Walkthroughs, Discord, and Fun?
Recon
1. Asset Discovery: Find Apex Domains Whois or DNSChecker Get Your Target’s Organization Name… Whois Example: For IBM Whois works: https://www.whois.com/whois/ibm.com DNSChecker Example: For Uber DNSChecker works: https://dnschecker.org/all-dns-records-of-domain.php?query=uber.com&rtype=ALL&dns=google ASNs + IP Ranges Get your target’s Autonomous System Numbers (ASNs) and/or IP ranges… You can use the data scraper chrome extension to copy the IPs and ASNs. https://bgp.he.net/ Search for organization’s names. There may be multiple names. Save the ASN numbers. Click on the ASN# -> Prefixes v4 to get the IP ranges and save them to a ips.txt file. Asrank Search for organization names. There may be multiple names. Save the ASN number. Go to https://bgp.he.net/ to get the IPv4 ranges and save them to a ips.txt file. You can use org2ip-asn instead, but you might miss some ASNs or IP ranges. Arin and Ripe Search for organization names. There may be multiple names. Save the IP ranges as CIDR (Example: 66.90.225.72/29) to a ips.txt file. Caduceus Use Caduceus to get subdomains and apex domains… ...