Conference notes: It's the little things (Disobey 2018) & Doing recon like a boss (LevelUp 2017)

Hi, these are the notes I took while watching the “Doing recon like a boss” talk given by Ben Sadeghipour (@nahamsec) on LevelUp 2017.

[UPDATE] I modified these notes after watching the updated version of this talk: “It’s the little things” by Ben Sadeghipour & Jon Bottarini (Disobey 2018).

Links

• “Doing recon like a boss” video: https://www.youtube.com/watch?v=1Kg0_53ZEq8
• “It’s the little things” video: https://www.youtube.com/watch?v=5clT3JN7R8w

Overview

• Why: Bigger attack surface, more bugs, more bounties, more problems

Traditional way for finding subdomains (brute forcing)

• Brute force
  • Sublist3r

Conference notes: Esoteric subdomain enumeration techniques (LevelUp 2017)

Hi, these are the notes I took while watching the “Esoteric subdomain enumeration techniques” talk given by Bharath Kumar on LevelUp 2017.

Links

• Video: https://youtu.be/e_Gq99CKAys
• Slides: https://speakerdeck.com/yamakira/esoteric-sub-domain-enumeration-techniques
• Github repository: https://github.com/appsecco/bugcrowd-levelup-subdomain-enumeration
• Cheatsheet: https://github.com/appsecco/bugcrowd-levelup-subdomain-enumeration/blob/master/cheatsheet.pdf

How to scan all ports with Nmap

Hi, today’s tip is an Nmap option. It’s nothing extroardinary but I haven’t been aware of it for years and the day I stumbled on it, it has simply changed my life.
So I’m sharing it with you today on the off chance that you’re not using.

The 5 Hacking NewsLetter 3

Hi, I’m very happy to present you this week’s five items! They each taught me something that I’ve started using or added to my pentest/bug bounty checklist.

1. Scanners benchmark

Scanners benchmark

I enjoyed reading this Web Application Vulneability Scanners Benchmark for its precision and the number of open source tools mentioned.
Currently, I’m only using Burp Pro and none of the free open source scanners. But after reading this benchmark, I think I’m going to start playing with some of the open source tools too. ZAP and Arachni in particular seem to complement Burp Pro for all the vulnerability classes tested.

Vulnerability databases of commercial scanners

Sometimes when I am on a penetration test, I need confirmation for a vulnerability’s risk score, consequences (meaning real-life exploitation scenarios) or fix recommendations.

This happens mostly when vulnerabilities are not easily exploitable or have a low impact but, as a penetration tester, I must still report them and explain to clients why they should fix them. Examples of such vulnerabilities are the TRACE method being enabled, default Apache pages being accessible, etc.

When that happens, I check for the vulnerability class in question in one of these 4 sites: