain is vulnerable and explores methods of automation for this phase.
They acknowledge the need to investigate further by conducting a Google search for any relevant references to subdomain weaknesses before proceeding with targeted efforts.
"So, I'll do content discovery on this and for every site I'm inspecting, this is what I check."
The speaker discusses content discovery as a key tactic for identifying vulnerabilities in web applications. This involves inspecting the site for error messages, file uploads, and user role references. The approach is systematic, with a methodology template being utilized for each analysis.
Key items being inspected include how the site handles special characters in search forms, dynamic parameters, and the presence of any APIs. The speaker emphasizes the importance of understanding the site's architecture to identify potential attack vectors.
"I just have a feeling like this is a custom coded login form, which means it's probably custom code."
The speaker expresses intuition about the nature of a login form associated with managed print services, suggesting that its simplistic design may indicate custom coding rather than reliance on a popular framework.
Noticing details like the last update of the site from 2009 raises red flags about security, hinting that there may be vulnerabilities that could be exploited.
"The script that I use to scrape GitHub for subdomains is called GitHub subdomains."
The speaker introduces tools utilized for subdomain enumeration, including scripts for scraping GitHub and Shodan for subdomain discovery. Emphasis is placed on the necessity of API keys for accessing these services.
The mention of bufferoverflow.run showcases methods for finding subdomains across major cloud services like AWS, GCP, and Azure, which can greatly assist in the reconnaissance phase of ethical hacking.
"The idea of favicon analysis is kind of like what we talked about before with identifying assets."
Favicon analysis is highlighted as an essential tool for identifying technologies used by a site. By hashing favicons and searching them on Shodan, researchers can quickly find other instances of the same technology in use across the web.
The speaker notes that this technique can enhance the effectiveness of scanning tools, particularly when default application paths have been modified, making it easier to identify potential vulnerabilities.
"Change the URL path, and you're not usually finding anything significant."
The speaker discusses the strategy of manipulating the URL path during a penetration test, highlighting that this alone often does not yield significant vulnerabilities, especially where the favicon remains unchanged.
They suggest utilizing tools to fingerprint various technologies related to the domains of interest for hacking purposes.
After identifying domains, the next step involves feeding a list of raw domains to a port scanner to identify potential vulnerabilities.
"I have been using dn mass; it wraps around masscan, allowing you to scan domains effectively."
The presenter emphasizes methods for port scanning, particularly their preference for using dn mass, a wrapper that facilitates masscan to scan domains instead of just IP addresses, enhancing efficiency.
The speaker details the output generated from their bash script, which compiles data on raw domains and their associated services, showcasing the significance of having numerous targets for ethical hacking opportunities.
"Nmap does not scan as fast as masscan for a list of domains; masscan is considerably quicker."
The speaker critiques the common belief that Nmap can compete with masscan's speed by using specific flags, asserting that masscan maintains superior efficiency for large domain lists.
They mention their extensive experience with port scanning and emphasize that masscan operates closer to the kernel, resulting in a faster scanning process.
"After obtaining IP addresses and open ports from dn masscan, you can then use Nmap for a full service scan."
Following the port scanning with dn masscan, the speaker advises performing a full service scan with Nmap to gather comprehensive data on services running on the discovered ports.
They introduce brute spray, a tool to automate credential guessing efforts against services that require logins utilizing the previously collected data.
"You can run a screenshotting tool like Eyewitness to automate the analysis of multiple domains."
By incorporating a tool like Eyewitness, the speaker demonstrates how to automate the process of capturing screenshots of web pages corresponding to the scanned domains to streamline analysis.
The methodology allows the tester to minimize manual checks of individual websites, providing a visual overview of potential targets quickly and effectively.
"I will check this out and see if it's a custom application or part of Office Depot's infrastructure."
The presenter describes their approach to prioritizing which domains to investigate further based on visual data from the screenshots, focusing on unique characteristics of web pages that might indicate areas for deeper exploration.
