Scope Discovery

WHOIS and Reverse WHOIS

With the whois command you can find public information about the person or organization who registered that domain (whois example.com).

If domain privacy is activated, then you only see the information about the registrar. You could then conduct a reverse WHOIS search, searching a database by using an organization name, a phone number or email address to find domains registered with it. This way, you can find all the domains that bleong to the same owner.

Us a public reverse WHOIS tool like ViewDNS.info to conduct this search.

IP Addresses

With the nslookup command you can find the IP address of a domain (nslookup example.com).

Once you have this you can perform a reverse IP lookup, this means looking for domains hosted on the same server, given an IP or domain. You can also use ViewDNS.info for this.

Also run the whois command toon an IP address, and then see if the target has a dedicated IP range by checking the NetRange field.

Another way of finding IP addresses in scope is by looking at autonomous systems, which are routable networks within the public internet. ASNs identify the owners of these networks. By checking if two IP addresses share an ASN, you can determine whether the IPs belong to the same owner.

whois -h whois.cymru.com 157.240.2.20

Certificate Parsing

Another way of finding hosts is to check the Subject Alternative Name of the SSL certificate. Use online databases like crt.sh, Censys, and Cert Spotter to find certificates for domain.

Subdomain Enumeration

Afer you located domains, locate as many subdomains as possible on this domains. Each subdomain represents a new angle for attacking the network. The best way to enumerate subdomains is to use automation. Use tools like Sublist3r, SubBrute, Amass, and Gobuster.

gobuster dns -d target_domain -w wordlist

Service Enumeration

Next, enumerate the services hosted on the machines you've found. Since services often run on default oprts, a good way to find them is by port-scanning the maching with either active or passive scanning.

Active Scanning

In active scanning, you directly engage with the server. Active scanning tools send requests to connect to the target machine's ports to look for open ones. You can use tools like Nmap or Masscan.

nmap scanme.nmap.org

Passive Scanning

In passive scanning, you use third-party resources to learn about a machine's ports without interacting with the server. Passive scanning is stealthier and helps attackers avoid detection. You can use Shodan, a search engine that lets the user find machines connected to the internet.

Directory Brute-Forcing

Finding directories on servers is valuable, because through them, you might discover hidden admin panels, configuration files, password files, outdated functionalities, database copies, and source code files. Directory brute-forcing can sometimes allow you to directly take over a server. You can use Dirsearch or Gobuster for directory brute-forcing.

Spidering the Site

Another way of discovering directories and paths is through web spidering, or web crawling, a process used to identify all pages on a site. You can use Zed Attack Proxy (ZAP) for spidering a site.

Third-Party Hosting

Take a look at the company's third-party hosting footprint. For example look for the organization's S3 buckets.

site:s3.amazonaws.com COMPANY_NAME

Github Recon

Search an organization's GitHub repositories for sensitive data that has been committed, or information that could lead to the discovery of a vulnerability.