渗透测试之信息收集 之域名爆破

在渗透测试之信息收集中，域名的集中梳理和分类是至关重要的。可以通过爆破的方式来完成。

一般会使用到dnsrecon和dig 这两款软件，如图所示

# DNSRecon
dnsrecon -d www.example.com -a
dnsrecon -d www.example.com -t axfr
dnsrecon -d
dnsrecon -d www.example.com -D  -t brt

# Dig
dig www.example.com + short
dig www.example.com MX
dig www.example.com NS
dig www.example.com> SOA
dig www.example.com ANY +noall +answer
dig -x www.example.com
dig -4 www.example.com (For IPv4)
dig -6 www.example.com (For IPv6)
dig www.example.com mx +noall +answer example.com ns +noall +answer
dig -t AXFR www.example.com

Subdomain finder


sublist3r -d www.example.com
sublist3r -v -d www.example.com -p 80,443
knockpy domain.com
amass enum -active -d example.com
subfinder -d example.com
spyse -target domain.com -param domain --subdomains | aquatone

# Onliner to find (sub)domains related to a kword on pastebin through google
# https://github.com/gwen001/pentest-tools/blob/master/google-search.py
google-search.py -t "site:http://pastebin.com kword" -b -d -s 0 -e 5 | sed "s/\.com\//\.com\/raw\//" | xargs curl -s | egrep -ho "[a-zA-Z0-9_\.\-]+kword[a-zA-Z0-9_\.\-]+" | sort -fu

# amass
amass enum -d www.example.com
amass intel -whois -d www.example.com
amass intel -active 172.21.0.0-64 -p 80,443,8080,8443
amass intel -ipv4 -whois -d www.example.com
amass intel -ipv6 -whois -d www.example.com

# Subdomain bruteforcing
subbrute.py /path/dictionary.txt example.com | ./bin/massdns -r resolvers.txt -t A -a -o -w massdns_output.txt -
gobuster -m dns -u domain.com -t 100 -w /path/dictionary.txt

# Sublist3r aliases
alias sublist3r=’python /path/to/Sublist3r/sublist3r.py -d ‘
alias sublist3r-one=”. <(cat domains | awk ‘{print “sublist3r “$1 “ -o “ $1 “.txt”}’)”

#RapidDNS
http://rapiddns.io/subdomain

# Findomain
./findomain-linux -t domain.com

# AltDNS
altdns -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt

# crtndstry
./crtndstry example.com

# Spyse
# https://github.com/zeropwn/spyse.py
spyse -target domain.com --subdomains
spyse -target 52.14.144.171 --domains-on-ip
spyse -target "org: Company" --ssl-certificates
spyse -target domain.com --dns-all
spyse -target domain.com --ssl-certificates
spyse -target domain.com -param domain --subdomains --raw | aquatone

# Aquatone
aquatone-discover --domain example.com
aquatone-scan --domain example.com
aquatone-scan --domain example.com --p 80,443

# Wildcard subdomain
dig a *.domain.com = dig a asdasdasd132123123213.domain.com -> this is a wildcard subdomain

Subdomain takeover

Explanation:
1. Domain name (sub.example.com) uses a CNAME record for another domain (sub.example.com CNAME anotherdomain.com).
2. At some point, anotherdomain.com expires and is available for anyone's registration.
3. Since the CNAME record is not removed from the DNS zone of example.com, anyone who records anotherdomain.com has full control over sub.example.com until the DNS record is present.

Best resources:
https://blog.initd.sh/others-attacks/mis-configuration/subdomain-takeover-explained/
https://github.com/EdOverflow/can-i-take-over-xyz
https://0xpatrik.com/takeover-proofs/
https://github.com/EdOverflow/can-i-take-over-xyz

# amass
amass -nodns -norecursive -noalts -d domain.com

# subjack
https://github.com/haccer/subjack
subjack -w /root/subdomain.txt -a -v -t 100 -timeout 30 -o results.txt -ssl # Subdomains generated with subgen

# subgen (subdomain list generator)
# https://github.com/pry0cc/subgen
go get -u github.com/pry0cc/subgen
cat wordlist.txt | subgen -d "uber.com"
cat /home/user/Escritorio/tools/SecLists/Discovery/DNS/clean-jhaddix-dns.txt | subgen -d domain.com |  massdns -r /usr/share/wordlists/dns.txt -t A -o S -w results.txt
Check for results.txt

# subdomain-takeover
# https://github.com/antichown/subdomain-takeover
python takeover.py -d domain.com -w /root/Repos/SecLists/Discovery/DNS/clean-jhaddix-dns.txt -t 100

# SubOver
# https://github.com/Ice3man543/SubOver
SubOver -l /root/subdomains.txt  # Subdomains generated with subgen