# Pentest Intelligence Gathering > PTES Phase 2 - Intelligence gathering for AWS security assessments - Skill: `bob-reis/pentest-intelligence-gathering` (Agent Skill) - Install (CLI): `npx skillmds@latest add bob-reis/pentest-intelligence-gathering` - Raw SKILL.md: https://api.skillmd.com/api/skills/bob-reis/pentest-intelligence-gathering/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: bob-reis (https://skillmd.com/u/bob-reis) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/bob-reis/pentest-intelligence-gathering --- # PTES Phase 2: Intelligence Gathering ## 🎯 pfSense Detection & Routing > **IMPORTANTE:** Se durante o OSINT ou footprinting você identificar **pfSense**, **ATIVE A SKILL `pentest-pfsense`** imediatamente. ### Indicadores de pfSense em OSINT ```bash # Shodan - Passive detection shodan search "product:pfsense" shodan search "http.title:pfSense" shodan search "org:Netgate" # Censys - Certificate and service discovery censys search "services.software.product=pfSense" censys search "services.http.response.html_title:pfSense" # Google Dorks site:target.com "pfSense" site:target.com "Netgate" intitle:"pfSense Login" ``` ### Sinais de Alerta em OSINT - [ ] Menções a "pfSense" ou "Netgate" em documentos públicos - [ ] Certificados SSL com CN=pfSense - [ ] Jobs/postagens mencionando pfSense - [ ] Configurações vazadas com referências pfSense - [ ] Screenshots públicos da web GUI ### Ação Imediata ```bash # Se pfSense detectado → ATIVAR pentest-pfsense skill # Esta skill continua para intelligence gathering geral # Use pentest-pfsense para: # - Passive reconnaissance específica (Shodan/Censys) # - CVE mapping para versão detectada # - Feature-based testing especializado ``` --- ## 🎯 cPanel & WHM Detection & Routing > **IMPORTANTE:** Se durante o OSINT ou footprinting você identificar **cPanel** ou **WHM**, **ATIVE A SKILL `pentest-exploitation`** para CVE-2026-41940. ### Indicadores de cPanel/WHM em OSINT ```bash # Shodan - Passive detection shodan search "product:cpanel" shodan search "http.title:cPanel" shodan search "http.title:WHM" shodan search "port:2087" # WHM shodan search "port:2083" # cPanel shodan search "port:2095" # cPanel Webmail shodan search "port:2096" # Webmail SSL # Censys - Certificate and service discovery censys search "services.software.product=cPanel" censys search "services.http.response.html_title:cPanel" censys search "services.http.response.html_title:WHM" # Google Dorks site:target.com "cPanel" site:target.com "WHM" intitle:"cPanel Login" intitle:"WHM Login" inurl:2087 inurl:2083 ``` ### Sinais de Alerta em OSINT - [ ] Menções a "cPanel" ou "WHM" em documentos públicos - [ ] Certificados SSL com CN=cPanel ou CN=WHM - [ ] Jobs/postagens mencionando cPanel hosting - [ ] Configurações vazadas com referências cPanel - [ ] Screenshots públicos do cPanel/WHM - [ ] Domínios com nameservers ns1.target.com, ns2.target.com (padrão cPanel) ### Indicadores de Rede Ativa ```bash # Port scanning com Naabu naabu -host target.com -p 2087,2083,2095,2096 -silent # HTTP probing com httpx httpx -u https://target.com:2087 -title -tech-detect httpx -u https://target.com:2083 -title -tech-detect # Banner grabbing curl -sk https://target.com:2087/login | grep -iE "cPanel|WHM" ``` ### Ação Imediata ```bash # Se cPanel/WHM detectado → ATIVAR pentest-exploitation skill # Testar CVE-2026-41940 (Authentication Bypass CVSS 9.8) python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \ -t https://TARGET:2087 -u admin -p password detect # Se vulnerável → Explorar python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \ -t https://TARGET:2087 -u admin -p password exploit ``` --- ## Seções PTES para Intelligence Gathering ### 2.1 OSINT (Open Source Intelligence) - **2.1.1 Corporate**: Informações da entidade legal, filings estaduais - **2.1.2 Physical**: Localizações físicas, proprietários, registros de impostos - **2.1.3 Datacenter Locations**: Fuso horário, produtos/serviços, organograma - **2.1.4 Relationships**: Charity affiliations, network providers, business partners ### 2.2 Individuals - **2.2.1 Social Networking Profiles** - **2.2.2 Social Networking Websites** - **2.2.3 Cree.py** para geolocalização ### 2.3 Internet Footprint - **2.3.1 Email addresses** (Maltego, TheHarvester, NetGlub) - **2.3.2 Usernames/Handles** - **2.3.3 Social Networks** (Newsgroups, Mailing Lists, Chat Rooms, Forums) - **2.3.4 Personal Domain Names** - **2.3.5 Personal Activities** (Audio, Video) - **2.3.6 Archived Information** - **2.3.7 Electronic Data** (Document leakage, Metadata leakage) ### 2.4 Covert Gathering - **2.4.1 On-location gathering** (Adjacent facilities, Physical security, Employee behavior) - **2.4.2 Frequency Usage** - **2.4.3 Equipment Identification** (Airmon-ng, Airodump-ng, Kismet, inSSIDer) ### 2.5 External Footprinting - **2.5.1 Identifying IP Ranges** (WHOIS lookup, BGP looking glasses) - **2.5.2 Active Reconnaissance** - **2.5.3 Passive Reconnaissance** - **2.5.4 