JamesMarino/useful_information_gathering.md

## useful_information_gathering.md

      
    Raw
  

              useful_information_gathering.md
            
          
    Useful Information Gathering


List all DNS Records

dig any example.com @`dig +short  SOA example.com | cut -d' ' -f1`

Get Nameservers

nslookup 1.2.3.4

Directory Listing of Bucket - Access to Everyone

aws s3 ls s3://example.com/ --no-sign-request --region ap-southeast-2`

Directory Listing of Bucket - Access to Authenticated AWS Users

aws s3 ls s3://example.com/ --region ap-southeast-2

Copy all files from S3 Bucket

aws s3 sync s3://example.com/ . --no-sign-request --region ap-southeast-2

Scanning Ports

nmap example.com

Cloning a site

wget --mirror --convert-links --adjust-extension --page-requisites --no-parent "https://example.com"

Generating RSA Key Pairs

openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -pubout -in private_key.pem -out public_key.pem

ARP Poising

mitmf --arp --spoof --gateway <IP of Gateway> --target <IP of Target> -i eth0

DNS Spoofing

mitmf --arp --spoof --gateway <IP of Gateway> --target <IP of Target> -i eth0 --dns

Apache Server Directory Scrape

# Recursively
wget -r -np -nH –cut-dirs=3 -R index.html http://example.com/my/directory/

# Just in that directory
wget -m -np http://example.com/my/directory/
References


Flaws Site