Passive Information Gathering

WHOIS

Linux

export TARGET="facebook.com" # Assign our target to an environment variable

whois $TARGET

Windows

C:\htb> whois.exe facebook.com

Get The Tool. Read More.

---

Nslookup & DIG

export TARGET="facebook.com"

nslookup $TARGET

dig facebook.com @1.1.1.1

Querying: A Records for a Subdomain

export TARGET=www.facebook.com

nslookup -query=A $TARGET

dig a www.facebook.com @1.1.1.1

Querying: PTR Records for an IP Address

nslookup -query=PTR 31.13.92.36

dig -x 31.13.92.36 @1.1.1.1

Querying: ANY Existing Records

export TARGET="google.com"

nslookup -query=ANY $TARGET

dig any google.com @8.8.8.8

The more recent RFC8482 specified that ANY DNS requests be abolished. Therefore, we may not receive a response to our ANY request from the DNS server or get a reference to the said RFC8482.

Querying: TXT Records

export TARGET="facebook.com"

nslookup -query=TXT $TARGET

dig txt facebook.com @1.1.1.1

Querying: MX Records

export TARGET="facebook.com"

nslookup -query=MX $TARGET

dig mx facebook.com @1.1.1.1

---

Nslookup

export TARGET="facebook.com"

nslookup $TARGET

---

WHOIS

whois 157.240.199.35

---

VirusTotal

Certificates

• https://censys.io

• https://crt.sh

---

Certificate Transparency

export TARGET="facebook.com"

curl -s "https://crt.sh/?q=${TARGET}&output=json" | jq -r '.[] | "\(.name_value)\n\(.common_name)"' | sort -u > "${TARGET}_crt.sh.txt"

head -n20 facebook.com_crt.sh.txt

curl -s	Issue the request with minimal output.
https://crt.sh/?q=<DOMAIN>&output=json	Ask for the json output.
jq -r '.[]' "\(.name_value)\n\(.common_name)"'	Process the json output and print certificate's name value and common name one per line.
sort -u	Sort alphabetically the output provided and removes duplicates.

We also can manually perform this operation against a target using OpenSSL via:

openssl s_client -ign_eof 2>/dev/null <<<$'HEAD / HTTP/1.0\r\n\r' -connect "${TARGET}:${PORT}" | openssl x509 -noout -text -in - | grep 'DNS' | sed -e 's|DNS:|\n|g' -e 's|^\*.*||g' | tr -d ',' | sort -u

TheHarvester

Read More.

---

Passive Infrastructure Identification

Read More.