The script you're about to see in this video was written by a guy named Karimi a.k.a. that one Tester.
Now he is a fantastic resource and he writes some really great script.
So I'm going to be linking this script on the resources for the cause.
Go ahead.
Check it out and check out some of the other scripts that he has because they are fantastic.
So that being said let's go ahead and dive right in.
OK.
So now we are on my actual pen test machine and I wanted to show you this script because this is where
I keep it.
It looks very similar.
It's going to look similar.
It's just going to do a lot more.
OK.
So we have here all the different creations of folders and files.
You don't have to worry about this too much.
You can review this when you have the file.
And again I'm going to leave a pastebin of this in the references the pastebin will never expire.
So you'll have access to that and then we just come through here and a lot of this should look similar
already.
So I was building you up for it.
Right.
So we look through subdomains with asset finder we look through subdomains with M.S. And then we probe
for those alive domains.
And then I sort that out and I put that into an alive text and remove that file here.
So everything comes down we look for subdomains we find what's alive.
We put that into a live text and that's it sorted out.
So that should all look pretty familiar.
Then I do what is looking for a possible sub domain takeover attack meaning that these subdomain sometimes
are purchased but sometimes that the records are wrong or the subdomain is lapsed in payment or something
along those lines.
But basically what a subdomain takeover is it say you have test that Tesla dot com and they have not
renewed it or they don't own it or something happened with the record.
Well you go by test stop Tesla dot com and own that subdomain and you could take over there subdomain
and have a subdomain on their site.
So that is what a subdomain takeover is there's a tool out there called subject that you can utilize.
And I just run it against the final list as opposed to just the alive list to just see if it can find
any kind of subdomain takeover on top of that I want to scan for open ports.
I want to know not just what's running on eighty four four or three but I want to know if maybe they
have some kind of weird open port open right.
So like are they running.
3 3 8 9.
They're running RTP on their machine.
So I'll scan for alive ports to see what's out there.
Also do what is called scraping wayback data.
So if you've never heard of archive dot org or way back you are ls basically what those are historical
Web sites right.
So you can go to archive Dora right now and look at a Web site that maybe they go look at Facebook for
example you can look at Facebook from like 10 years ago and see exactly what Facebook looked like at
the time and it has all these things preserved.
So it's really nice and what you can do is you can go and scan with this tool way back or else it's
going to pull down anything that is potentially interesting with parameters right.
So it's going to pull down all these different parameter files javascript each Jamal Jason BHP aspects.
We're gonna take all these out of that output and sometimes there's information left behind.
There might be like stored credentials or a way that that code is kept in there.
We might find source code may find you know a key or something in these files that was there before
and even though it's not there anymore that key or that password might still work.
So it's important to look at the wayback machine and these you URLs to see if there's anything interesting
to us that we can leverage against a client or against the bug bounty or whatever.
Right.
And lastly I come through here and I run go witness and I run go witness against everything to take
those pictures that we talked about and to just make sure that everything I want to look at in a quick
format is there available to me and I put that all into a folder.
So with that all being said I just can run this script against one you url and it comes through here
and does all these things for me while I can go drink my coffee I can work on something else I can start
focusing on certain Web sites I can multitask because of this automation.
So this is just a big build up off of the Linux section from earlier and we've just been utilizing Linux
more and more and more and I wanted to throw out some more complex thinking and how you can utilize
this as an attacker.
And this is really this is it seems overwhelming but this is just running commands that you would run
anyway and then just echoing out a little bit extra stuff and putting it in order.
That's it a little bit of Kung Fu on the command line here with some of these things that you have to
do and think through but otherwise it's nothing crazy.
I promise it it may look like a lot but it's really it's not a lot.
So that's it for this section and that's it for the additional tools I want to just show you.
So from here we're going to go into web application penetration testing and we're going to start talking
about the top 10 I'm going to introduce you to burp suite at a deeper level.
That way we can cover it and understand what it does and then covered the top 10 attacks and possibly
some more.
So I'll catch you over in the next section.