Pentest Intelligence Gathering

PTES Phase 2: Intelligence Gathering

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante o OSINT ou footprinting você identificar pfSense, ATIVE A SKILL pentest-pfsense imediatamente.

Indicadores de pfSense em OSINT

# Shodan - Passive detection
shodan search "product:pfsense"
shodan search "http.title:pfSense"
shodan search "org:Netgate"

# Censys - Certificate and service discovery
censys search "services.software.product=pfSense"
censys search "services.http.response.html_title:pfSense"

# Google Dorks
site:target.com "pfSense"
site:target.com "Netgate"
intitle:"pfSense Login"

Sinais de Alerta em OSINT

• Menções a "pfSense" ou "Netgate" em documentos públicos
• Certificados SSL com CN=pfSense
• Jobs/postagens mencionando pfSense
• Configurações vazadas com referências pfSense
• Screenshots públicos da web GUI

Ação Imediata

# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para intelligence gathering geral
# Use pentest-pfsense para:
# - Passive reconnaissance específica (Shodan/Censys)
# - CVE mapping para versão detectada
# - Feature-based testing especializado

🎯 cPanel & WHM Detection & Routing

IMPORTANTE: Se durante o OSINT ou footprinting você identificar cPanel ou WHM, ATIVE A SKILL pentest-exploitation para CVE-2026-41940.

Indicadores de cPanel/WHM em OSINT

# Shodan - Passive detection
shodan search "product:cpanel"
shodan search "http.title:cPanel"
shodan search "http.title:WHM"
shodan search "port:2087"  # WHM
shodan search "port:2083"  # cPanel
shodan search "port:2095"  # cPanel Webmail
shodan search "port:2096"  # Webmail SSL

# Censys - Certificate and service discovery
censys search "services.software.product=cPanel"
censys search "services.http.response.html_title:cPanel"
censys search "services.http.response.html_title:WHM"

# Google Dorks
site:target.com "cPanel"
site:target.com "WHM"
intitle:"cPanel Login"
intitle:"WHM Login"
inurl:2087
inurl:2083

Sinais de Alerta em OSINT

• Menções a "cPanel" ou "WHM" em documentos públicos
• Certificados SSL com CN=cPanel ou CN=WHM
• Jobs/postagens mencionando cPanel hosting
• Configurações vazadas com referências cPanel
• Screenshots públicos do cPanel/WHM
• Domínios com nameservers ns1.target.com, ns2.target.com (padrão cPanel)

Indicadores de Rede Ativa

# Port scanning com Naabu
naabu -host target.com -p 2087,2083,2095,2096 -silent

# HTTP probing com httpx
httpx -u https://target.com:2087 -title -tech-detect
httpx -u https://target.com:2083 -title -tech-detect

# Banner grabbing
curl -sk https://target.com:2087/login | grep -iE "cPanel|WHM"

Ação Imediata

# Se cPanel/WHM detectado → ATIVAR pentest-exploitation skill
# Testar CVE-2026-41940 (Authentication Bypass CVSS 9.8)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET:2087 -u admin -p password detect

# Se vulnerável → Explorar
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET:2087 -u admin -p password exploit

Seções PTES para Intelligence Gathering

2.1 OSINT (Open Source Intelligence)

• 2.1.1 Corporate: Informações da entidade legal, filings estaduais
• 2.1.2 Physical: Localizações físicas, proprietários, registros de impostos
• 2.1.3 Datacenter Locations: Fuso horário, produtos/serviços, organograma
• 2.1.4 Relationships: Charity affiliations, network providers, business partners

2.2 Individuals

• 2.2.1 Social Networking Profiles
• 2.2.2 Social Networking Websites
• 2.2.3 Cree.py para geolocalização

2.3 Internet Footprint

• 2.3.1 Email addresses (Maltego, TheHarvester, NetGlub)
• 2.3.2 Usernames/Handles
• 2.3.3 Social Networks (Newsgroups, Mailing Lists, Chat Rooms, Forums)
• 2.3.4 Personal Domain Names
• 2.3.5 Personal Activities (Audio, Video)
• 2.3.6 Archived Information
• 2.3.7 Electronic Data (Document leakage, Metadata leakage)

2.4 Covert Gathering

• 2.4.1 On-location gathering (Adjacent facilities, Physical security, Employee behavior)
• 2.4.2 Frequency Usage
• 2.4.3 Equipment Identification (Airmon-ng, Airodump-ng, Kismet, inSSIDer)

2.5 External Footprinting

• 2.5.1 Identifying IP Ranges (WHOIS lookup, BGP looking glasses)
• 2.5.2 Active Reconnaissance
• 2.5.3 Passive Reconnaissance
• 2.5.4 Active Footprinting (Zone transfers, Reverse DNS, DNS Bruting, Port Scanning with Naabu, SNMP Sweeps, Banner Grabbing)

2.6 Internal Footprinting

• 2.6.1 Active Footprinting (Ping Sweeps, Port Scanning, SNMP Sweeps, Banner Grabbing)

Coleta de Informações com WorstAssume

1. Enumeração Inicial do Ambiente (PTES 2.5.4 - Active Footprinting)

# Enumeração completa com stealth mode (jitter 0.3-1.2s entre API calls)
worst enumerate --profile <profile> --region us-east-1 --stealth

