Before You Touch The Target: A passive and active recon walk-through for cybersecurity practitioners

Do this to get more than relevant information on a target before exploitation

Passive and active recon can be done using various tools and today we will look at 6 very crucial tools used in passive and active recon together with their alternatives.

Requirements

First of all, we need to make sure that we have the tools and other requirements.

Check if you have:

• subfinder
• dig
• nmap
• httpx
• wafw00f
• whatweb

Installing the required tools

Run the following commands on Kali Linux terminal to install the tools before we dive in:

To install subfinder

sudo apt update
sudo apt install subfinder -y

To install dig

sudo apt update
sudo apt install dnsutils

To install nmap

sudo apt update
sudo apt install nmap
nmap --version #To confirm you have nmap installed

To install httpx for network scanning

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

To install wafw00f

sudo apt update
sudo apt install wafw00f

To install whatweb

sudo apt update
sudo apt install whatweb

The commands for installation vary across different operating systems for most of the tools but the script will run on Linux and Mac OS. For those using windows, you can use a Kali Linux virtual machine.

The script below will scan any domain which we are legally or explicitly allowed to scan to give us the IP address, subdomains, technologies used, whether the subdomains have web application firewalls, which ports are open and more.

Here is the script:

#!/bin/bash

#=!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+
#Do not run this script on domains you are not allowed to do so
#=!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+

#===================================================================================
#This make hr to be a command that output a line to make the output more presentable
#===================================================================================

hr() {
    printf '%*s\n' "${COLUMNS:-$(tput cols)}" | tr ' ' "${1:-=}"
}

#==============================================================================================================
#The user is prompted to input a domain like example.com which will be used in all the processes in this script
#==============================================================================================================
hr -
read -p "Enter the domain: " doma
dom="${doma%%.*}"

#==============================================================================
#Creates a folder to save the files which will have the output of the full scan
#==============================================================================

mkdir ${dom}_folder

#=============================
#This part is totally optional
#=============================

touch ./${dom}_folder/errors.txt && touch ./${dom}_folder/scan.txt && touch ./${dom}_folder/open.txt && touch ./${dom}_folder/open1.txt && touch ./${dom}_folder/${dom}.txt && touch ./${dom}_folder/${dom}_live.txt && touch ./${dom}_folder/scan.txt && touch ./${dom}_folder/No_Firewall.txt 

#====================================================================================================
#This section looks for subdomains of the domain and checks whether they are (live/responsive) or not
#====================================================================================================
hr -
if [ -z "${doma}" ]; then
    echo "Please input a domain name. Exitting..."
else
    subfinder -d "${doma}" -all | tee "./${dom}_folder/${dom}.txt"
fi

while read -r domain; do
    echo "${domain}" | httpx -sc -silent
done < "./${dom}_folder/${dom}.txt" > "./${dom}_folder/${dom}_live.txt" 2>./${dom}_folder/errors.txt

#==============================================================================================================
#This section finds out the live subdomains of the domain which are not protected by a web application firewall
#==============================================================================================================
hr -
echo "httpx scan starting... . Here are the live subdomains of ${doma}"
httpx -l "./${dom}_folder/${dom}.txt" -silent | tee "./${dom}_folder/${dom}_plain_live.txt"
hr -
wafw00f -a -i "./${dom}_folder/${dom}_plain_live.txt" -o ./${dom}_folder/Firewall.csv && grep "None" ./${dom}_folder/Firewall.csv | tee ./${dom}_folder/No_Firewall.txt

#=========================================================================================================================================================
#This section checks for the IPv4 address of the domain and runs an nmap scan on the IPv4 address to find any open ports which are potentially exploitable
#=========================================================================================================================================================
hr -
ipv4=$(dig "${doma}" A +short | head -n1)
echo "The IPv4 address is ${ipv4}"
hr -
echo "${doma}: IPv4 => ${ipv4}" >> ./${dom}_folder/scan.txt
echo "Starting nmap scan..."
nmap -Pn -sC -sV "${ipv4}" -T4 -v -oG ./${dom}_folder/open1.txt
grep "/open/" ./${dom}_folder/open1.txt >> ./${dom}_folder/open.txt
hr -
echo "Here are the results of the nmap scan, lookp for open ports." && cat ./${dom}_folder/open.txt
hr -

#==========================================================================================
#This section enables the script to give the user info on the technology used by the domain
#==========================================================================================
whatweb "${doma}"
hr

echo "Scan complete!"
echo "The subdomains of ${dom} have been saved to ${dom}.txt in ${dom}_folder"
echo "The 'live' subdomain of ${dom} together with their status code have been saved to ${dom}_live.txt in ${dom}_folder"
echo "The subdomains of ${dom} have been saved to No_Firewall.txt in ${dom}_folder"
echo "The open ports of ${dom} have been saved to open.txt in ${dom}_folder"
hr

Before running the script, run:

chmod +x recon.sh #recon.sh is the name of the bash script

To run the script simply run ‘./script_name as so:

./recon.sh

When you run the script you will be prompted to input a domain. For legal reasons, don’t run this script on domains you do not own or have explicit permission to do so. I have explicit permission to run the script on the domain used in this article.