Active Footprinting** (Zone transfers, Reverse DNS, DNS Bruting, **Port Scanning with Naabu**, SNMP Sweeps, Banner Grabbing) ### 2.6 Internal Footprinting - **2.6.1 Active Footprinting** (Ping Sweeps, Port Scanning, SNMP Sweeps, Banner Grabbing) --- ## Coleta de Informações com WorstAssume ### 1. Enumeração Inicial do Ambiente (PTES 2.5.4 - Active Footprinting) ```bash # Enumeração completa com stealth mode (jitter 0.3-1.2s entre API calls) worst enumerate --profile --region us-east-1 --stealth # Com credenciais explícitas worst enumerate --access-key AKIA... --secret-key ... --session-token ... # Com assume-role para contas cross-account worst enumerate --profile default --assume-role arn:aws:iam::TARGET:role/AuditRole # Enumeração multi-conta (script enum.sh) ./enum.sh > log.txt # Enumera 14+ contas em sequência ``` ### 2. Informações Coletadas Automaticamente (PTES 2.5 - External Footprinting) #### IAM Intelligence (Identidade) - worstassume/modules/iam.py - [ ] **Usuários IAM**: ARN, path, create_date, inline policies, attached policies - [ ] **Roles**: ARN, trust policy JSON, inline policies, attached policies - [ ] **Grupos**: ARN, path, memberships (users), policies attached - [ ] **Políticas Managed**: Document JSON, versions, attachment count - [ ] **Capability Map**: Permissões detectadas via probing (iam:ListUsers, iam:GetPolicy, etc.) - [ ] **Group Memberships**: User → Group mappings (herança de permissões) #### Recursos de Computação (worstassume/modules/*.py) - [ ] **EC2** (ec2.py): Instances, instance profiles, metadata options (IMDSv1/v2), tags - [ ] **Lambda** (lambda_.py): Functions, execution roles, triggers, environment variables - [ ] **ECS** (ecs.py): Clusters, services, task definitions, task roles - [ ] **VPC** (vpc.py): VPCs, subnets, security groups, endpoints #### Armazenamento e Dados - [ ] **S3** (s3.py): Buckets, bucket policies, ACLs, public access block - [ ] **Secrets Manager**: Secrets list (via capability probing) - [ ] **SSM Parameter Store**: Parameters (via capability probing) #### Rede (PTES 2.5.1 - IP Ranges) - [ ] **VPCs**: CIDR blocks, DHCP options, DNS settings - [ ] **Subnets**: AZ, CIDR, route tables, NAT gateways - [ ] **Security Groups**: Ingress/egress rules, referenced VPCs - [ ] **VPC Endpoints**: Interface/Gateway endpoints, policies ### 3. Workflow de Enumeração (WorstAssume Adaptive Enumeration) #### Fast Path vs Slow Path (worstassume/modules/iam.py) ``` FAST PATH (iam:GetAccountAuthorizationDetails): - 1 chamada API = todos usuários, grupos, roles, políticas - ~2-5 segundos para conta completa - Requer: iam:GetAccountAuthorizationDetails SLOW PATH (fallback quando fast path não disponível): - 50-200+ chamadas API individuais - ~30-120 segundos dependendo do tamanho da conta - Requer: iam:ListUsers, iam:ListRoles, iam:ListGroups, etc. CAPABILITY PROBING (worstassume/core/capability.py): Antes de enumerar, WorstAssume detecta automaticamente: - iam_full_dump: Pode usar fast path? - iam_list_users: Pode listar usuários? - iam_list_roles: Pode listar roles? - iam_list_policies: Pode listar políticas? - ec2_full, s3_full, lambda_full, etc. ``` #### Módulos de Enumeração (executados em sequência) ```bash # Cada módulo é executado com jitter (se --stealth) # Ordem de execução no worstassume/cli.py: 1. Identity (identity_mod.get_caller_identity) → Retorna: ARN, Account ID, Principal Type 2. IAM (iam.enumerate) → Usuários, Groups, Roles, Policies, Memberships 3. EC2 (ec2.enumerate) → Instances, Instance Profiles, Metadata Options 4. S3 (s3.enumerate) → Buckets, Bucket Policies 5. Lambda (lambda_.enumerate) → Functions, Execution Roles 6. ECS (ecs.enumerate) → Clusters, Task Definitions, Task Roles 7. VPC (vpc.enumerate) → VPCs, Subnets, Security Groups ``` ### 4. Cross-Account Intelligence (worstassume/core/cross_account.py) #### Inferência Automática de Trust Relationships ```bash # Após enumerar múltiplas contas, WorstAssume detecta automaticamente: worst accounts list # Mostra contas enumeradas # Cross-account links são inferidos sem chamadas API adicionais # Analisando trust policies das roles no banco de dados ``` #### Trust Relationships Mapeadas (PTES 2.1.4 - Relationships) ``` Cross-Account Links Detectados: ├── Account A (111111111111) → Account B (222222222222) │ └── Role: CrossAccountRole │ ├── Trust Principal: arn:aws:iam::111111111111:root │ ├── Wildcard: NO │ └── Condition: sts:ExternalId (presente) │ └── Account A (111111111111) → Account C (333333333333) └── Role: AdminCrossAccount ├── Trust Principal: * (wildcard!) ├── Wildcard: YES (CRITICAL!) └── Condition: NONE # Detectado por: worstassume/core/cross_account.py:build_cross_account_links() # Regex de extração: arn:aws[^:]*:[^:]*:[^:]*:(\d{12}): ``` #### Wildcard Trust Detection (CRITICAL Finding) ```python # Detecção automática durante análise de trust policies: if principal_block == "*": is_wildcard = True # Qualquer principal pode assumir severity = "CRITICAL" elif "aws:PrincipalOrgID" in condition: is_wildcard = True # Todo o organization pode assumir severity = "HIGH" ``` ### 5. Mapeamento de Superfície de Ataque (PTES 2.5.4 - Active Footprinting) #### Identidade Inicial (worstassume/modules/identity.py) ```bash # Identificar quem somos (PTES 2.5.4.7 - Banner Grabbing) aws sts get-caller-identity # Output esperado: # { # "UserId": "AIDAI...", # "Account": "123456789012", # "Arn": "arn:aws:iam::123456789012:user/auditor" # } ``` #### Capability Probing Results ``` Capability Map Exemplo (após enumeration): ├── iam_full_dump: TRUE (fast path disponível) ├── iam_list_users: TRUE ├── iam_list_roles: TRUE ├── iam_list_policies: TRUE ├── ec2_describe_instances: TRUE ├── s3_list_buckets: TRUE ├── lambda_list_functions: TRUE ├── ecs_list_clusters: TRUE └── vpc_describe_vpcs: TRUE ``` ### 6. Database e Persistência (worstassume/db/) #### SQLite Database Schema ``` Database: ~/.worstassume/db.sqlite Tables: ├── accounts (account_id, account_name, org_id, profile, last_enumerated_at) ├── runs (account_id, started_at, completed_at, capabilities_json, success) ├── principals (arn, name, principal_type, account_id, trust_policy_json, path) ├── policies (arn, name, policy_type, account_id, document_json) ├── resources (arn, name, service, resource_type, account_id, execution_role_id, extra_json) ├── principal_policies (principal_id, policy_id) ├── group_memberships (user_id, group_id) ├── cross_account_links (source_account_id, target_account_id, role_arn, trust_principal_arn, is_wildcard) └── security_findings (entity_arn, category, path_id, severity, message) ``` #### Comandos de Gestão de Database ```bash # Listar contas enumeradas worst accounts list # Output: # Account ID Name Principals Resources Last Enumerated # 123456789012 DEV-Prod 142 89 2026-04-24 15:30 # 222222222222 STG-Data 67 34 2026-04-24 16:45 # Deletar conta e todos os dados worst accounts delete 123456789012 # Exportar grafo para análise externa worst graph-export --output graph.json ``` ### 5. Análise Cross-Account Automática (PTES 2.1.4 - Relationships) ```bash # Após enumerar múltiplas contas, WorstAssume detecta automaticamente: # - Trust relationships entre contas # - Wildcard trust policies (Principal: *) # - Cross-account role assumptions ``` #### Trust Relationships Mapeadas ``` Cross-Account Links (PTES 2.1.4 - Relationships): - Account A (111111111111) → Account B (222222222222) └── Role: CrossAccountRole (Wildcard: YES) - Account A (111111111111) → Account C (333333333333) └── Role: DevRole (Wildcard: NO) ``` ### 6. Documentação da Inteligência (PTES 2.6 - Internal Footprinting) #### Inventário de Principais ``` Conta: 123456789012 ├── Usuários: 15 ├── Roles: 42 ├── Grupos: 8 ├── Políticas Managed: 25 └── Políticas Inline: 67 ``` #### Inventário de Recursos (PTES 2.5.4 - Active Footprinting) ``` Conta: 123456789012 ├── EC2 Instances: 120 ├── Lambda Functions: 35 ├── ECS Clusters: 5 ├── S3 Buckets: 28 └── VPCs: 12 ``` ### 7. Análise Preliminar de Riscos (PTES 3.3 - Attack Avenues) #### Red Flags Imediatas - [ ] Trust policies com `Principal: "*"` - [ ] Políticas com `Action: "*"` e `Resource: "*"` - [ ] IAM Users com console access sem MFA - [ ] Access keys antigas (> 90 dias) - [ ] EC2 instances com IMDSv1 habilitado - [ ] Lambda functions com permissões administrativas #### PTES 2.3.7 - Metadata Leakage - [ ] S3 buckets com listagem pública - [ ] EC2 metadata endpoint exposto (IMDSv1) - [ ] Lambda environment variables com secrets ### 8. Ferramentas de Inteligência (PTES Tools Required) #### WorstAssume Commands ```bash # Listar contas enumeradas worst accounts list # Exportar grafo para análise externa (PTES 6.2 - Technical Reporting) worst graph-export --output graph.json # Visualizar dashboard worst viz ``` #### AWS CLI Commands Úteis ```bash # Identidade (PTES 2.5.4.7 - Banner Grabbing) aws sts get-caller-identity # Região atual aws configure get region # Listar todas as regiões aws ec2 describe-regions --query 'Regions[].RegionName' # Descrever ranges de IP (PTES 2.5.1 - IP Ranges) aws ec2 describe-prefix-lists --query 'PrefixLists[?PrefixListName*`com.amazonaws']' ``` #### Ferramentas OSINT Externas (PTES Software) ```bash # theHarvester (PTES 2.3.1 - Email addresses) theHarvester -d target.com -b google,linkedin # Maltego (PTES 2.3.1.1) # Interface gráfica para OSINT correlation # Subfinder (PTES 2.3.4 - Domain Names) subfinder -d target.com -o domains.txt # Amass (PTES 2.3.4) amass enum -d target.com -o amass_domains.txt ``` --- ## Network Scanning e Firewall Mapping com Naabu e hping3 (PTES 2.5.4 - Active Footprinting) ### Naabu - Port Scanning Primário (Recomendado) **Naabu** é a ferramenta primária para port scanning neste framework. Use naabu para: - Enumeração rápida de portas em múltiplos hosts - Output estruturado (JSON/CSV) para integração com outras ferramentas - Scan de grandes ranges (CIDR) e listas de hosts - CDN/WAF detection automática - Integração nativa com httpx, nuclei, subfinder ```bash # Scan básico (top 100 ports) naabu -host target.com -silent # Todas as portas naabu -host target.com -p - -silent # Lista de hosts naabu -l hosts.txt -silent # Output JSON para pipeline naabu -host target.com -j -o output.json # Integração com httpx naabu -host target.com -silent | httpx -silent # Host discovery naabu -host 192.168.1.0/24 -sn -silent # CDN/WAF exclusion naabu -host target.com -ec -silent # Smart scan (predictive port scanning) naabu -host target.com -ss ``` **Ver `/root/.pcode/skills/pentest-network-scanning/SKILL.md` para documentação completa do Naabu.