There is more than meets the eye. Consider all points of view.
2.
Distinguish between what we see and what we do not see.
3.
There are always ways to gain more information. Understand the target.
Layer
Name
Goal / Purpose
1
Internet Presence
Discover Assets: Identify all public-facing domains, subdomains, IPs, and netblocks.
2
Gateway
Analyze the Perimeter: Understand the target’s external interfaces and protection mechanisms (e.g., WAF, firewall).
3
Accessible Services
Enumerate Services: Identify and understand the function of every open port and running service on the discovered assets.
4
Processes
Understand Functionality: Analyze how data is processed by services and identify dependencies between inputs and outputs.
5
Privileges
Identify Permissions: Determine the privileges of each service’s user account and look for overlooked or excessive permissions.
6
OS Setup
Internal Recon: After gaining access, gather information on the OS configuration, security posture, and admin practices.
External Recon (Passive OSINT)
Data Point
Description
IP Space
Valid ASN for our target, netblocks in use for the organization’s public-facing infrastructure, cloud presence and the hosting providers, DNS record entries, etc.
Domain Information
Based on IP data, DNS, and site registrations. Who administers the domain? Are there any subdomains tied to our target? Are there any publicly accessible domain services present? (Mailservers, DNS, Websites, VPN portals, etc.) Can we determine what kind of defenses are in place? (SIEM, AV, IPS/IDS in use, etc.)
Schema Format
Can we discover the organization’s email accounts, AD usernames, and even password policies? Anything that will give us information we can use to build a valid username list to test external-facing services for password spraying, credential stuffing, brute forcing, etc.
Data Disclosures
For data disclosures we will be looking for publicly accessible files ( .pdf, .ppt, .docx, .xlsx, etc. ) for any information that helps shed light on the target. For example, any published files that contain intranet site listings, user metadata, shares, or other critical software or hardware in the environment (credentials pushed to a public GitHub repo, the internal AD username format in the metadata of a PDF, for example.)
Breach Data
Any publicly released usernames, passwords, or other critical information that can help an attacker gain a foothold.
Domaintools, PTRArchive, ICANN, manual DNS record requests against the domain in question or against well known DNS servers, such as 8.8.8.8.
Social Media
Searching Linkedin, Twitter, Facebook, your region’s major social media sites, news articles, and any relevant info you can find about the organization.
Public-Facing Company Websites
Often, the public website for a corporation will have relevant info embedded. News articles, embedded documents, and the “About Us” and “Contact Us” pages can also be gold mines.
HaveIBeenPwned to determine if any corporate email accounts appear in public breach data, Dehashed to search for corporate emails with cleartext passwords or hashes we can try to crack offline. We can then try these passwords against any exposed login portals (Citrix, RDS, OWA, 0365, VPN, VMware Horizon, custom applications, etc.) that may use AD authentication.
via DNS
Great to validate and discover new information, especially from IP and ASN searches.
# Use a userlistwget https://github.com/insidetrust/statistically-likely-usernames/raw/refs/heads/master/jsmith.txt
# AD Username Brute-Forcekerbrute userenum --dc <DC_IP> -d <DOMAIN_NAME> <USERNAME_LIST>
Find High Value Users
# via SMBnxc smb <TARGET> -u <USER> -p <PASSWORD> --groups "Domain Admins"# via LDAP# gets objects with adminCount=1, which includes DAs, Enterprise Admins, Backup Ops, etc.nxc ldap <TARGET> -u <USER> -p <PASSWORD> --admin-count
via Social Media
Check various sites, especially for different types of IT admins, to skim information about hardware, software, or services used: