Network Information

MITRE ATT&CK, Reconnaissance, Technique T1590

DNS Information

Subdomain enumeration is the process of finding valid resolvable subdomains for a companies domain(s). The more you can find, the more you can hack.

Google Dork

site:*.$domain -www)

Dome

# Passive subdomain enumeration
dome.py -m passive -d $domain

# Active enumeration
dome.py -m active -d $domain

GitHub - v4d1/Dome: Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.GitHub

Sublist3r

# Passively enumerate subdomains
sublist3r.py -d $domain

# Enumerate subdomains and utilize the 'brute force' module
sublist3r.py -b -d $domain

GitHub - aboul3la/Sublist3r: Fast subdomains enumeration tool for penetration testersGitHub

DNSRecon

# Enumerate subdomains
dnsrecon -d $domain

# Enumerate subdomains and perform a zone transfer
dnsrecon -a -d $domain

GitHub - darkoperator/dnsrecon: DNS Enumeration ScriptGitHub

Amass

# Retrieve the target domains ASN number
amass enum -d $domain

GitHub - owasp-amass/amass: In-depth attack surface mapping and asset discoveryGitHub

Gobuster

# Actively enumerate subdomains
gobuster dns --domain $domain --wordlist $wordlist

GitHub - OJ/gobuster: Directory/File, DNS and VHost busting tool written in GoGitHub

IP Addresses

Hurricane Electric Internet Services

Hurricane Electric Internet Services is a fast way to identify what company owns what IP

SecurityTrails

SecurityTrails Another good site for verifying IP addresses and netblocks belonging to an organization

NetBlockTool

NetblockTool can be used to gather IP ranges, points of contact, and even netblocks belonging to your target’s subsidiaries

Basic usage

python3 NetblockTool.py -v [COMPANY]

Extract ranges owned by the target company’s subsidiaries

python3 NetblockTool.py -v Company -s

References

NetblockTool: The Easy Way to Find IP Addresses Owned by a CompanyNetSPI

https://securitytrails.com/blog/identify-ip-ranges-company-ownssecuritytrails.com

​

References

DNS Information

SecurityTrails | SecurityTrails: Data Security, Threat Hunting, and Attack Surface Management Solutions for Security Teamssecuritytrails

crt.sh | Certificate Searchcrt.sh

DNSDumpster - Find & lookup dns records for recon & researchDNSDumpster.com

IP Addresses

NetblockTool: The Easy Way to Find IP Addresses Owned by a CompanyNetSPI