Asset enumuration slide - Abisheik M

Transcript

1. By Abisheik M ASSET ENUMERATION
2. 1. Chapter Lead for OWASP Tiruvallur 2. SecDevOps Engineer intern @syncrony 3. Application Security Researcher 4. Synack Red Team 5. Freelancer 6. Student at SATHYABAMA UNIVERSITY 7. Bug Bounty Hunter 8. A noob Developer $ cat whoami.txt
3. WHY ASSET ENUMERATION / RECON ? a 1 1 1
4. SCOPE BASED ENUMERATION 1. Small Scope ( Only Specific Application ) 2. Medium Scope (*.target.com) 3. Large Scope (AnyThing which is owned by company is in scope)
5. LARGE SCOPE - RECON APPROACH Scope - Any Asset Which is owned By the Organization is In Scope • Root Domain Enumeration • SubDomain Enumeration • ASN Enumeration • Favicon Enumeration • Service Enumeration • Github Recon • Port Scan What To Look For ?
6. Root Domain Technically, the root domain is the highest hierarchical level of the Internet, even above top-level domains such as .com and . net Enumerating the Root domain owned by the company will fetch you higher chance of finding a critical issue
7. Subdomain Enumeration A subdomain name is a piece of additional information added to the beginning of a website's domain name. It allows websites to separate and organize content for a specific function Enumerating the subd domain owned by the company Will widely increase your attack surface
8. ASN ENUMERATION What is ASN Number ? Autonomous System Number (ASN) is a globally unique identifier that defines a group of one or more IP prefixes run by one or more network operators that maintain a single, clearly-defined routing policy. These groups of IP prefixes are known as autonomous systems. ASN Number look something like “ AS394943 “ You can actually find the Asn number using the given url URL: https://bgp.he.net/
9. 01 DOMAIN ENUMERATION
10. DOMAIN ENUMERATION Domain Enumeration Vertical Domain Enumeration Horizontal Domain Enumeration Business.facebook.com Graph.Facebook.com Facebook.com Fb.com thefacebook.com
11. Horizontal DOMAIN ENUMERATION Horizontal Domain Enumeration : This is Otherwise Known As Root domain enumeration This can be Enumerate in Many ways 1. Reverse Whois 2. Accusation of the the Organization
12. Horizontal DOMAIN ENUMERATION GITHUB TOOLS 1. HTTPX 2. HTTPROBE Run the bulk Rwhois domain in the following tools to get Live Domain list lookup.icann.org WHOIS Record FOR FB.COM Registran mail : Domain@fb.com viewdns.info/reversewhois/ Using the Registrar Email make RWHOIS LiveFinalOut.txt WORKFLOW
13. FAVICON ENUMERATION What is FAVICON ? An icon associated with a particular website, typically displayed in the address bar of a browser accessing the site or next to the site name in a user's list of bookmark By some Organization may use same favicon for their multiple domains so in the attacker Enumeration Perspective we can actually we can gain some interesting domain which we may have missed in the initial Domain Enumeration HOW TO CALCULATE HASH VALUE OF FAVICON ? This can be done in Two ways . ➢ Writing a Code to calculate an hash ➢ Use Prebuilt online tools and github tools like ( https://faviconhash.com/
14. USING FAVICON ENUMERATION HOW TO USE HASH VALUE OF FAVICON to Find ASSET ? Using the favicon value to grab data over the Shodan.io will be one of the effective Way to enumerate the domain with same favicon hash value
15. 02 CONTENT Discovery
16. OUR WORKFLOW Directory ENUMERATION JS file GRABBING Collect Archive URL LIVE URL ENUMERATION Tools used 1. FFUF 2. Dirb 3. dirsearch Tools Used 1. Waybackurls 2. archive.org/web/ Tools used 1. GAU Tools used 1. relative-url-extractor
17. PRACTICAL TIME !!!!!
18. What after Recon ???
19. ANY QUESTION ?
20. CONTACT MY SOCIAL MEDIA HANDLE Instagram : https://www.instagram.com/_itsjust___.a.k.m.___/ Twitter : https://twitter.com/abisheikmagesh?lang=en LInkedin : https://www.linkedin.com/in/abisheik-m-86352218b/ Facebook : https://www.facebook.com/profile.php?id=100012284136155 Mail : abisheikmagesh@gmail.com
21. THANK YOU :)