recon
ACTIVE
nmap, of course best to run inside Metasploit, even if you use no other feature of that tool because it makes searching so easy
External networks
Aquatone -- excellent tool for multiple stages of bounty hunting/recon
TODO: FILL IN THESE EXAMPLES with the other aquatone tools
aquatone- ???
aquatone ???
aquatone-discover --threads 15 --nameservers 1.1.1.1 <domain>For local networks (ex: during CTFs)
netdiscover - very fast, uses arp; output = IP, MAC, HW Manuf based on MAC
sudo netdiscover -P -N -L -r 192.168.1.0/24
nbtscan - find SMB shares/chatty windoze boxes
nbtscan 192.168.10.2-9; nbtscan 192.168.20.2-9
smbmap - SMB share enumerator
smbmap -u admin -p admin -H $SERVER -x 'net group "Domain Admins" /domain'
smbmap -H $SERVERsmbclient - connect to SMB shares to pull/put files
smbclient -d2 -N -U guest //192.168.10.4/Public
Passive
SSL Transparency Report - search by host/domain -- check the hostnames that a company has registered certs for (even expired certs!), and include subdomains in search
Last updated