Hey there, welcome to the course Reconnaissance with OWASP Amass. In here,
we'll cover how to use some advanced recon techniques for enumerating domains.
Your first step on a red team engagement is the recon phase, and in this phase,
one of your main tasks is to enumerate all the domains of your target so
then you can decide what you'll try to attack first.
Usually what most people do is running some DNS queries to identify which
domains belongs to a company, and although this works,
it usually does not identify all the domains of a company.
Nowadays, we have several more advanced techniques for domain enumeration,
which will return you way more valid domains to test.
For example,
we can search open source databases for all the domains related to a
company, or we can check the history of the certificates generated for
a company, or we can use some APIs to third‑party tools to get domain
information, or we could even check some web archives to see if there's
any domains in the past that were open to the public. As you can
imagine, doing all those advanced recon techniques manually takes a lot
of time.
For this reason, we have the Amass tool, which automates all those techniques I
mentioned before, as well as a few other recon techniques.
The Amass tool was mainly developed by Jeff Foley and
Anthony Rhodes, and thanks to those guys,
we can save a lot of time doing a red team engagement.
If you never heard about Jeff or Anthony before, I do
recommend you checking their work.
They have a lot of interesting publications out there.
The OWASP Amass tool can be described as a tool for performing
network mapping of attack surfaces and external asset discovery
using open source information gathering.
Also, we can do a lot of active reconnaissance techniques with this tool.
In other words,
Amass uses several passive and active techniques to find
as much domain information as possible.
What I love about Amass is that it is an open source tool,
meaning that if you access this GitHub page,
you can download the source code for free or you can even edit the
source code and customize it for your needs.
Also,
it is important to remember that Amass is part of the OWASP project,
which stands for Open Web Application Security Project.
If you never heard about OWASP before,
I definitely recommend you checking it out. As I mentioned before,
Amass allows us to discover the attack surface of our target, and
this tool uses several advanced recon techniques to identify domains
and IPs related to our target, so then we can pick which domains we
want to focus first.
Also,
Amass has a really cool feature in which it generates a graph
showing the relationship between the domains and the sub domains,
and you've seen our demo how this graphic can be helpful to
better understand our target.
In the previous slide,
I mentioned that Amass has some more advanced recon techniques,
and you might be wondering what are those?
Amass has several ways of discovering new domains,
but the ones that I've found more interesting are brute forcing,
alterations, reverse WHOIS, and searching web archives.
The domain brute force you might have heard before. Basically,
Amass tries several non‑subdomain names.
For example,
if you are doing the recon against the Globomantics
domain, Amass will try web.globomantics,
mail.globomantics, ftp.globomantics, and much more.
The domain alterations is basically mutating the
domain names to find similar servers.
For example, let's say we found a server called dc01.globomantics.com.
Then Amass will also try dc02.globomantics.com and dc03.globomantics,com.
The reverse WHOIS is an interesting one.
First Amass does a basic WHOIS search against our target domain, and
then extracts some key information, for example,
the email address of the administrator of that domain.
Then Amass does a reverse search looking for all the domains registered for the
same email address, which might result in similar domains.
And finally, the web archive is also an interesting one.
Basically, Amass uses web archive websites to find old websites related to
Globomantics, and from those archives you can find domains that might not even
be available anymore and might be worth checking it out.
Those are just some of the techniques that Amass performs in the
background, and for this reason I think Amass is one of the best
tools for identifying subdomains.
If you're familiar with the red team kill chain methodology,
we can map the Amass tool to the recon phase of this process.
In here, we use Amass to discover subdomains and IP
addresses related to our target.
Also, if you're familiar with the MITRE ATT&CK framework,
we can map this course to the reconnaissance phase.
In this phase, we focus on one main technique which is
Search Open Technical Databases.
Inside of this technique we cover three main sub‑techniques, which are
DNS, WHOIS, and digital certificates, and the good news is Amass performs
all those techniques automatically for us,
which means that we're doing all those searches with just one tool.
If you want to follow the demos of this course,
all you need is an attacker machine.
In here.
I'm using a Kali Linux virtual machine,
but you can actually use Amass in any Linux version you want.
The installation process is really simple. So, if you're ready,
let's go to our lab environment.