In this lesson,
we're going to talk about two more tools
that are highly valuable for reconnaissance
and enumeration and pentesting.
DNSdumpster
and Amass.
First, let's discuss DNSdumpster.
DNSdumpster is a free domain research tool
that provides information
about the DNS infrastructure of a domain.
It helps you map out the domain's footprint
by identifying all associated subdomains,
IP addresses, and MX records.
This tool is particularly useful
for uncovering the DNS landscape of a target,
which can reveal critical information
about the target's network.
When conducting reconnaissance,
understanding the DNS configuration of your target
can provide significant insights.
DNSdumpster simplifies this by offering
a clear visual representation of the target's DNS records.
For example,
by using DNSdumpster you can discover subdomains
that are not directly linked from the main website,
but are still part of the organization's infrastructure.
These subdomains can sometimes host
development environments,
backup services,
or administrative portals that might be less secure.
Imagine you're tasked
with performing a pentest on DionTraining.com.
By using DNSdumpster,
you can uncover a subdomain like dev.diontraining.com,
which leads to a development environment
that's not as tightly secure as a production environment.
This subdomain might use weaker passwords
or outdated software,
providing a potential entry point for the exploitation.
DNSdumpster can also help to identify
potential misconfigurations in A DNS setup,
such as exposed mail servers or old unused records
that should have been removed.
These misconfigurations can sometimes lead
to security vulnerabilities,
like open relays,
which are SMTP servers that are misconfigured
to allow anyone on the internet
to send emails through them,
regardless if there are authorized users or not.
These misconfigurations can also allow DNS zone transfers,
which can be exploited during an attack.
Now let's shift our focus to Amass.
Amass is an open-source tool developed by OWASP
for performing in-depth DNS enumeration
and mapping out the external assets of a target.
It uses various techniques to gather information,
including passive information gathering from public sources,
active DNS probing,
and brute-forcing subdomains.
Amass stands out
because it's actively maintained and updated,
ensuring it keeps up
with the latest techniques and methodologies,
unlike many other tools
that might not be consistently updated.
This makes Amass highly effective
for discovering the full scope
of an organization's external infrastructure.
Amass as a command line tool
excels at providing a comprehensive view
of the target's external domain landscape.
It integrates with over 80 data sources
and APIs to collect information
it then correlates and presents in an organized manner.
This integration and active maintenance by OWASP
provides a level of prestige and confidence in the results,
making it a trustworthy tool
for penetration testing engagements.
Like DNSdumpster,
Amass can be used to uncover hidden subdomains,
map out domain relationships,
and identify IP addresses associated with the target.
This extensive mapping
is critical for understanding the full attack surface.
For instance,
it can reveal that a subdomain
is actually hosted on a third party server,
which might have different security controls
compared to the main organization,
which could give us a good place to look at
for security vulnerabilities.
This information is vital
for understanding where security boundaries lie
and where additional scrutiny might be needed.
Amass also provides options
for active reconnaissance techniques,
such as DNS probing and brute-forcing,
which can uncover even more details
about the target's DNS setup.
This active approach compliments
passive information gathering
and supports a thorough enumeration of the target's assets.
Amass supports various information gathering techniques,
including reading SSL/TLS certificates,
performing DNS zone transfers,
and checking certificate transparency logs.
It also supports recursive subdomain discovery
and can use
Hashcat style masks for brute-forcing subdomains,
which is useful if you have internal information
on name and conventions.
Amass comes with three subdomains
that allow for different functions,
which are the following:
amass intel
for discovering target namespaces for enumerations,
amass enum
for performing enumerations and network mapping,
and amass db
for manipulating the Amass graph database.
These subcommands can be used in conjunction,
allowing you to create scripts
that perform multiple Amass operations seamlessly.
Additionally,
Amass can be configured using a configuration file,
making it easy to maintain, use, or integrate
with other tools and scripts.
Look at the following example.
Here the command
Amass
enum, -passive,
d,
owasp.org, -source
is used to perform a passive enumeration
of the domain owasp.org,
collecting data from various sources
without actively probing the target servers.
The result shows several subdomains discovered.
These subdomains are identified
through data sources like AnubisDB and AlienVault,
demonstrating Amass's ability to integrate
with multiple data sources
to gather comprehensive information.
This approach helps in uncovering hitting subdomains
and understanding the full scope
of an organization's external infrastructure,
making it a vital tool for pentesters in their recon phase.
So remember,
DNSdumpster and Amass are essential tools
for reconnaissance and enumeration efforts.
DNSdumpster helps you to quickly visualize
and understand the DNS landscape of your target,
revealing subdomains and potential misconfigurations.
Amass, a command-line tool by OWASP,
provides a thorough and detailed mapping
of the target's external assets
using a combination of passive and active techniques
to uncover hidden subdomains and domain relationships.
Using these tools will enhance your ability
to gather detailed and comprehensive information
about your target,
laying the groundwork for a successful pentest.