In this recipe, we will set up a few tools beforehand; not to worry, we will be covering their usage in detail in later chapters.

Here is a list of some tools that we will need before we dive deeper into penetration testing. Don't worry, we will learn about their usage with some real-life examples in the next few chapters. But those of us who are excited about them right now can run the following simple commands to view the -help section where toolname is the name of the tool we would like to view the help of:

toolname -help
toolname -h

We will be looking at two tools in this section.

Aquatone is a tool for visually inspecting websites across a large amount of hosts and is convenient for quickly gaining an overview of an HTTP-based attack surface. Aquatone has four major modules: discover, scanner, gather, and takeover. Each of these can be used to perform in-depth enumeration of a target:

1. We will use a simple command to install aquatone:

gem install aquatone

The following screenshot shows the output of the preceding command:

2. Next, we create a directory in /root/folder using the following command:

mkdir /root/aquatone/

3. As aquatone uses different modules to hunt for subdomains, we will have to configure aquatone's discovery module before running it.
4. For example, to configure the shodan, we can use the following command:

aquatone-discover --set-key shodan XXXXXXXXXXX

The following screenshot shows the output of the preceding command:

5. Similarly, we can set keys for other services too, such as Censys and PassiveTotal.
6. Once it is all set, we can start our subdomain hunting. We can do this using the following command:

aquatone-discover -d domain.com

The following screenshot shows the output of the preceding command:

7. Aquatone also allows us to set a custom wordlist by using the -w flag, and we can also set the threads by using the -t flag.
8. By default, aquatone stores the output in TXT as well as JSON format in the /root/aquatone/ directory.
9. After we find the subdomains, we can use the aquatone scanner to scan for open ports on the discovered hosts. Let's look at an example:

aquatone-scan --ports 80 -d packtpub.com

The following screenshot shows the output of the preceding command:

10. This will look for the domain's hosts.json file in the aquatone directory.
    Aquatone by default has four inbuilt port scanning flags (small, medium, large, and huge). These flags will decide the number of ports being scanned on the hosts, or we can define custom ports by using the -ports flag.
    • aquatone-gather: This tool makes a connection to the web services found using the discover and scanner modules of aquatone and takes screenshots of discovered web pages for later analysis.
    • aquatone-takeover: This module is used to find subdomains that are vulnerable to the subdomain takeover vulnerability.

Let's refer to the following screenshot:

Subfinder is considered as a successor to sublist3r. It is amazingly fast and finds valid subdomains using passive online sources such as Ask, Archive.is, Baidu, Bing, Censys, CertDB, CertSpotter, Commoncrawl, CrtSH, DnsDB and so on.

1. Install subfinder. It needs Go to be installed, which we can install by using the following command:

apt install golang

The following screenshot shows the output of the preceding command:

2. Next, we clone subfinder by using the following command:

git clone https://github.com/subfinder/subfinder.git

The following screenshot shows the output of the preceding command:

Or you can download and save it from https://github.com/subfinder/subfinder.

3. To install subfinder, we go to the cloned directory and run the go build command.
4. Once the installation is complete, we will need a wordlist for it to run, so we can download dnspop's list. This list can be used in the previous recipe too: https://github.com/bitquark/dnspop/tree/master/results.
5. Now that both are set up, we browse into subfinder's directory and run it using the ./subfinder -h command.

The following screenshot shows the output of the preceding command:

6. To run it against a domain with our wordlist, we use the following command:

./subfinder -w /path/to/wordlist -d hostname.com

If we do not specify a wordlist the tool will run with a default wordlist as shown in the following screenshot:

Once the enumeration is complete, the output will be shown onscreen as follows:

7. Subfinder is also designed to work with services such as shodan, censys, and virustotal, but they need to be configured in the config.json file shown here:

A subdomain takeover vulnerability exists when a service that previously pointed to a subdomain is removed but the CNAME record still exists. More information can be read about it at the following GitHub link: https://github.com/EdOverflow/can-i-take-over-xyz/.

Aquatone-takeover is based on the same methodology described by EdOverflow at the preceding URL.