Breaching Defenses
  • Breaching Defenses Course
  • What is Red Teaming
  • Lab
    • Infos
    • Hardware
    • Preparing the OS
    • Installing the Red Team home lab
    • ELK
    • Deploying Full Lab
  • Tools
    • C2 Framework
  • OSINT & RECON
    • Passive Reconnaissance
    • OSINT Framework
Powered by GitBook
On this page
  • OSINT Framework
  • Spiderfoot
  • Amass
  1. OSINT & RECON

OSINT Framework

After doing manually reconnaissance on our target we will see how to use framework that automatize all these techniques

PreviousPassive Reconnaissance

Last updated 3 years ago

OSINT Framework

Spiderfoot

SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.

SpiderFoot has an embedded web-server for providing a clean and intuitive web-based interface but can also be used completely via the command-line. It's written in Python 3 and GPL-licensed.

Installation

wget https://github.com/smicallef/spiderfoot/archive/v3.4.tar.gz
tar zxvf v3.4.tar.gz
cd spiderfoot-3.4
pip3 install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001

Running a scan

We run a scan against our target: breachdefs.com

Results

Once finish we can visualize our results as a graph.

From it we can see that:

  • there is an exchange server running on 192.168.42.11

Amass

The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.

Installation

apt install amass

Running a scan

amass enum -d breachdefs.com

Results

Once finish we get two subdomains: www.breachdefs.com and owa.breachdefs.com

a webserver at

we also get an email:

https://www.breachdefs.com
david_lightman@breachdefs.com
GitHub - smicallef/spiderfoot: SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.GitHub
GitHub - OWASP/Amass: In-depth Attack Surface Mapping and Asset DiscoveryGitHub
Logo
Logo
How to run a scan with SpiderFoot
Graph results of the scan
Amass results