** ### Quando usar hping3 (Complementar) Use hping3 como ferramenta complementar quando: ### Host Discovery (PTES 2.5.4.1 - Ping Sweeps) ```bash # SYN scan na porta 80 para descobrir hosts vivos hping3 -S -p 80 --scan 1-254 192.168.1.1 # ICMP scan para host discovery hping3 -1 -c 5 192.168.1.1 # TCP ACK scan (bypass de firewalls stateless) hping3 -A -p 80 192.168.1.1 # UDP scan para discovery hping3 -2 -p 53 192.168.1.1 ``` ### Port Scanning (PTES 2.5.4.8 - Port Scanning) ```bash # SYN scan em range de portas (stealth scan) hping3 -S -p 1-1000 --scan target.com # Scan em portas específicas hping3 -S -p 22,80,443,8080 --scan target.com # XMAS scan (difícil de detectar por IDS) hping3 -F -P -U -p 1-1000 --scan target.com # NULL scan (sem flags) hping3 -O -p 1-1000 --scan target.com ``` ### Firewall Ruleset Mapping (PTES 2.5.4 - Active Footprinting) ```bash # Testar se firewall permite SYN hping3 -S -p 80 target.com # SYN-ACK = porta aberta # RST = porta fechada # Sem resposta = filtrada # Testar se firewall é stateful (ACK scan) hping3 -A -p 80 target.com # RST = porta não filtrada (firewall stateless) # Sem resposta = firewall stateful ou drop # Mapear regras com TTL customizado hping3 -S -p 80 -t 64 target.com hping3 -S -p 80 -t 128 target.com ``` ### Template de Finding - Network Discovery com hping3 ``` FINDING: NETWORK-DISCOVERY-HPING3 CATEGORY: RECONNAISSANCE SEVERITY: INFO PTES: 2.5.4 - Active Footprinting TARGET: - IP/Hostname: [target] - Portas descobertas: [lista] - Hosts ativos: [lista] DESCRIPTION: Host discovery e port scanning via hping3 identificou [X] hosts ativos e [Y] portas abertas na rede alvo. hping3 permitiu bypass de filtros que bloqueavam scans tradicionais do nmap. EVIDENCE: hping3 -S -p 1-1000 --scan [target] [Output do scan] TECHNIQUE: - SYN scan (-S): Identifica portas abertas via SYN-ACK - ACK scan (-A): Mapeia firewalls stateless - XMAS scan (-FPU): Evasão de IDS básico PTES REFERENCE: Section 2.5.4 (Active Footprinting) ``` ### Advanced: Packet Crafting para Evasão (PTES 4.1.1 - Countermeasure Bypass) ```bash # Random source IP (spoofing para testes de IDS/IPS) hping3 -S -p 80 --rand-source target.com # Fragmented packets (bypass de ACLs fracas) hping3 -S -p 80 -f target.com # Don't fragment flag hping3 -S -p 80 -y target.com # Custom TTL para OS fingerprinting hping3 -S -p 80 -t 64 target.com # Windows típico hping3 -S -p 80 -t 128 target.com # Linux típico # Source address spoofing hping3 -S -p 80 -a 10.0.0.1 target.com ``` ### ICMP Tunneling Detection (PTES 2.4 - Covert Gathering) ```bash # Testar se ICMP é permitido (potencial tunnel vector) hping3 -1 -d 1024 target.com # ICMP com data payload # Large ICMP packets (covert channel testing) hping3 -1 -d 65000 target.com # ICMP timestamp request hping3 -1 -C 13 -K 0 target.com ``` ### Rate Control e Stealth (PTES 2.4.3 - Equipment Identification) ```bash # Scan lento para evitar detecção hping3 -S -p 1-1000 -i u100000 target.com # 100ms entre packets # Scan moderado hping3 -S -p 1-1000 --fast target.com # 10 packets/segundo # Scan rápido (pode ser detectado) hping3 -S -p 1-1000 --faster target.com # 100 packets/segundo ``` ### Traceroute Mode (PTES 2.5.1 - IP Ranges) ```bash # Traceroute via SYN packets hping3 -S -p 80 -T traceroute target.com # Traceroute via ICMP hping3 -1 -T traceroute target.com # Traceroute com TTL fixo (monitorar hop específico) hping3 -S -p 80 -t 5 --tr-keep-ttl target.com ``` ### Record Route (PTES 2.5.1 - Identifying IP Ranges) ```bash # Incluir RECORD_ROUTE option hping3 -S -p 80 -G target.com # Loose source routing hping3 -S -p 80 --lsrr target.com # Strict source routing hping3 -S -p 80 --ssrr target.com ``` --- ## 9. OWASP Nettacker for Intelligence Gathering (PTES 2.5 - External Footprinting) > **NOTE:** Nettacker complementa Naabu e hping3 com **detecção automática de tecnologias**, **subdomain enumeration**, e **WAF detection** em uma única ferramenta. ### 9.1 Subdomain Enumeration com Nettacker ```bash # Enumeração passiva de subdomínios (sem scan ativo) docker run --rm owasp/nettacker -i target.com -m subdomain_scan # Subdomínios + detecção de tecnologias docker run --rm owasp/nettacker -i target.com -m subdomain_scan,web_technologies_scan # Output JSON para integração docker run --rm -v $(pwd):/tmp owasp/nettacker \ -i target.com -m subdomain_scan \ --json-output /tmp/subdomains.json # API integration API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}') curl -k -X POST "https://localhost:5000/new/scan" \ -d "key=${API_KEY}&targets=target.com&selected_modules=subdomain_scan" ``` **Template de Finding - Subdomain Discovery:** ``` FINDING: SUBDOMAIN-DISCOVERY-NETTACKER CATEGORY: RECONNAISSANCE SEVERITY: INFO PTES: 2.5.2 - Active Reconnaissance TARGET: target.com SUBDOMAINS FOUND: [X] - api.target.com (203.0.113.10) - admin.target.com (203.0.113.11) - dev.target.com (203.0.113.12) DESCRIPTION: Nettacker subdomain enumeration identified [X] subdomains through passive OSINT sources and DNS brute-forcing. Several subdomains expose administrative interfaces and development environments. EVIDENCE: docker run --rm owasp/nettacker -i target.com -m subdomain_scan REMEDIATION: - Implement DNS zone transfer restrictions - Remove unused subdomains from DNS - Apply WAF to exposed administrative subdomains - Consider DNS wildcard records for unused prefixes PTES REFERENCE: Section 2.5.2 (Active Reconnaissance) ``` ### 9.2 Web Technology Detection (PTES 2.5.4.7 - Banner Grabbing) ```bash # Detecção de tecnologias web (CMS, frameworks, servidores) docker run --rm owasp/nettacker -i target.com -m web_technologies_scan # CMS-specific detection docker run --rm owasp/nettacker -i target.com \ -m wordpress_scan,joomla_scan,drupal_scan # Output detalhado com versões docker run --rm owasp/nettacker -i target.com -m web_technologies_scan \ --graph-output /tmp/report.html ``` **Tecnologias Detectadas Automaticamente:** - CMS: WordPress, Joomla, Drupal - Web Servers: Apache, Nginx, IIS, LiteSpeed - Frameworks: Django, Flask, Laravel, Express, Rails - JavaScript: React, Vue, Angular - Analytics: Google Analytics, Facebook Pixel - CDNs: Cloudflare, Akamai, Fastly - WAFs: ModSecurity, Cloudflare, AWS WAF **Template de Finding - Technology Stack:** ``` FINDING: TECH-STACK-DETECTION CATEGORY: RECONNAISSANCE SEVERITY: INFO PTES: 2.5.4.7 - Banner Grabbing TARGET: https://target.com TECHNOLOGIES DETECTED: - WordPress 6.4.2 (CMS) - Apache 2.4.57 (Web Server) - PHP 8.1.12 (Runtime) - Cloudflare (CDN/WAF) - Google Analytics (Tracking) DESCRIPTION: Nettacker web technologies scan identified the complete technology stack. WordPress version disclosure allows targeting version-specific CVEs. Cloudflare presence indicates WAF bypass techniques may be required. RISK ASSESSMENT: - WordPress 6.4.2: Check WPScan for plugin vulnerabilities - Apache 2.4.57: Check CVE-2023-25690, CVE-2023-31122 - PHP 8.1.12: Check for deserialization vulnerabilities PTES REFERENCE: Section 2.5.4.7 (Banner Grabbing) ``` ### 9.3 WAF Detection (PTES 2.5.4 - Active Footprinting) ```bash # WAF detection e fingerprinting docker run --rm owasp/nettacker -i target.com -m waf_scan # WAF + tecnologias web docker run --rm owasp/nettacker -i target.com -m waf_scan,web_technologies_scan # API integration curl -k -X POST "https://localhost:5000/new/scan" \ -d "key=${API_KEY}&targets=target.com&selected_modules=waf_scan" ``` **WAF Products Detected:** - ModSecurity, Cloudflare, AWS WAF, Azure WAF - Akamai Kona, F5 BIG-IP ASM, Imperva - Barracuda, Citrix NetScaler, FortiWeb - NAXSI, URLScan, Yundun ### 9.4 Admin Panel Discovery (PTES 2.5.4 - Active Footprinting) ```bash # Admin panel discovery com wordlists otimizadas docker run --rm owasp/nettacker -i target.com -m admin_scan # Admin + directory enumeration docker run --rm owasp/nettacker -i target.com -m admin_scan,dir_scan # Custom wordlist docker run --rm -v $(pwd)/wordlists:/wordlists owasp/nettacker \ -i target.com -m admin_scan \ --scan-args "-w /wordlists/admin-panels.txt" ``` **Paths Comuns Testados:** ``` /admin, /administrator, /wp-admin, /phpmyadmin /login, /signin, /dashboard, /console /manager, /cpanel, /webmail, /controlpanel ``` ### 9.5 Directory Enumeration (PTES 2.5.4 - Active Footprinting) ```bash # Directory brute forcing docker run --rm owasp/nettacker -i target.com -m dir_scan # Directory + file enumeration docker run --rm owasp/nettacker -i target.com \ -m dir_scan --scan-args "--wordlist /usr/share/wordlists/dirb/common.txt" # Recursive scanning docker run --rm owasp/nettacker -i target.com -m dir_scan \ --scan-args "--depth 3" ``` ### 9.6 Reverse IP Lookup (PTES 2.5.1 - Identifying IP Ranges) ```bash # ViewDNS reverse IP lookup (shared hosting detection) docker run --rm owasp/nettacker -i target.com -m viewdns_reverse_iplookup_scan # Identificar outros domínios no mesmo IP # Útil para descobrir siblings em shared hosting ``` ### 9.7 Full Recon Workflow (Nettacker + Existing Tools) ```bash # Step 1: Subdomain enumeration (Nettacker) docker run --rm owasp/nettacker -i target.com -m subdomain_scan \ --json-output /tmp/subdomains.json # Step 2: Extract live domains jq -r '.