Skip to content

5-Stages of Ethical Hacking

img

  • Reconnaisance (Activate vs Passive)
  • Scanning and Enumaration (nmap, nessus)
  • Gaining Access (Exploitation)
  • Maitaning Access
  • Covering tracs (cleaning up)

Information Gathering

Passive Recon

Types: Physical/Social

  • Location information:

    • satellite images, drone recon
    • building layout

  • Job Information

  • Employees (names, jobtitle, phone number, etc)
  • Pictures (badges photoes, desk photos, computer, etc)

Web/Host

rcon1

Bugcrowd for programs and targets

Discoverig Email Addresses

Hunter for email discovery and verify or Phonebook for chrome as an extesnion clearbit another one verifyemail

Hunting breached credentials

Dehashed

dehashed

Hunting subdomains

apt istall sublister

  • Get subdomains with wublist3r

sublister sub2

Search by certificate with crt.sh

crt

owasp-amass

Identify built with

Check builtwith and wappalyzer for firefox whatweb on kali

builtwith

Installing Tor Browser on Kali Linux

kali@kali:~$ sudo apt update
kali@kali:~$
kali@kali:~$ sudo apt install -y tor torbrowser-launcher
kali@kali:~$

kali@kali:~$ torbrowser-launcher