# Com credenciais explícitas
worst enumerate --access-key AKIA... --secret-key ... --session-token ...

# Com assume-role para contas cross-account
worst enumerate --profile default --assume-role arn:aws:iam::TARGET:role/AuditRole

# Enumeração multi-conta (script enum.sh)
./enum.sh > log.txt  # Enumera 14+ contas em sequência

2. Informações Coletadas Automaticamente (PTES 2.5 - External Footprinting)

IAM Intelligence (Identidade) - worstassume/modules/iam.py

• Usuários IAM: ARN, path, create_date, inline policies, attached policies
• Roles: ARN, trust policy JSON, inline policies, attached policies
• Grupos: ARN, path, memberships (users), policies attached
• Políticas Managed: Document JSON, versions, attachment count
• Capability Map: Permissões detectadas via probing (iam:ListUsers, iam:GetPolicy, etc.)
• Group Memberships: User → Group mappings (herança de permissões)

Recursos de Computação (worstassume/modules/*.py)

• EC2 (ec2.py): Instances, instance profiles, metadata options (IMDSv1/v2), tags
• Lambda (lambda_.py): Functions, execution roles, triggers, environment variables
• ECS (ecs.py): Clusters, services, task definitions, task roles
• VPC (vpc.py): VPCs, subnets, security groups, endpoints

Armazenamento e Dados

• S3 (s3.py): Buckets, bucket policies, ACLs, public access block
• Secrets Manager: Secrets list (via capability probing)
• SSM Parameter Store: Parameters (via capability probing)

Rede (PTES 2.5.1 - IP Ranges)

• VPCs: CIDR blocks, DHCP options, DNS settings
• Subnets: AZ, CIDR, route tables, NAT gateways
• Security Groups: Ingress/egress rules, referenced VPCs
• VPC Endpoints: Interface/Gateway endpoints, policies

3. Workflow de Enumeração (WorstAssume Adaptive Enumeration)

Fast Path vs Slow Path (worstassume/modules/iam.py)

FAST PATH (iam:GetAccountAuthorizationDetails):
- 1 chamada API = todos usuários, grupos, roles, políticas
- ~2-5 segundos para conta completa
- Requer: iam:GetAccountAuthorizationDetails

SLOW PATH (fallback quando fast path não disponível):
- 50-200+ chamadas API individuais
- ~30-120 segundos dependendo do tamanho da conta
- Requer: iam:ListUsers, iam:ListRoles, iam:ListGroups, etc.

CAPABILITY PROBING (worstassume/core/capability.py):
Antes de enumerar, WorstAssume detecta automaticamente:
- iam_full_dump: Pode usar fast path?
- iam_list_users: Pode listar usuários?
- iam_list_roles: Pode listar roles?
- iam_list_policies: Pode listar políticas?
- ec2_full, s3_full, lambda_full, etc.

Módulos de Enumeração (executados em sequência)

# Cada módulo é executado com jitter (se --stealth)
# Ordem de execução no worstassume/cli.py:

1. Identity (identity_mod.get_caller_identity)
   → Retorna: ARN, Account ID, Principal Type

2. IAM (iam.enumerate)
   → Usuários, Groups, Roles, Policies, Memberships

3. EC2 (ec2.enumerate)
   → Instances, Instance Profiles, Metadata Options

4. S3 (s3.enumerate)
   → Buckets, Bucket Policies

5. Lambda (lambda_.enumerate)
   → Functions, Execution Roles

6. ECS (ecs.enumerate)
   → Clusters, Task Definitions, Task Roles

7. VPC (vpc.enumerate)
   → VPCs, Subnets, Security Groups

4. Cross-Account Intelligence (worstassume/core/cross_account.py)

Inferência Automática de Trust Relationships

# Após enumerar múltiplas contas, WorstAssume detecta automaticamente:
worst accounts list  # Mostra contas enumeradas

# Cross-account links são inferidos sem chamadas API adicionais
# Analisando trust policies das roles no banco de dados

Trust Relationships Mapeadas (PTES 2.1.4 - Relationships)

Cross-Account Links Detectados:
├── Account A (111111111111) → Account B (222222222222)
│   └── Role: CrossAccountRole
│       ├── Trust Principal: arn:aws:iam::111111111111:root
│       ├── Wildcard: NO
│       └── Condition: sts:ExternalId (presente)
│
└── Account A (111111111111) → Account C (333333333333)
    └── Role: AdminCrossAccount
        ├── Trust Principal: * (wildcard!)
        ├── Wildcard: YES (CRITICAL!)
        └── Condition: NONE

# Detectado por: worstassume/core/cross_account.py:build_cross_account_links()
# Regex de extração: arn:aws[^:]*:[^:]*:[^:]*:(\d{12}):

Wildcard Trust Detection (CRITICAL Finding)

# Detecção automática durante análise de trust policies:
if principal_block == "*":
    is_wildcard = True  # Qualquer principal pode assumir
    severity = "CRITICAL"
elif "aws:PrincipalOrgID" in condition:
    is_wildcard = True  # Todo o organization pode assumir
    severity = "HIGH"

5. Mapeamento de Superfície de Ataque (PTES 2.5.4 - Active Footprinting)

Identidade Inicial (worstassume/modules/identity.py)

# Identificar quem somos (PTES 2.5.4.7 - Banner Grabbing)
aws sts get-caller-identity

# Output esperado:
# {
#   "UserId": "AIDAI...",
#   "Account": "123456789012",
#   "Arn": "arn:aws:iam::123456789012:user/auditor"
# }

Capability Probing Results

Capability Map Exemplo (após enumeration):
├── iam_full_dump: TRUE (fast path disponível)
├── iam_list_users: TRUE
├── iam_list_roles: TRUE
├── iam_list_policies: TRUE
├── ec2_describe_instances: TRUE
├── s3_list_buckets: TRUE
├── lambda_list_functions: TRUE
├── ecs_list_clusters: TRUE
└── vpc_describe_vpcs: TRUE

6. Database e Persistência (worstassume/db/)

SQLite Database Schema

Database: ~/.worstassume/db.sqlite

Tables:
├── accounts (account_id, account_name, org_id, profile, last_enumerated_at)
├── runs (account_id, started_at, completed_at, capabilities_json, success)
├── principals (arn, name, principal_type, account_id, trust_policy_json, path)
├── policies (arn, name, policy_type, account_id, document_json)
├── resources (arn, name, service, resource_type, account_id, execution_role_id, extra_json)
├── principal_policies (principal_id, policy_id)
├── group_memberships (user_id, group_id)
├── cross_account_links (source_account_id, target_account_id, role_arn, trust_principal_arn, is_wildcard)
└── security_findings (entity_arn, category, path_id, severity, message)

Comandos de Gestão de Database

# Listar contas enumeradas
worst accounts list

# Output:
# Account ID     Name          Principals  Resources  Last Enumerated
# 123456789012   DEV-Prod      142         89         2026-04-24 15:30
# 222222222222   STG-Data      67          34         2026-04-24 16:45

# Deletar conta e todos os dados
worst accounts delete 123456789012

# Exportar grafo para análise externa
worst graph-export --output graph.json

5. Análise Cross-Account Automática (PTES 2.1.4 - Relationships)

# Após enumerar múltiplas contas, WorstAssume detecta automaticamente:
# - Trust relationships entre contas
# - Wildcard trust policies (Principal: *)
# - Cross-account role assumptions

Trust Relationships Mapeadas

Cross-Account Links (PTES 2.1.4 - Relationships):
- Account A (111111111111) → Account B (222222222222)
  └── Role: CrossAccountRole (Wildcard: YES)
- Account A (111111111111) → Account C (333333333333)
  └── Role: DevRole (Wildcard: NO)

6. Documentação da Inteligência (PTES 2.6 - Internal Footprinting)

Inventário de Principais

Conta: 123456789012
├── Usuários: 15
├── Roles: 42
├── Grupos: 8
├── Políticas Managed: 25
└── Políticas Inline: 67

Inventário de Recursos (PTES 2.5.4 - Active Footprinting)

Conta: 123456789012
├── EC2 Instances: 120
├── Lambda Functions: 35
├── ECS Clusters: 5
├── S3 Buckets: 28
└── VPCs: 12

7. Análise Preliminar de Riscos (PTES 3.3 - Attack Avenues)

Red Flags Imediatas

• Trust policies com Principal: "*"
• Políticas com Action: "*" e Resource: "*"
• IAM Users com console access sem MFA
• Access keys antigas (> 90 dias)
• EC2 instances com IMDSv1 habilitado
• Lambda functions com permissões administrativas

PTES 2.3.7 - Metadata Leakage

• S3 buckets com listagem pública
• EC2 metadata endpoint exposto (IMDSv1)
• Lambda environment variables com secrets

8. Ferramentas de Inteligência (PTES Tools Required)

WorstAssume Commands

# Listar contas enumeradas
worst accounts list

# Exportar grafo para análise externa (PTES 6.2 - Technical Reporting)
worst graph-export --output graph.json

# Visualizar dashboard
worst viz

AWS CLI Commands Úteis

# Identidade (PTES 2.5.4.7 - Banner Grabbing)
aws sts get-caller-identity

# Região atual
aws configure get region

# Listar todas as regiões
aws ec2 describe-regions --query 'Regions[].RegionName'

# Descrever ranges de IP (PTES 2.5.1 - IP Ranges)
aws ec2 describe-prefix-lists --query 'PrefixLists[?PrefixListName*`com.amazonaws']'

Ferramentas OSINT Externas (PTES Software)

# theHarvester (PTES 2.3.1 - Email addresses)
theHarvester -d target.com -b google,linkedin

# Maltego (PTES 2.3.1.1)
# Interface gráfica para OSINT correlation

# Subfinder (PTES 2.3.4 - Domain Names)
subfinder -d target.com -o domains.txt

# Amass (PTES 2.3.4)
amass enum -d target.com -o amass_domains.txt

Network Scanning e Firewall Mapping com Naabu e hping3 (PTES 2.5.4 - Active Footprinting)

Naabu - Port Scanning Primário (Recomendado)

Naabu é a ferramenta primária para port scanning neste framework. Use naabu para:

• Enumeração rápida de portas em múltiplos hosts
• Output estruturado (JSON/CSV) para integração com outras ferramentas
• Scan de grandes ranges (CIDR) e listas de hosts
• CDN/WAF detection automática
• Integração nativa com httpx, nuclei, subfinder

# Scan básico (top 100 ports)
naabu -host target.com -silent

# Todas as portas
naabu -host target.com -p - -silent

# Lista de hosts
naabu -l hosts.txt -silent

# Output JSON para pipeline
naabu -host target.com -j -o output.json

# Integração com httpx
naabu -host target.com -silent | httpx -silent

# Host discovery
naabu -host 192.168.1.0/24 -sn -silent

# CDN/WAF exclusion
naabu -host target.com -ec -silent

# Smart scan (predictive port scanning)
naabu -host target.com -ss

Ver /root/.pcode/skills/pentest-network-scanning/SKILL.md para documentação completa do Naabu.

Quando usar hping3 (Complementar)

Use hping3 como ferramenta complementar quando:

Host Discovery (PTES 2.5.4.1 - Ping Sweeps)

# SYN scan na porta 80 para descobrir hosts vivos
hping3 -S -p 80 --scan 1-254 192.168.1.1

# ICMP scan para host discovery
hping3 -1 -c 5 192.168.1.1

# TCP ACK scan (bypass de firewalls stateless)
hping3 -A -p 80 192.168.1.1

# UDP scan para discovery
hping3 -2 -p 53 192.168.1.1

Port Scanning (PTES 2.5.4.8 - Port Scanning)

# SYN scan em range de portas (stealth scan)
hping3 -S -p 1-1000 --scan target.com

# Scan em portas específicas
hping3 -S -p 22,80,443,8080 --scan target.com

# XMAS scan (difícil de detectar por IDS)
hping3 -F -P -U -p 1-1000 --scan target.com

# NULL scan (sem flags)
hping3 -O -p 1-1000 --scan target.com

Firewall Ruleset Mapping (PTES 2.5.4 - Active Footprinting)

# Testar se firewall permite SYN
hping3 -S -p 80 target.com
# SYN-ACK = porta aberta
# RST = porta fechada
# Sem resposta = filtrada

# Testar se firewall é stateful (ACK scan)
hping3 -A -p 80 target.com
# RST = porta não filtrada (firewall stateless)
# Sem resposta = firewall stateful ou drop

# Mapear regras com TTL customizado
hping3 -S -p 80 -t 64 target.com
hping3 -S -p 80 -t 128 target.com

Template de Finding - Network Discovery com hping3

FINDING: NETWORK-DISCOVERY-HPING3
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting

TARGET:
- IP/Hostname: [target]
- Portas descobertas: [lista]
- Hosts ativos: [lista]

DESCRIPTION:
Host discovery e port scanning via hping3 identificou [X] hosts ativos
e [Y] portas abertas na rede alvo. hping3 permitiu bypass de filtros
que bloqueavam scans tradicionais do nmap.

EVIDENCE:
hping3 -S -p 1-1000 --scan [target]
[Output do scan]

TECHNIQUE:
- SYN scan (-S): Identifica portas abertas via SYN-ACK
- ACK scan (-A): Mapeia firewalls stateless
- XMAS scan (-FPU): Evasão de IDS básico

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

Advanced: Packet Crafting para Evasão (PTES 4.1.1 - Countermeasure Bypass)

# Random source IP (spoofing para testes de IDS/IPS)
hping3 -S -p 80 --rand-source target.com

# Fragmented packets (bypass de ACLs fracas)
hping3 -S -p 80 -f target.com

# Don't fragment flag
hping3 -S -p 80 -y target.com

# Custom TTL para OS fingerprinting
hping3 -S -p 80 -t 64 target.com   # Windows típico
hping3 -S -p 80 -t 128 target.com  # Linux típico

# Source address spoofing
hping3 -S -p 80 -a 10.0.0.1 target.com

ICMP Tunneling Detection (PTES 2.4 - Covert Gathering)

# Testar se ICMP é permitido (potencial tunnel vector)
hping3 -1 -d 1024 target.com  # ICMP com data payload

# Large ICMP packets (covert channel testing)
hping3 -1 -d 65000 target.com

# ICMP timestamp request
hping3 -1 -C 13 -K 0 target.com

Rate Control e Stealth (PTES 2.4.3 - Equipment Identification)

# Scan lento para evitar detecção
hping3 -S -p 1-1000 -i u100000 target.com  # 100ms entre packets

# Scan moderado
hping3 -S -p 1-1000 --fast target.com  # 10 packets/segundo

# Scan rápido (pode ser detectado)
hping3 -S -p 1-1000 --faster target.com  # 100 packets/segundo

Traceroute Mode (PTES 2.5.1 - IP Ranges)

# Traceroute via SYN packets
hping3 -S -p 80 -T traceroute target.com

# Traceroute via ICMP
hping3 -1 -T traceroute target.com

# Traceroute com TTL fixo (monitorar hop específico)
hping3 -S -p 80 -t 5 --tr-keep-ttl target.com

Record Route (PTES 2.5.1 - Identifying IP Ranges)

# Incluir RECORD_ROUTE option
hping3 -S -p 80 -G target.com

# Loose source routing
hping3 -S -p 80 --lsrr target.com

# Strict source routing
hping3 -S -p 80 --ssrr target.com

9. OWASP Nettacker for Intelligence Gathering (PTES 2.5 - External Footprinting)

NOTE: Nettacker complementa Naabu e hping3 com detecção automática de tecnologias, subdomain enumeration, e WAF detection em uma única ferramenta.