./recon output

Once you input the domain a new folder will be created where all the output will be saved and subfinder will start enumerating the subdomains of the domain and list them on the screen, and in a domain.txt file as shown in the script.

#To run this manually I would run:
subfinder -d muthengia.com -all | tee muthengia.txt

At this point you can stop the script and run another tool like dig on the specific subdomain as so:

dig <subdomain> ANY +short

But if that is not your goal, allow the script to continue.

Phase one: How secure are the subdomains?

Immediately after running subfinder, the script will run a httpx scan on the subdomains to find out which ones are ‘live’ and save them in domain_live.txt. This file will contain the status codes alongside the subdomains.

subfinder + httpx scan output

Output of httpx scan saved with the status codes of the subdomains

To run wafw00f on all subdomains automatically, the script runs another httpx scan without the ‘-sc’ flag to avoid having status codes in the output which would make the next code on wafw00f to fail to execute.

httpx scan results without status codes

wafw00f results

The generic detection shows there is no firewall but we can clearly that the website is behind Cloudflare Web Application Firewall. The wafw00f scan was done on subdomains listed on muthengia_plain_live.txt to avoid any syntax error.

Phase one conclusion: subfinder looks for the subdomains of the input domain and saves the output to a file. httpx finds out which subdomains are ‘live’ while wafw00f goes through each of the subdomains to check which ones are behind a web application firewall.

Phase two: What if the ports are not secure?

The script automatically runs dig on the domains to find the first IPv4 address on the list which is assigned a variable ‘ipv4'. The script then performs an nmap scan on the IPv4 address to discover the open ports on the domain, and saves them on another file.

result of running dig on the domain

nmap scan running

Since we are interested in the open port, we added -oG flag in the nmap command and used grep to search for the output showing open ports and saved it to open.txt

Combination of nmap with -oG flag and grep ”/open/”

The output of grep “/open/” saved in a .txt file

Ports can be used to set payloads if you are doing penetration testing on the domain.

Phase two conclusion: dig finds the IPv4 address while nmap scans for open ports on the domain.

Phase three: Last chance. Final blow!

This includes one tool which is very crucial, whatweb. The script will run whatweb on the domain input and give a lot of information concerning the domain including the technology running the website. The technology is actually the crucial detail in this case. When you find the technology used, you can look for already discovered but unpatched vulnerabilities affecting the version of the technology used on platforms like exploit DB.

whatweb output

Phase three conclusion: whatweb gives the technology running the website while we look for discovered but unpatched vulnerabilities affecting the exact version of the technology used.

For the sake of having an organized and orderly output, I added the extra echo commands to guide the user:

echo "Scan complete!"
echo "The subdomains of ${dom} have been saved to ${dom}.txt in ${dom}_folder"
echo "The 'live' subdomain of ${dom} together with their status code have been saved to ${dom}_live.txt in ${dom}_folder"
echo "The subdomains of ${dom} have been saved to No_Firewall.txt in ${dom}_folder"
echo "The open ports of ${dom} have been saved to open.txt in ${dom}_folder"

The output is where everything is saved:

A concluding output to guide the user

What we have gained

Conclusion: The script gives us three attacking points:

1. The subdomains which are not behind any web application firewall. This makes it easier for us to attack since down by one protection-layer. In our case, muthengia.com has a Web Application Firewall. Therefore, I will avoid launching obvious attacks against the system since the probes will be blocked.
2. The open ports on the domain’s server. We can decide to use payloads to infiltrate the system.
3. The discovered but unpatched vulnerabilities affecting the exact version of the technology used. We can use the unpatched vulnerabilities to exploit the system.

Alternative tools: What if I don’t want to use these tools?

1. findomain for subfinder
2. nslookup for dig
3. masscan for nmap (If you prioritise speed over accuracy during the scan)
4. httpx and nmap can be used in place of wafw00f to check for any web application firewalls guarding the target
5. You can use wpscan if you know the target uses WordPress instead of running whatweb.

Note: Do not run the script on domains you do not own or have explicit permission to do so.