Tools
Dig
Domain Name System (DNS) records can provide a wealth of information regarding services that may be exposed to the Internet, but here there be dragons.
The "target" we're going to attack in the lab is an organisation called Cyberbotic. Their domain name is cyberbotic.io. We can start off by performing a simple lookup of any A records for this domain.
Whois
Performing a whois on each public IP address can show who it belongs to. We can see that it resolves to a 3rd party provider, Cloudflare.
Cloud
Some Software as a Service (SaaS) offerings require DNS records on the target domain, in order to point towards those services. A notable example includes Microsoft's Office 365 which can be found at autodiscover.target-domain. If the target uses these SaaS services for email and/or document storage etc, it may be possible to gain access to your objective without ever needing to compromise their network.
DNScan
Email Security
Google Dorking
site: Limit the search results to those from a specific website. site:apple.com
Not so useful by itself but will return every page that Google has indexed for the apple.com domain.
intitle: Find pages with a certain word in the title. intitle:apple
This will return every page that contains the word "apple" in the title.
inurl: Find pages with a certain word in the URL. inurl:apple
This will return every page where "apple" appears in the URL.
intext: Find pages containing a certain word (or words) somewhere in the content. intext:apple
This will return every page where "apple" appears in the body text.
filetype: Search for filetypes that Google understands. site:apple.com filetype:pdf
This will return all PDFs on apple.com. Other filetypes such as docx, pptx and xlsx also work. This could be combined with intitle:report to find all PDFs that have "report" in the name. Google does not understand all filetypes, so inurl could be used instead.
#..#: Search for a range of numbers. site:apple.com filetype:pdf 2020..2022
This will return all PDFs on apple.com which contain the numbers 2020, 2021 and 2022. Useful for finding information constrained to a given timeframe.
-: Exclude a phrase. site:apple.com -www -support
This will return pages indexed on apple.com excluding the www and support domains. Useful for finding other subdomains.
These dorks can be used to find interesting files, web applications and information.
Social Media
Many people also cross-link their social media profiles, so you can find their Twitter/Facebook/Instagram/etc accounts as well. Phishing is still the most prevalent method of compromising a target and gathering both professional and personal information on targets goes a long way to making those pre-texts convincing and enticing.
Last updated