[] | select(.result.subdomain_found == true) | .result.subdomain_found' \ /tmp/subdomains.json | tee live_subdomains.txt # Step 3: Port scanning (Naabu - mais rápido para grandes ranges) naabu -l live_subdomains.txt -o ports.json -j # Step 4: Web tech detection (Nettacker) for domain in $(cat live_subdomains.txt); do docker run --rm owasp/nettacker -i $domain -m web_technologies_scan \ --json-output /tmp/tech_${domain}.json & done wait # Step 5: WAF detection (Nettacker) for domain in $(cat live_subdomains.txt); do docker run --rm owasp/nettacker -i $domain -m waf_scan \ --json-output /tmp/waf_${domain}.json & done wait # Step 6: Consolidate results cat /tmp/tech_*.json | jq -s '.' > /tmp/tech_consolidated.json cat /tmp/waf_*.json | jq -s '.' > /tmp/waf_consolidated.json ``` ### 9.8 Nettacker + OSINT Combined Workflow ```bash # Step 1: Shodan passive recon shodan search "org:TargetCorp" > shodan_results.txt # Step 2: Censys certificate search censys search "services.http.response.html_title:TargetCorp" > censys_certs.txt # Step 3: Nettacker subdomain enumeration docker run --rm owasp/nettacker -i target.com -m subdomain_scan \ --json-output nettacker_subs.json # Step 4: Wayback Machine historical URLs waybackurls target.com > wayback_urls.txt # Step 5: Consolidate all sources cat shodan_results.txt censys_certs.txt nettacker_subs.json wayback_urls.txt \ | sort -u > consolidated_recon.txt # Step 6: Filter for sensitive paths grep -iE "admin|login|api|backup|config|dev|staging" consolidated_recon.txt ``` ### 9.9 Comparison: Nettacker vs Subfinder for Subdomain Enum | Feature | Nettacker | Subfinder | |---------|-----------|-----------| | **Sources** | Built-in OSINT + DNS brute | 40+ passive sources | | **Speed** | Moderate | Very fast | | **Integration** | Part of full scan workflow | Standalone + httpx pipeline | | **Output** | JSON, HTML, CSV | TXT, JSON | | **Best For** | Combined recon + vuln scan | Fast subdomain-only enum | **Recommended Workflow:** ```bash # Use Subfinder for initial fast enumeration subfinder -d target.com -o subs_fast.txt # Use Nettacker for deep scan with DNS brute-forcing docker run --rm owasp/nettacker -i target.com -m subdomain_scan # Combine results cat subs_fast.txt nettacker_subs.txt | sort -u > all_subs.txt # Proceed with Naabu + httpx + nuclei cat all_subs.txt | naabu -silent | httpx -silent | nuclei ``` --- ## 10. Username Enumeration com security-usernames ### Recursos Disponíveis (`security-usernames` plugin) ``` Local: `seclists-categories usernames/usernames/references/` Wordlists Disponíveis: - `Names/names.txt` - Nomes comuns para enumeration - `top-usernames-shortlist.txt` - Top usernames para teste rápido - `cirt-default-usernames.txt` - Default accounts de serviços ``` ### Técnicas de Username Enumeration ```bash # Usar wordlists com ffuf ffuf -w seclists-categories/usernames/top-usernames-shortlist.txt \ -u https://target.com/users/FUZZ \ -mc 200 # Usar com curl para teste de existência for user in $(cat seclists-categories/usernames/cirt-default-usernames.txt); do curl -s -o /dev/null -w "%{http_code}" "https://target.com/api/users/$user" done # Integrar com ferramentas OSINT theHarvester -d target.com -b google,linkedin subfinder -d target.com -o domains.txt ``` ### Default Accounts para Testar (cirt-default-usernames.txt) ``` admin, root, test, guest, user, operator service, backup, oracle, postgres, mysql tomcat, jenkins, deploy, www-data ``` --- ## 11. API Key Discovery com security-patterns ### Recursos Disponíveis (`security-patterns` plugin) ``` Local: `seclists-categories pattern-matching/pattern-matching/references/` Patterns Disponíveis: - `malicious.txt` - Padrões de código malicioso - `pcap-strings.txt` - Strings para análise de PCAP - `php-auditing.txt` - Patterns para auditoria PHP - `grepstrings-basic.txt` - Strings básicas para grep - `errors.txt` - Padrões de mensagens de erro ``` ### Pattern Matching para API Keys ```bash # AWS Access Keys grep -rE "AKIA[0-9A-Z]{16}" . 2>/dev/null # Google Cloud API Keys grep -rE "AIza[0-9A-Za-z_-]{35}" . 2>/dev/null # GitHub Tokens grep -rE "ghp_[0-9a-zA-Z]{36}" . 2>/dev/null # Generic API Keys grep -riE "api[_-]?key.*[=:]\s*['\"][0-9a-zA-Z]{32,}['\"]" . 2>/dev/null # Private Keys grep -r "BEGIN.*PRIVATE KEY" . 2>/dev/null # Passwords em código grep -riE "password\s*[=:]\s*['\"][^'\"]+['\"]" . 2>/dev/null ``` ### Script de Scan Automatizado ```python import re import os patterns = { 'AWS_KEY': r'AKIA[0-9A-Z]{16}', 'GCP_KEY': r'AIza[0-9A-Za-z_-]{35}', 'GITHUB_TOKEN': r'ghp_[0-9a-zA-Z]{36}', 'GENERIC_API_KEY': r'api[_-]?key.*[=:]\s*['"][0-9a-zA-Z]{32,}['"]', 'GENERIC_SECRET': r'secret.*[=:]\s*['"][0-9a-zA-Z]{32,}['"]', 'PASSWORD': r'password\s*[=:]\s*['"][^'"]+['"]', 'PRIVATE_KEY': r'BEGIN.