Jul 12, 2023, 08:42 AM
FROM NOOB TO 0DAY FINDER
Reconnaissance
WEBSITE SEARCH
Search the target's own websites
-Press releases-White papers
-Design documents
-Sample deliverables
-Open position (cool)
-Key people (cool)
-Contacts (cool)
Seach related sites
-Buisness partners, ISP, suplliers
We try to get as much informations as possible
Open-Source information:
Public databases:
-EDGAR search
https://www.sec.gov/edgar/search/
-Job sites
https://www.monster.com/
data.com
Other useful open source information:
Newspapers blogs, magazines
Social networking site
-Nexsgroup with posting from employees
https://namechk.com/ to check domain and username on different social media
You can find what the employee like and make a social engineering attack
PushPin by Time Tomes:
-Part of recon-ng
Social-media geolocation
-Flicker
Can map targets to behavior patterns
-When and where they have a launch
-Their religious and political leanings
It can even be used to gather internal pictures of secured location
-People love to take picture of their office and badges lmao
Website search defense:
-Limit and control information
-Make employement ads more general
-Limit information on a website
-Determine what other site are linked to u company
Identification
-Look for web spider/crawler activity