They mention the importance of distinguishing between legitimate business applications and potential subdomains that could be exploited, thus outlining a crucial step in an ethical hacking assessment.
"I will attempt to find API documentation and fuzz the API."
The speaker is identifying potential application programming interfaces (APIs) to analyze and explore.
Fuzzing involves sending a wide range of malformed or random inputs to the API to discover vulnerabilities, and they expect to obtain a significant number of screenshots (around 200 or 400) from the fuzzing tool as it processes.
"Nuclei is a scanner that looks for CVEs, login portals, interesting pages."
The presenter emphasizes the use of Nuclei, a scanning tool developed by the Project Discovery team, which contains the most signatures for subdomain takeovers compared to any other available tool.
The speaker demonstrates how to configure Nuclei to check for subdomain takeover risks by using specific templates and providing it with a list of targets to analyze.
"You can make your own templates to do cool stuff; this is the next level of recon."
The speaker highlights the flexibility of Nuclei, allowing users to create custom templates for various checks including CVEs, directory brute-forcing, and specific keyword searches within responses from URLs.
Custom templates enable users to tailor their scanning and vulnerability analysis more effectively, thus enhancing their overall reconnaissance efforts.
"If any of the tools you use do not support your preferred notation, you can use Interlace."
The presenter discusses the Interlace tool, which allows users to thread older vulnerability scanning tools like Nikto, thus increasing efficiency during testing.
Even older tools can still provide valuable information on outdated technologies, especially when utilized alongside more modern tools like Nuclei.
"All of these different GitHub projects are tiered frameworks that are basically bash or python gluing together all of the tools."
The speaker mentions various frameworks available for automating reconnaissance tasks, highlighting Ultimate Recon as a preferred option because it integrates Nuclei checks and performs a comprehensive enumeration of subdomains.
The discussion covers the potential for users to construct their own automated tools or scripts to streamline and enhance their cybersecurity assessment processes.
"You could build a tool like I have, or you could just use one of the ones that is already out there; there's several examples here."
Various tools are available for reconnaissance in cybersecurity, and the choice depends on the user’s needs and preferences.
Advanced tools like Lazy Recon offer features such as screenshots, port scanning, and technology mapping while performing tasks like subdomain takeover checks.
There are also paid tools, such as Find Domain, that organize findings into databases and notify users via text or Slack when discoveries occur.
Examples of other tools in the same category include Rock On, Recon Pipeline, and Js.
"Recon Pipeline is actually pretty advanced."
Some reconnaissance tools, like Recon Pipeline, provide advanced continuous recon capabilities, but the user acknowledges they haven't explored every tool available.
Jails is another notable tool for scanning CVEs, and while it hasn't been discussed extensively in this instance, it's recognized as beneficial.
Tools like Us Medius and Re-Engine abstract the reconnaissance process into user-friendly web interfaces, simplifying domain profiling and port scanning.
"Bert Bounty, or Automated Scan Checker, is a Burp extension."
Burp Suite has an extension called Bounty that allows users to create custom scan checks, with built-in checks for various vulnerabilities like XXE and XSS.
The presenter highlights a specific type of vulnerability known as blind XSS, which occurs when an XSS payload triggers on a different user’s session rather than the attacker’s own.
"You can create a new active scan... and basically load your XSS Hunter payload in here."
Users can leverage XSS Hunter to create payloads and monitor when they are triggered.
By configuring Burp to append the XSS payload across various request parameters, users can execute scans to identify blind XSS vulnerabilities.
This method involves waiting to see if the payload will report back through XSS Hunter, indicating a successful exploit.
"This is the CVE detectors thing by Vulners; it's now called Software Vulnerability Scanner."
The methodology also incorporates a software vulnerability scanner for analysis of web servers.
The presenter is developing a second part of their methodology on manual web hacking and content discovery, which will be released in the future.