*PRIVATE KEY' } def scan_file(filepath): with open(filepath, 'r', errors='ignore') as f: content = f.read() for name, pattern in patterns.items(): matches = re.findall(pattern, content, re.IGNORECASE) if matches: print(f"[{name}] Found in {filepath}: {len(matches)} matches") for root, dirs, files in os.walk('.'): for file in files: if file.endswith(('.py', '.js', '.env', '.config', '.json', '.yaml', '.yml')): scan_file(os.path.join(root, file)) ``` ### Integração com Bug Bounty Recon (bug-bounty-hunter agent) ```bash # Subdomain enumeration + API key discovery subfinder -d target.com -o subdomains.txt cat subdomains.txt | httpx -silent | while read url; do curl -s "$url" | grep -oE "AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}" done # GitHub reconnaissance curl -s "https://api.github.com/orgs/target/repos" | jq '.[].clone_url' ``` --- ## 12. Output Esperado desta Fase (PTES Deliverables) 1. **Inventário completo de IAM principals** (PTES 2.5 - External Footprinting) 2. **Inventário de recursos AWS** (PTES 2.5.4 - Active Footprinting) 3. **Mapa de trust relationships cross-account** (PTES 2.1.4 - Relationships) 4. **Lista inicial de misconfigurações** (PTES 3.1 - Vulnerability Testing) 5. **Capability map das credenciais atuais** (PTES 2.5.4 - Active Footprinting) 6. **OSINT report** com domínios, emails, e infraestrutura externa (PTES 2.1 - OSINT) 7. **Network diagram** com ranges de IP e VPCs (PTES 2.5.1 - IP Ranges) 8. **Username enumeration report** (security-usernames plugin) 9. **API key discovery report** (security-patterns plugin) 10. **Asset graph** com 29 tipos de assets e edge taxonomy (PTES 2.5.4) 11. **Subdomain enumeration results** (crt.sh + fallback chain) 12. **Dork corpus findings** (80+ Google dork templates) 13. **Java middleware fingerprint** (Spring Boot, Tomcat, WebLogic detection) 14. **Information leak checklist** (.git, .env, backup files, API docs) 15. **Zseano methodology application** (parameter insights, testing sequence) 16. **Bug bounty triage analysis** (high-value targets and features) 17. **Email security posture** (SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC) ## Próximos Passos Após completar esta fase, prossiga para **pentest-threat-modeling** (PTES Phase 3) --- ## 🤖 AIRecon Integration for Intelligence Gathering AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante intelligence gathering para automatizar OSINT, network scanning, e descoberta de credenciais. ### Invocando AIRecon para Intelligence Gathering ```bash # AIRecon com keywords de OSINT e network discovery airecon "pentest intelligence gathering osint network scan target.com" # AIRecon detectará keywords e carregará: # - pentest-intelligence-gathering.md (skill primária) # - pentest-network-scanning.md (para network scan) # - MCP tools: hexstrike (nmap, naabu), cve-mcp, pentestswarm # Para pfSense-specific OSINT: airecon "pfsense osint shodan censys reconnaissance" # Para API key discovery: airecon "api key discovery github secrets scan target" ``` ### AIRecon Slash Commands Úteis para Intelligence Gathering ```bash # Network scanning com Naabu integrado /naabu-scan --target target.com -p 443,8443,22,80 /naabu-scan --target 192.168.1.0/24 -p - -silent # API key discovery em repositórios e código /api-keys --target ./src --recursive /api-keys --target https://github.com/org/repo --scan-type github # Wordlist generation para brute-force /wordlist --type usernames --length 6 /wordlist --type passwords --length 8 --include-symbols ``` ### MCP Tool Integration via AIRecon Durante intelligence gathering, AIRecon pode invocar MCP tools automaticamente: ```bash # hexstrike-local: nmap, naabu, nuclei scans airecon "scan target.com with nmap version detection" # → Usará mcp__hexstrike-local__nmap_scan airecon "run naabu port scan on 192.168.1.0/24" # → Usará mcp__hexstrike-local__rustscan_fast_scan ou naabu_scan airecon "run nuclei vulnerability scan on target.com" # → Usará mcp__hexstrike-local__nuclei_scan # pentestswarm-remote: Automated reconnaissance campaigns airecon "start reconnaissance campaign for example.com" # → Usará mcp__pentestswarm-remote__start_campaign # → Retornará campaign_id para monitoramento # cve-mcp: CVE lookup para tecnologias detectadas airecon "check CVEs for Apache 2.4.57" # → Usará mcp__cve-mcp__search_cves # virustotal: Domain e IP reputation airecon "check domain reputation for suspicious-domain.com" # → Usará mcp__virustotal__get_domain_report # osint-remote: Username e email OSINT airecon "search username john.doe across social networks" # → Usará mcp__osint-remote__maigret_search ``` ### Workflow Example: Intelligence Gathering com AIRecon + Naabu + Nettacker ```bash # 1. Usar AIRecon para OSINT inicial airecon "osint reconnaissance target.com subdomain enumeration" # 2. AIRecon auto-carrega pentest-intelligence-gathering.md # 3. Invocar Naabu via AIRecon para port scanning airecon "/naabu-scan --target target.com -p - -silent" # 4. Invocar Nettacker via AIRecon para tech detection airecon "docker run --rm owasp/nettacker -i target.com -m web_technologies_scan" # 5. AIRecon processa output e consolida findings # 6. Exportar para relatório de intelligence gathering airecon "export findings to JSON for stakeholder review" ``` ### Workflow Example: pfSense-Specific