9.1 Subdomain Enumeration com Nettacker

# Enumeração passiva de subdomínios (sem scan ativo)
docker run --rm owasp/nettacker -i target.com -m subdomain_scan

# Subdomínios + detecção de tecnologias
docker run --rm owasp/nettacker -i target.com -m subdomain_scan,web_technologies_scan

# Output JSON para integração
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i target.com -m subdomain_scan \
  --json-output /tmp/subdomains.json

# API integration
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')
curl -k -X POST "https://localhost:5000/new/scan" \
  -d "key=${API_KEY}&targets=target.com&selected_modules=subdomain_scan"

Template de Finding - Subdomain Discovery:

FINDING: SUBDOMAIN-DISCOVERY-NETTACKER
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.2 - Active Reconnaissance

TARGET: target.com
SUBDOMAINS FOUND: [X]
- api.target.com (203.0.113.10)
- admin.target.com (203.0.113.11)
- dev.target.com (203.0.113.12)

DESCRIPTION:
Nettacker subdomain enumeration identified [X] subdomains through passive
OSINT sources and DNS brute-forcing. Several subdomains expose administrative
interfaces and development environments.

EVIDENCE:
docker run --rm owasp/nettacker -i target.com -m subdomain_scan

REMEDIATION:
- Implement DNS zone transfer restrictions
- Remove unused subdomains from DNS
- Apply WAF to exposed administrative subdomains
- Consider DNS wildcard records for unused prefixes

PTES REFERENCE: Section 2.5.2 (Active Reconnaissance)

9.2 Web Technology Detection (PTES 2.5.4.7 - Banner Grabbing)

# Detecção de tecnologias web (CMS, frameworks, servidores)
docker run --rm owasp/nettacker -i target.com -m web_technologies_scan

# CMS-specific detection
docker run --rm owasp/nettacker -i target.com \
  -m wordpress_scan,joomla_scan,drupal_scan

# Output detalhado com versões
docker run --rm owasp/nettacker -i target.com -m web_technologies_scan \
  --graph-output /tmp/report.html

Tecnologias Detectadas Automaticamente:

• CMS: WordPress, Joomla, Drupal
• Web Servers: Apache, Nginx, IIS, LiteSpeed
• Frameworks: Django, Flask, Laravel, Express, Rails
• JavaScript: React, Vue, Angular
• Analytics: Google Analytics, Facebook Pixel
• CDNs: Cloudflare, Akamai, Fastly
• WAFs: ModSecurity, Cloudflare, AWS WAF

Template de Finding - Technology Stack:

FINDING: TECH-STACK-DETECTION
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4.7 - Banner Grabbing

TARGET: https://target.com
TECHNOLOGIES DETECTED:
- WordPress 6.4.2 (CMS)
- Apache 2.4.57 (Web Server)
- PHP 8.1.12 (Runtime)
- Cloudflare (CDN/WAF)
- Google Analytics (Tracking)

DESCRIPTION:
Nettacker web technologies scan identified the complete technology stack.
WordPress version disclosure allows targeting version-specific CVEs.
Cloudflare presence indicates WAF bypass techniques may be required.

RISK ASSESSMENT:
- WordPress 6.4.2: Check WPScan for plugin vulnerabilities
- Apache 2.4.57: Check CVE-2023-25690, CVE-2023-31122
- PHP 8.1.12: Check for deserialization vulnerabilities

PTES REFERENCE: Section 2.5.4.7 (Banner Grabbing)

9.3 WAF Detection (PTES 2.5.4 - Active Footprinting)

# WAF detection e fingerprinting
docker run --rm owasp/nettacker -i target.com -m waf_scan

# WAF + tecnologias web
docker run --rm owasp/nettacker -i target.com -m waf_scan,web_technologies_scan

# API integration
curl -k -X POST "https://localhost:5000/new/scan" \
  -d "key=${API_KEY}&targets=target.com&selected_modules=waf_scan"

WAF Products Detected:

• ModSecurity, Cloudflare, AWS WAF, Azure WAF
• Akamai Kona, F5 BIG-IP ASM, Imperva
• Barracuda, Citrix NetScaler, FortiWeb
• NAXSI, URLScan, Yundun

9.4 Admin Panel Discovery (PTES 2.5.4 - Active Footprinting)

# Admin panel discovery com wordlists otimizadas
docker run --rm owasp/nettacker -i target.com -m admin_scan

# Admin + directory enumeration
docker run --rm owasp/nettacker -i target.com -m admin_scan,dir_scan

# Custom wordlist
docker run --rm -v $(pwd)/wordlists:/wordlists owasp/nettacker \
  -i target.com -m admin_scan \
  --scan-args "-w /wordlists/admin-panels.txt"

Paths Comuns Testados:

/admin, /administrator, /wp-admin, /phpmyadmin
/login, /signin, /dashboard, /console
/manager, /cpanel, /webmail, /controlpanel

9.5 Directory Enumeration (PTES 2.5.4 - Active Footprinting)

# Directory brute forcing
docker run --rm owasp/nettacker -i target.com -m dir_scan

# Directory + file enumeration
docker run --rm owasp/nettacker -i target.com \
  -m dir_scan --scan-args "--wordlist /usr/share/wordlists/dirb/common.txt"

# Recursive scanning
docker run --rm owasp/nettacker -i target.com -m dir_scan \
  --scan-args "--depth 3"

9.6 Reverse IP Lookup (PTES 2.5.1 - Identifying IP Ranges)

# ViewDNS reverse IP lookup (shared hosting detection)
docker run --rm owasp/nettacker -i target.com -m viewdns_reverse_iplookup_scan

