OSINT

Attack Surface

• SHODAN

  Search Engine for the Internet of Everything

  # Search Query
  #   <keyword> ...
  #   [{[-(filter out)]<attr>:<value>,...(or)} ...(and)]
  #     country:{<country>|tw|us}
  
  hostname:google.com,facebook.com
  http.html:"index of" country:tw
  Microsoft-IIS port:8530,8531 country:tw -http.status:403  # WSUS
  

• Censys

  Censys helps organizations, individuals, and researchers find and monitor every server on the Internet to reduce exposure and improve security

• Google Hacking Database

  # {keyword | "<full match>"}
  #   [-<exclusion>]
  #   [site:<domain>]
  #   [filetype:<ext>]
  #   [intitle:<title>]
  
  intitle:"index of" setting.php
  

• OSINT Framework

• maltego

  A platform for open-source intelligence (OSINT) and cyber investigations

Domain

• crt.sh

  Enter an Identity (Domain Name, Organization Name, etc)

• robtex

  Subdomains

• dnsdumpster

  dns recon & research, find & lookup dns records

• IANA WHOIS Service

• DomainTools
• VirusTotal

Tech Stack

• Netcraft Site Report

  Find out the infrastructure and technologies used by any site

• Wappalyzer