Information Gathering

It’s a passive or active way of collecting information about your target, without directly interacting with the host/services. You scope out your attack surface.
Eg – Find domain, subdomains, IP-ranges, SSL/TLS certificates, public web pages, API endpoints, past breaches, public github repositories.

Tools

Subdomains - Subfinder, OWASP Amass, Sublist3r, nmmapper.com(website)
SSL/TLS cert - Qualys SSL Labs, crt.sh(website)
Past data breaches involving API endpoints - https://escape.tech/resources/api-threat-landscape
Webpages – robots.txt, sitemap.xml, Google dorking, Gobuster, Wayback Machine

Google Dorking Commands

Basics

site:example.com
Shows results for the domain example.com only
site:*.example.com
All subdomains of example.com (e.g. mysite.example.com)

For Login Pages

🔍 site:example.com inurl:admin

🔍 site:*.example.com inurl:admin/login
→ (“admin login”) use quotes for multiword phrases

🔍 site:*.example.com intitle:login/admin
→ (“login” / “admin” / “login page”) use quotes for exact words

Directory Listing

🔍 site:*.example.com intitle:"Index of /"
→ very useful and powerful

🔍 site:*.example.com intitle:"index of" "parent directory"
→ finds pages with <title>Index of</title> containing “parent directory”

🔍 site:*.example.com inurl:ftp
→ old but sometimes used for files/backups

🔍 site:*.example.com inurl:wp-content
→ for WordPress sites

Finding Files

🔍 site:example.com ext:xls OR ext:csv OR ext:doc

🔍 site:example.com (ext:pdf OR filetype:pdf)
→ ext:pdf is more precise than filetype:pdf (other: txt, robots.txt, sitemap, docx, xlsx, log, xml)

🔍 site:example.com filetype:env
→ try env, ini, sql, bak for sensitive info

Subdomain Enumeration

Websites

  • 🌐 crt.sh
  • 🌐 pentest-tools.com/information-gathering/find-subdomains-of-domain

Tools

  • 🛠️ sublist3r - CLI tool for getting all the subdomains of a domain.
    step 1 → git clone https://github.com/aboul3la/Sublist3r.git
    step 2 → cd ~/Sublist3r
    step 3 → python3 -m venv venv
    step 4 → source venv/bin/activate
    step 5 → pip install -r requirements.txt
    step 6 → python sublist3r.py -d example.com
    step 7 → python sublist3r.py -d example.com > subdomains.txt
    step 8 → deactivate

for step 6 - run inside the Sublist3r directory—where the sublist3r.py file is located.
for step 7 - run if you want to save the result in a file.
for step 8 - after using you can type to exit out of venv -> virtual environment

  • shodan / spiderfoot - browsers for advance search

Directory and File Enumeration - (Gobuster)

  • Gobuster supports both protocols, and you can specify the target URL using either http:// or https://. When using HTTPS, you may encounter certificate validation errors, especially with self-signed certificates, which can be bypassed using the -k or –no-tls-validation flag to skip SSL certificate verification.