# Identificar outros domínios no mesmo IP
# Útil para descobrir siblings em shared hosting

9.7 Full Recon Workflow (Nettacker + Existing Tools)

# Step 1: Subdomain enumeration (Nettacker)
docker run --rm owasp/nettacker -i target.com -m subdomain_scan \
  --json-output /tmp/subdomains.json

# Step 2: Extract live domains
jq -r '.[] | select(.result.subdomain_found == true) | .result.subdomain_found' \
  /tmp/subdomains.json | tee live_subdomains.txt

# Step 3: Port scanning (Naabu - mais rápido para grandes ranges)
naabu -l live_subdomains.txt -o ports.json -j

# Step 4: Web tech detection (Nettacker)
for domain in $(cat live_subdomains.txt); do
  docker run --rm owasp/nettacker -i $domain -m web_technologies_scan \
    --json-output /tmp/tech_${domain}.json &
done
wait

# Step 5: WAF detection (Nettacker)
for domain in $(cat live_subdomains.txt); do
  docker run --rm owasp/nettacker -i $domain -m waf_scan \
    --json-output /tmp/waf_${domain}.json &
done
wait

# Step 6: Consolidate results
cat /tmp/tech_*.json | jq -s '.' > /tmp/tech_consolidated.json
cat /tmp/waf_*.json | jq -s '.' > /tmp/waf_consolidated.json

9.8 Nettacker + OSINT Combined Workflow

# Step 1: Shodan passive recon
shodan search "org:TargetCorp" > shodan_results.txt

# Step 2: Censys certificate search
censys search "services.http.response.html_title:TargetCorp" > censys_certs.txt

# Step 3: Nettacker subdomain enumeration
docker run --rm owasp/nettacker -i target.com -m subdomain_scan \
  --json-output nettacker_subs.json

# Step 4: Wayback Machine historical URLs
waybackurls target.com > wayback_urls.txt

# Step 5: Consolidate all sources
cat shodan_results.txt censys_certs.txt nettacker_subs.json wayback_urls.txt \
  | sort -u > consolidated_recon.txt

# Step 6: Filter for sensitive paths
grep -iE "admin|login|api|backup|config|dev|staging" consolidated_recon.txt

9.9 Comparison: Nettacker vs Subfinder for Subdomain Enum

Recommended Workflow:

# Use Subfinder for initial fast enumeration
subfinder -d target.com -o subs_fast.txt

# Use Nettacker for deep scan with DNS brute-forcing
docker run --rm owasp/nettacker -i target.com -m subdomain_scan

# Combine results
cat subs_fast.txt nettacker_subs.txt | sort -u > all_subs.txt

# Proceed with Naabu + httpx + nuclei
cat all_subs.txt | naabu -silent | httpx -silent | nuclei

10. Username Enumeration com security-usernames

Recursos Disponíveis (security-usernames plugin)

Local: `seclists-categories usernames/usernames/references/`

Wordlists Disponíveis:
- `Names/names.txt` - Nomes comuns para enumeration
- `top-usernames-shortlist.txt` - Top usernames para teste rápido
- `cirt-default-usernames.txt` - Default accounts de serviços

Técnicas de Username Enumeration

# Usar wordlists com ffuf
ffuf -w seclists-categories/usernames/top-usernames-shortlist.txt \
     -u https://target.com/users/FUZZ \
     -mc 200

# Usar com curl para teste de existência
for user in $(cat seclists-categories/usernames/cirt-default-usernames.txt); do
    curl -s -o /dev/null -w "%{http_code}" "https://target.com/api/users/$user"
done

# Integrar com ferramentas OSINT
theHarvester -d target.com -b google,linkedin
subfinder -d target.com -o domains.txt

Default Accounts para Testar (cirt-default-usernames.txt)

admin, root, test, guest, user, operator
service, backup, oracle, postgres, mysql
tomcat, jenkins, deploy, www-data

11. API Key Discovery com security-patterns

Recursos Disponíveis (security-patterns plugin)

Local: `seclists-categories pattern-matching/pattern-matching/references/`

Patterns Disponíveis:
- `malicious.txt` - Padrões de código malicioso
- `pcap-strings.txt` - Strings para análise de PCAP
- `php-auditing.txt` - Patterns para auditoria PHP
- `grepstrings-basic.txt` - Strings básicas para grep
- `errors.txt` - Padrões de mensagens de erro

Pattern Matching para API Keys

# AWS Access Keys
grep -rE "AKIA[0-9A-Z]{16}" . 2>/dev/null

# Google Cloud API Keys
grep -rE "AIza[0-9A-Za-z_-]{35}" . 2>/dev/null

# GitHub Tokens
grep -rE "ghp_[0-9a-zA-Z]{36}" . 2>/dev/null

# Generic API Keys
grep -riE "api[_-]?key.*[=:]\s*['\"][0-9a-zA-Z]{32,}['\"]" . 2>/dev/null

# Private Keys
grep -r "BEGIN.*PRIVATE KEY" . 2>/dev/null

# Passwords em código
grep -riE "password\s*[=:]\s*['\"][^'\"]+['\"]" . 2>/dev/null

Script de Scan Automatizado

import re
import os

patterns = {
    'AWS_KEY': r'AKIA[0-9A-Z]{16}',
    'GCP_KEY': r'AIza[0-9A-Za-z_-]{35}',
    'GITHUB_TOKEN': r'ghp_[0-9a-zA-Z]{36}',
    'GENERIC_API_KEY': r'api[_-]?key.*[=:]\s*['"][0-9a-zA-Z]{32,}['"]',
    'GENERIC_SECRET': r'secret.*[=:]\s*['"][0-9a-zA-Z]{32,}['"]',
    'PASSWORD': r'password\s*[=:]\s*['"][^'"]+['"]',
    'PRIVATE_KEY': r'BEGIN.*PRIVATE KEY'
}

