Identify and map the external corporate footprint of a target organization. Use this skill at the absolute beginning of an engagement (Reconnaissance) to identify all registered domains, subdomains, IP ranges, and Autonomous System Numbers (ASNs) owned by the target. This skill forms the foundation for all subsequent external penetration testing and attack surface management.
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
# Concept: Large organizations have their own ASNs, representing huge blocks of IP addresses.
# We want to map these to find infrastructure they host themselves vs cloud hosting.
# 1. Start with the main domain or company name via BGPView API or Hurricane Electric (bgp.he.net)
curl -s "https://api.bgpview.io/search?query_term=tesla" | jq
# 2. Extract ASNs provided in the response (e.g., AS394380)
# 3. Use Amass to map ASNs to IP ranges
amass intel -asn 394380
# 4. Alternatively, use whois to lookup the organization name
whois -h whois.radb.net -- '-i origin AS394380' | grep -Eo "([0-9.]+){4}/[0-9]+"
# This gives you the CIDR blocks (e.g., 216.239.32.0/19) owned directly by the company.
# Concept: We have the main domain (target.com). Now we want to find OTHER root domains
# owned by the same company (target.net, target-holdings.com, acquired-startup.com).
# 1. Extract WHOIS registrant email or organization name from the main domain
whois target.com | grep "Registrant Organization\|Registrant Email"
# Result: Registrant Organization: Target Corp
# 2. Perform Reverse WHOIS (who owns domains matching this Org/Email?)
# Use Amass Intel module
amass intel -org "Target Corp"
amass intel -whois -d target.com
# 3. Use Crunchbase and Wikipedia to manually search for Subsidaries and Acquisitions.
# Add these root domains to your target list.
# Concept: Find thousands of subdomains (dev.target.com, api.target.com) without sending
# a single packet to the target's actual servers. Rely on third-party data.
# 1. Certificate Transparency Logs (crt.sh)
# Organizations must register TLS/SSL certs publicly.
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > subdomains_crt.txt
# 2. Use Subfinder (Rapid passive enumeration using multiple APIs)
subfinder -d target.com -all -silent > subdomains_subfinder.txt
# 3. Use theHarvester for search engine scraping
theHarvester -d target.com -b google,bing,linkedin,twitter -f target_harvest.html
# Concept: Actively query a massive list of potential subdomains against DNS resolvers
# to see which ones actually resolve to an IP address.
# 1. Powerful active enumeration mapping with Amass
amass enum -active -d target.com -brute -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -o amass_active.txt
# Note: Amass can take a long time. For pure speed, Puredns or Massdns is preferred.
# 2. Fast resolution with Puredns
puredns resolve combined_subdomains.txt -r public_resolvers.txt -w resolved_subdomains.txt
# We now have a list of all root domains, combined subdomains, and ASNs (CIDR blocks).
# 1. Clean and deduplicate lists
cat subdomains_*.txt | sort | uniq > final_subdomains.txt
# 2. Resolve final subdomains to IP addresses
cat final_subdomains.txt | httpx -silent -rt -ip
# These IPs and CIDR bounds are now ready for Phase 2: Mass Port Scanning (e.g., using Naabu or Masscan).
| Concept | Description |
|---|---|
| ASN | Autonomous System Number; uniquely identifies a network routing domain on the internet |
| CIDR | Classless Inter-Domain Routing; a method for allocating IP addresses and IP routing (e.g., a "/24" block) |
| Certificate Transparency | Publicly accessible logs of all issued SSL/TLS certificates |
| Active vs Passive Recon | Active touches the target's servers. Passive asks third parties about the target without touching them. |
OSINT Infrastructure Intel Report
=================================
Target Organization: MegaCorp Industries
1. Autonomous Systems Identified:
- AS12345 (MegaCorp US) -> Maps to 192.168.0.0/22
- AS67890 (MegaCorp EU) -> Maps to 10.0.0.0/24
2. Root Domains Identified (Via Reverse WHOIS):
- megacorp.com
- megacorp.net
- acquired-startup.io
- megacorp-staging.com
3. Subdomain Discovery Statistics:
- Certificate Logs (crt.sh): 432
- Passive Scraping (Subfinder): 856
- Active DNS Bruteforce (Amass): 120
- Total Unique Resolvable Subdomains: 1,024
Next Steps Approved: Initiate targeted port scanning against the 1,024 resolved endpoints and 2 identified CIDR blocks.
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
The English summary is being prepared. Showing the original description.
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
The English summary is being prepared. Showing the original description.
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
The English summary is being prepared. Showing the original description.
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
The English summary is being prepared. Showing the original description.
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
The English summary is being prepared. Showing the original description.
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
The English summary is being prepared. Showing the original description.