Effective Information Gathering Techniques for Businesses
Information Gathering
Business
Collect:
- crunchbase.com or www.inc.com
- Cached and archived sites: archive.org, Google (cache: URL)
Financial
- Harvesting (emails, files, PDFs, etc.):
CASE I
- theHarvester -d site -l 100 -b google
- ORG (domain): Google (site: filetype:)
Social Media
- People: LinkedIn, site:, www.pipl.com, Spokeo, People Finders, Crunchbase
Infrastructure
- Domains, Netblocks or IPs, MX, ISPs, etc.
- Whois – owner, DNS, MX, Exp
DNS Enumeration
- DNSdumpster, DNSenum, DNSmap
- nslookup site
- rev – nslookup -type=PTR
- nslookup -type=MX, NS
- Zone – nslookup, NS-ser, ls -d domain
- dig target PTR, MX, NS
- dig axfr @target.com target
IP
>>nslookup >>server 10.50.96.5>>set q=NS
4)
>>foocampus.com
Reverse
- nslookup NS or domain
- Bing IP:
- domain-neighbours, Robtex
- domain-tools
Netblocks & AS
- whois.arin.net, Maltego
- Foca, Fierce, Dmitry
Live Hosts
- fping -a -g IP/24
- nmap -sn IP/24 –disable-arp-ping
Further DNS
- nmap -sS -p53 IP
- nmap -sU -p53 IP
After retrieving the IP, perform a reverse lookup to find domains and perform a zone transfer.
>> nslookup
>> server 10.50.96.5
>> ns.foocampus.com
>>dig @10.50.96.5 foocampus.com -t AXFR +nocookie
>>host -t axfr foocampus.com 10.50.96.5
>> nslookup
>> server 10.50.96.5
>> set q=MX
>> foocampus.com