def scan_file(filepath):
    with open(filepath, 'r', errors='ignore') as f:
        content = f.read()
        for name, pattern in patterns.items():
            matches = re.findall(pattern, content, re.IGNORECASE)
            if matches:
                print(f"[{name}] Found in {filepath}: {len(matches)} matches")

for root, dirs, files in os.walk('.'):
    for file in files:
        if file.endswith(('.py', '.js', '.env', '.config', '.json', '.yaml', '.yml')):
            scan_file(os.path.join(root, file))

Integração com Bug Bounty Recon (bug-bounty-hunter agent)

# Subdomain enumeration + API key discovery
subfinder -d target.com -o subdomains.txt
cat subdomains.txt | httpx -silent | while read url; do
    curl -s "$url" | grep -oE "AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}"
done

# GitHub reconnaissance
curl -s "https://api.github.com/orgs/target/repos" | jq '.[].clone_url'

12. Output Esperado desta Fase (PTES Deliverables)

1. Inventário completo de IAM principals (PTES 2.5 - External Footprinting)
2. Inventário de recursos AWS (PTES 2.5.4 - Active Footprinting)
3. Mapa de trust relationships cross-account (PTES 2.1.4 - Relationships)
4. Lista inicial de misconfigurações (PTES 3.1 - Vulnerability Testing)
5. Capability map das credenciais atuais (PTES 2.5.4 - Active Footprinting)
6. OSINT report com domínios, emails, e infraestrutura externa (PTES 2.1 - OSINT)
7. Network diagram com ranges de IP e VPCs (PTES 2.5.1 - IP Ranges)
8. Username enumeration report (security-usernames plugin)
9. API key discovery report (security-patterns plugin)
10. Asset graph com 29 tipos de assets e edge taxonomy (PTES 2.5.4)
11. Subdomain enumeration results (crt.sh + fallback chain)
12. Dork corpus findings (80+ Google dork templates)
13. Java middleware fingerprint (Spring Boot, Tomcat, WebLogic detection)
14. Information leak checklist (.git, .env, backup files, API docs)
15. Zseano methodology application (parameter insights, testing sequence)
16. Bug bounty triage analysis (high-value targets and features)
17. Email security posture (SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC)

Próximos Passos

Após completar esta fase, prossiga para pentest-threat-modeling (PTES Phase 3)

🤖 AIRecon Integration for Intelligence Gathering

AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante intelligence gathering para automatizar OSINT, network scanning, e descoberta de credenciais.

Invocando AIRecon para Intelligence Gathering

# AIRecon com keywords de OSINT e network discovery
airecon "pentest intelligence gathering osint network scan target.com"

# AIRecon detectará keywords e carregará:
# - pentest-intelligence-gathering.md (skill primária)
# - pentest-network-scanning.md (para network scan)
# - MCP tools: hexstrike (nmap, naabu), cve-mcp, pentestswarm

# Para pfSense-specific OSINT:
airecon "pfsense osint shodan censys reconnaissance"

# Para API key discovery:
airecon "api key discovery github secrets scan target"

AIRecon Slash Commands Úteis para Intelligence Gathering

# Network scanning com Naabu integrado
/naabu-scan --target target.com -p 443,8443,22,80
/naabu-scan --target 192.168.1.0/24 -p - -silent

# API key discovery em repositórios e código
/api-keys --target ./src --recursive
/api-keys --target https://github.com/org/repo --scan-type github

# Wordlist generation para brute-force
/wordlist --type usernames --length 6
/wordlist --type passwords --length 8 --include-symbols

MCP Tool Integration via AIRecon

Durante intelligence gathering, AIRecon pode invocar MCP tools automaticamente:

# hexstrike-local: nmap, naabu, nuclei scans
airecon "scan target.com with nmap version detection"
# → Usará mcp__hexstrike-local__nmap_scan

airecon "run naabu port scan on 192.168.1.0/24"
# → Usará mcp__hexstrike-local__rustscan_fast_scan ou naabu_scan

airecon "run nuclei vulnerability scan on target.com"
# → Usará mcp__hexstrike-local__nuclei_scan

# pentestswarm-remote: Automated reconnaissance campaigns
airecon "start reconnaissance campaign for example.com"
# → Usará mcp__pentestswarm-remote__start_campaign
# → Retornará campaign_id para monitoramento

# cve-mcp: CVE lookup para tecnologias detectadas
airecon "check CVEs for Apache 2.4.57"
# → Usará mcp__cve-mcp__search_cves

# virustotal: Domain e IP reputation
airecon "check domain reputation for suspicious-domain.com"
# → Usará mcp__virustotal__get_domain_report

# osint-remote: Username e email OSINT
airecon "search username john.doe across social networks"
# → Usará mcp__osint-remote__maigret_search

