Description

Enumeration (Passive)

1. Google Dorks

• filetype: - looks for file types
• index of - directory listings
• info: - contains Google’s information about the page
• intitle: - string in title
• inurl: - string in URL
• link: - finds linked pages
• related: - finds similar pages
• site: - finds pages specific to that site

1. Shodan

• Top 40 Shodan Dorks to find sensitive information in 2023 (securitytrails.com)

1. GitHub

• GitHub Dorks (securitytrails.com)

Dorks:

• filename:.npmrc _auth
• filename:.dockercfg auth
• extension:pem private
• extension:ppk private
• filename:id_rsa or filename:id_dsa
• extension:sql mysql dump
• extension:sql mysql dump password
• filename:credentials aws_access_key_id
• filename:.s3cfg
• filename:wp-config.php
• filename:.htpasswd
• filename:.env DB_USERNAME NOT homestead
• filename:.env MAIL_HOST=smtp.gmail.com
• filename:.git-credentials

4. The Harvester

theHarvester -d uber.com -b all
theHarvester -d microsoft.com -l 200 -b baidu

-d → identify domain
-l → number of results
-b → search engine

1. Nslookup
   Records:
   type=A → IP address of a given domain.
   type=AAAA → the domain’s IPv6 address.
   type=NS → show name servers of domain.
   type=MX → contain names of the servers that handle the email server of domain.

Other Tools:
host google.com
dig yahoo.com

Enumeration (Active)

1. Host Discovery
   Netdiscover

netdiscover -r 10.10.10.0/24

Ping Sweep
Bash One-liner:

for i in $(seq 254); do ping 172.16.1.$i -c1 -W1 & done | grep from

Windows Ping Sweep:

for /L %i in (1,1,255) do @ping -n 1 -w 200 192.168.1.%i > nul && echo 192.168.1.%i is up.

1. Nmap
   Normal Scan (all ports)

   nmap -p- 10.10.10.10
   

   Quick Scan

   nmap -p- --min-rate=10000 -T4 10.10.10.10
   

   Advanced Scan (Using version detection & default scripts on open ports)

   nmap -p 22,80,443 -A -sV -sC --script vuln 10.10.10.10 -o out.txt
   

Wireshark Filters

http.request → Displays HTTP GET requests
http.request == POST → Displays HTTP POST requests
http contains google.com → Shows HTTP packets that have the google.com domain name
http.request.method == GET
tcp contains string → Displays TCP segments that contain the word "string"
ip.src==*IP-address* and ip.dst==*IP-address* → Traffic from which port to which port
ip.addr == 172.17.15.12 && tcp.port == 23 → Displays telnet packets containing that IP ---