cyber-security-resources/recon/README.md

46 lines
1.9 KiB
Markdown
Raw Normal View History

2018-01-20 00:14:08 -05:00
# Active and Passive Reconnaissance Tips and Tools
## Passive Recon
### Website Exploration and "Google Hacking"
* censys - https://censys.io/
* netcraft - https://searchdns.netcraft.com/
* Google Hacking Database (GHDB) - https://www.exploit-db.com/google-hacking-database/
* ExifTool - https://www.sno.phy.queensu.ca/~phil/exiftool/
* Certficate Search - https://crt.sh/
* Google Transparency Report - https://transparencyreport.google.com/https/certificates
* SiteDigger - http://www.mcafee.com/us/downloads/free-tools/sitedigger.aspx
* FOCA - http://www.informatica64.com/DownloadFOCA
### Social Media
* A tool to scrape LinkedIn: https://github.com/dchrastil/TTSL
* cree.py http://ilektrojohn.github.com/creepy/
### Whois
WHOIS information is based upon a tree hierarchy. ICANN (IANA) is the authoritative registry for all of the TLDs and is a great starting point for all manual WHOIS queries.
* ICANN - http://www.icann.org
* IANA - http://www.iana.com
* NRO - http://www.nro.net
* AFRINIC - http://www.afrinic.net
* APNIC - http://www.apnic.net
* ARIN - http://ws.arin.net
* LACNIC - http://www.lacnic.net
* RIPE - http://www.ripe.net
## BGP looking glasses
* BGP4 - http://www.bgp4.as/looking-glasses
* BPG6 - http://lg.he.net/
## DNS
* dnsenum - http://code.google.com/p/dnsenum
* dnsmap - http://code.google.com/p/dnsmap
* dnsrecon - http://www.darkoperator.com/tools-and-scripts
* dnstracer - http://www.mavetju.org/unix/dnstracer.php
* dnswalk - http://sourceforge.net/projects/dnswalk
### Other Great Intelligence Gathering Sources and Tools
* Resources from Pentest-standard.org - http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines#Intelligence_Gathering
## Active Recon
* Tons of references to scanners and vulnerability management software for active reconnaissance - http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines#Vulnerability_Analysis