Workflow Example: Intelligence Gathering com AIRecon + Naabu + Nettacker

# 1. Usar AIRecon para OSINT inicial
airecon "osint reconnaissance target.com subdomain enumeration"

# 2. AIRecon auto-carrega pentest-intelligence-gathering.md

# 3. Invocar Naabu via AIRecon para port scanning
airecon "/naabu-scan --target target.com -p - -silent"

# 4. Invocar Nettacker via AIRecon para tech detection
airecon "docker run --rm owasp/nettacker -i target.com -m web_technologies_scan"

# 5. AIRecon processa output e consolida findings
# 6. Exportar para relatório de intelligence gathering
airecon "export findings to JSON for stakeholder review"

Workflow Example: pfSense-Specific Intelligence

# 1. Passive OSINT com Shodan/Censys via AIRecon
airecon "shodan search product:pfsense org:target"

# 2. AIRecon detecta pfSense e ativa pentest-pfsense skill

# 3. Version detection via AIRecon
airecon "censys search services.http.title:pfSense"

# 4. CVE mapping automático
airecon "check CVEs for pfSense 2.7.0"
# → Usará mcp__cve-mcp__search_cves com filtro de severidade

# 5. Exportar findings
airecon "export pfsense intelligence report"

AIRecon Auto-Skill Loading para Intelligence

AIRecon + PentestSwarm Campaign Integration

# Iniciar campanha de reconnaissance automatizada
airecon "start pentestswarm campaign for target.com"

# PentestSwarm retornará campaign_id:
# campaign_abc123

# Monitorar progresso da campanha
airecon "get campaign status campaign_abc123"

# Buscar findings da campanha
airecon "get campaign findings campaign_abc123"

# Exportar resultados consolidados
airecon "export campaign report campaign_abc123"

AIRecon Error Handling e Retry Logic

AIRecon implementa error handling inteligente para ferramentas de intelligence:

# Se Naabu falhar (rate limiting), AIRecon automaticamente:
# 1. Aguarda backoff exponencial (2s, 4s, 8s...)
# 2. Tenta alternativa (rustscan, masscan)
# 3. Reporta falha após 3 retries

# Se Shodan API rate-limited:
# 1. Switch para Censys API
# 2. Fallback para OSINT passivo (Wayback Machine)
# 3. Notifica usuário sobre limitação

🤖 Watchtower Integration for Intelligence Gathering

Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza reconnaissance, vulnerability analysis, e report generation.

Invocando Watchtower para Intelligence Gathering

# Reconnaissance completo com Watchtower (PTES Phase 2)
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de reconnaissance
# - Worker Agent: Executa 23 ferramentas (nmap, subfinder, nuclei, etc.)
# - Analyst Agent: Analisa resultados e identifica vulnerabilidades

# Com LLM provider específico
python -m watchtower.main -t https://www.example.com \
  --provider openai \
  --model gpt-4o \
  --skip-ask-tools

# Com autenticação (authenticated pentest)
python -m watchtower.main -t https://www.example.com \
  --headers "Authorization: Bearer TOKEN" \
  --skip-ask-tools

Watchtower Slash Commands para Intelligence

# Iniciar reconnaissance automatizado
/watchtower-recon --target https://www.example.com --skip-ask-tools

# Gerar relatório PDF automático
/watchtower-report --input "pentest_report.pdf" --target https://www.example.com

# Executar ferramentas específicas
/watchtower-tool --tool nmap --target 192.168.1.0/24
/watchtower-tool --tool subfinder --target example.com
/watchtower-tool --tool nuclei --target https://example.com

MCP Tool Integration via Watchtower

Watchtower integra-se com MCP tools automaticamente durante reconnaissance:

# hexstrike-local: 23 ferramentas de segurança
# - nmap, masscan: Port scanning
# - httpx, whatweb: Web tech detection
# - wafw00f: WAF fingerprinting
# - subfinder, amass: Subdomain enumeration
# - dnsrecon: DNS enumeration
# - nuclei, nikto: Vulnerability scanning
# - sqlmap, wpscan: CMS-specific scanning
# - testssl.sh, sslyze: SSL/TLS analysis
# - gobuster, ffuf: Directory brute-forcing
# - arjun, kiterunner: Parameter discovery
# - xsstrike, dalfox: XSS detection
# - gitleaks: Secret detection
# - cmseek: CMS detection

# cve-mcp: CVE intelligence
# - search_cves: Busca CVEs por keyword
# - get_cve_summary: Resumo completo de CVE
# - check_exploit_availability: Verifica exploits públicos
# - get_epss_score: EPSS scoring

# pentestswarm-remote: Automated campaigns
# - start_campaign: Inicia campanha stateful
# - get_campaign_status: Monitora progresso
# - get_campaign_findings: Coleta resultados

# osint-remote: OSINT gathering
# - get_whois: Domain/IP WHOIS
# - get_certificates: Certificate transparency
# - get_threatfox: Malware IOCs
# - get_mitre_attack: MITRE ATT&CK mapping

# virustotal: Reputation analysis
# - get_domain_report: Domain analysis
# - get_ip_report: IP reputation
# - get_url_report: URL scanning

Workflow Example: Full Intelligence Gathering com Watchtower

# 1. Watchtower Planner analisa o target e planeja reconnaissance
python -m watchtower.main -t ht

…(truncated)