> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/information-gathering/passive-information-gathering.md). # Passive Information Gathering ### What is Footprinting ? **Footprinting** is essentially the same as reconnaissance. The only difference is we're identifying more important information that's pertinent to a particular target. **What are the we looking for ?** * IP addresses * Directories hidden from search engines * Names * Email addresses * Phone Numbers * Physical Addresses * Web technologies being used *** Target: * `whatis` - to learn more about a command on Linux ``` whatis ``` * `host` - used for DNS lookup ``` host ``` *Note:* if we get 2 address that means there is a proxy * robot.txt - to disallow search engine from listing certain directories * sitemap.xml - to provide search engines with an organized way of indexing * WhatWeb - Web Scanner ``` whatweb ``` * HTTrack - Website copier (apt package name: webhttrack) * Whois - a query and response protocol that is used for querying databases that store an internet resource's registered users or assignees. Includes domain names, IP address blocks. ``` whois ``` * Netcraft - used to gather information about a target domain *** #### Add-on & extenstion * Builtwith * Wappalyzer * Adblocker * Video DownloadHelper * ProxyFoxy *** #### DNS Recon * DNSRecon - A python script that provides the ability to perform Check all NS Records for Zone Transfer and enumerate DNS records. (package name: dnsrecon) ``` dnsrecon -d ``` * [DNSdumpster](https://dnsdumpster.com) - a FREE domain research tool that can discover hosts related to a domain > "Finding Visible hosts from the attackers perspective is an important part of security assessment process." - DNSdumpster.com *Note: mail server is not being protected by the cloudflare.* #### Web Application Firewall detection with wafw00f * It is useful in identifying whether a website or webapp is being protected web application firewall. * To list number of firewall, it can detect: ``` wafw00f -l ``` ``` wafw00f ``` * To test for all possible WAF instances ``` wafw00f -a ``` #### Subdomain Enumeration with Sublist3r (package: sublist3r) * It doesn't perform subdomain brute forcing. We'r using publicly available source of information like search engines to find subdomains. * `subbrute` was integrated with sublist3rs to increase the possibility of finding more subdomains using bruteforce. [Sublist3r Usage ](https://github.com/aboul3la/Sublist3r/blob/master/README.md#usage) * It's always better to use VPN for subdomain enumeration. > "Identifying that a site is being protected by a web application firewall will help you better strategize what your next steps are..." *** #### Google Dorks `site: ` - It is used for resulting in domain & subdomain links. `inurl: ` - this search filter check the keyword in the url of the site provided (e.g. admin). `site: *.domain.com` - It is used for subdomain enumeration. `intitle: ` - It searches the sites title to find the match of keyword (e.g. admin) filetype: \ - It searches the files from the website. `intitle: index of` - If we are looking for sites with directory listing enabled. `cache: ` - It will provide the google web's cache memory. waybackmachine - Stores the snapshots of history. `inurl: auth_user_file.txt` `inurl: passwd.txt` *Note: wp-config.bak file contains MySQL creds in wordpress sites* *** #### Email Harvesting With theHarvester theHarvester works quite similarly to a sublister where it utilizes search engines and publicly available databases to identify emails that might have been leaked or that are available online. ``` theHarvester -d -b ``` #### Leaked Password Databases * haveibeenpwned?