Intelligence ```bash # 1. Passive OSINT com Shodan/Censys via AIRecon airecon "shodan search product:pfsense org:target" # 2. AIRecon detecta pfSense e ativa pentest-pfsense skill # 3. Version detection via AIRecon airecon "censys search services.http.title:pfSense" # 4. CVE mapping automático airecon "check CVEs for pfSense 2.7.0" # → Usará mcp__cve-mcp__search_cves com filtro de severidade # 5. Exportar findings airecon "export pfsense intelligence report" ``` ### AIRecon Auto-Skill Loading para Intelligence | Keywords Detectadas | Skills Carregadas | MCP Tools Ativados | |---------------------|-------------------|---------------------| | `osint` `subdomain` | pentest-intelligence-gathering | osint-remote, hexstrike | | `network scan` `naabu` | pentest-network-scanning | hexstrike (nmap, rustscan) | | `api key` `secret` | pentest-intelligence-gathering | hexstrike (scan_repo_secrets) | | `pfsense` `firewall` | pentest-pfsense | shodan, cve-mcp | | `cpanel` `whm` | pentest-exploitation | cve-mcp (CVE-2026-41940) | | `username enum` | pentest-intelligence-gathering | hexstrike (hydra, http_intruder) | ### AIRecon + PentestSwarm Campaign Integration ```bash # Iniciar campanha de reconnaissance automatizada airecon "start pentestswarm campaign for target.com" # PentestSwarm retornará campaign_id: # campaign_abc123 # Monitorar progresso da campanha airecon "get campaign status campaign_abc123" # Buscar findings da campanha airecon "get campaign findings campaign_abc123" # Exportar resultados consolidados airecon "export campaign report campaign_abc123" ``` ### AIRecon Error Handling e Retry Logic AIRecon implementa error handling inteligente para ferramentas de intelligence: ```bash # Se Naabu falhar (rate limiting), AIRecon automaticamente: # 1. Aguarda backoff exponencial (2s, 4s, 8s...) # 2. Tenta alternativa (rustscan, masscan) # 3. Reporta falha após 3 retries # Se Shodan API rate-limited: # 1. Switch para Censys API # 2. Fallback para OSINT passivo (Wayback Machine) # 3. Notifica usuário sobre limitação ``` --- ## 🤖 Watchtower Integration for Intelligence Gathering Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza reconnaissance, vulnerability analysis, e report generation. ### Invocando Watchtower para Intelligence Gathering ```bash # Reconnaissance completo com Watchtower (PTES Phase 2) python -m watchtower.main -t https://www.example.com --skip-ask-tools # Watchtower executará automaticamente: # - Planner Agent: Planeja workflow de reconnaissance # - Worker Agent: Executa 23 ferramentas (nmap, subfinder, nuclei, etc.) # - Analyst Agent: Analisa resultados e identifica vulnerabilidades # Com LLM provider específico python -m watchtower.main -t https://www.example.com \ --provider openai \ --model gpt-4o \ --skip-ask-tools # Com autenticação (authenticated pentest) python -m watchtower.main -t https://www.example.com \ --headers "Authorization: Bearer TOKEN" \ --skip-ask-tools ``` ### Watchtower Slash Commands para Intelligence ```bash # Iniciar reconnaissance automatizado /watchtower-recon --target https://www.example.com --skip-ask-tools # Gerar relatório PDF automático /watchtower-report --input "pentest_report.pdf" --target https://www.example.com # Executar ferramentas específicas /watchtower-tool --tool nmap --target 192.168.1.0/24 /watchtower-tool --tool subfinder --target example.com /watchtower-tool --tool nuclei --target https://example.com ``` ### MCP Tool Integration via Watchtower Watchtower integra-se com MCP tools automaticamente durante reconnaissance: ```bash # hexstrike-local: 23 ferramentas de segurança # - nmap, masscan: Port scanning # - httpx, whatweb: Web tech detection # - wafw00f: WAF fingerprinting # - subfinder, amass: Subdomain enumeration # - dnsrecon: DNS enumeration # - nuclei, nikto: Vulnerability scanning # - sqlmap, wpscan: CMS-specific scanning # - testssl.sh, sslyze: SSL/TLS analysis # - gobuster, ffuf: Directory brute-forcing # - arjun, kiterunner: Parameter discovery # - xsstrike, dalfox: XSS detection # - gitleaks: Secret detection # - cmseek: CMS detection # cve-mcp: CVE intelligence # - search_cves: Busca CVEs por keyword # - get_cve_summary: Resumo completo de CVE # - check_exploit_availability: Verifica exploits públicos # - get_epss_score: EPSS scoring # pentestswarm-remote: Automated campaigns # - start_campaign: Inicia campanha stateful # - get_campaign_status: Monitora progresso # - get_campaign_findings: Coleta resultados # osint-remote: OSINT gathering # - get_whois: Domain/IP WHOIS # - get_certificates: Certificate transparency # - get_threatfox: Malware IOCs # - get_mitre_attack: MITRE ATT&CK mapping # virustotal: Reputation analysis # - get_domain_report: Domain analysis # - get_ip_report: IP reputation # - get_url_report: URL scanning ``` ### Workflow Example: Full Intelligence Gathering com Watchtower ```bash # 1. Watchtower Planner analisa o target e planeja reconnaissance python -m watchtower.main -t ht …(truncated)